Latest update.

Configurations/00-base-templates.conf

@@ -42,7 +42,6 @@ my %targets=(
 	shared_defines	=> [],
 	shared_ldflag	=> "",
 	shared_rcflag	=> "",
-	shared_extension	=> "",
 
 	#### Defaults for the benefit of the config targets who don't inherit
 	#### a BASE and assume Unix defaults
@@ -102,10 +101,10 @@ my %targets=(
                                      ? "ranlib" : "" },
         RC              => "windres",
 
-        shared_extension => ".so",
-
         build_scheme    => [ "unified", "unix" ],
         build_file      => "Makefile",
+
+        perl_platform   => 'Unix',
     },
 
     BASE_Windows => {
@@ -144,10 +143,10 @@ my %targets=(
         mtinflag        => "-manifest ",
         mtoutflag       => "-outputresource:",
 
-        shared_extension => ".dll",
-
         build_file      => "makefile",
         build_scheme    => [ "unified", "windows" ],
+
+        perl_platform   => 'Windows',
     },
 
     BASE_VMS => {
@@ -164,10 +163,10 @@ my %targets=(
                     return [ @incs ];
                 }),
 
-        shared_extension => ".exe",
-
         build_file       => "descrip.mms",
         build_scheme     => [ "unified", "VMS" ],
+
+        perl_platform    => 'VMS',
     },
 
     uplink_common => {

Configurations/10-main.conf

@@ -212,7 +212,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         thread_scheme    => "pthreads",
         shared_target    => "solaris",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         shared_ldflag    => "-Wl,-Bsymbolic",
         shared_defflag   => "-Wl,-M,",
         shared_sonameflag=> "-Wl,-h,",
@@ -365,7 +364,6 @@ my %targets = (
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
         shared_target    => "self",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         shared_ldflag    => "-shared -Wl,-Bsymbolic",
         shared_sonameflag=> "-Wl,-soname,",
     },
@@ -534,7 +532,6 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT",
         shared_cflag     => "+Z",
         shared_ldflag    => add_before("-b"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux32",
     },
     "hpux64-ia64-cc" => {
@@ -548,7 +545,6 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         shared_cflag     => "+Z",
         shared_ldflag    => add_before("-b"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux64",
     },
     # GCC builds...
@@ -562,7 +558,6 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT",
         shared_cflag     => "-fpic",
         shared_ldflag    => add_before("-shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux32",
     },
     "hpux64-ia64-gcc" => {
@@ -575,7 +570,6 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         shared_cflag     => "-fpic",
         shared_ldflag    => add_before("-shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux64",
     },
 
@@ -652,7 +646,6 @@ my %targets = (
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => sub { $disabled{pinshared} ? () : "-Wl,-znodelete" },
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         enable           => [ "afalgeng" ],
     },
     "linux-generic64" => {
@@ -906,7 +899,6 @@ my %targets = (
         shared_target    => "linux-shared",
         shared_cflag     => "--pic",
         shared_ldflag    => add("-z --sysv --shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => "true",
     },
 
@@ -933,7 +925,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "BSD-generic64" => {
         inherit_from     => [ "BSD-generic32" ],
@@ -991,7 +982,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 
     "nextstep" => {
@@ -1052,7 +1042,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "svr5-shared",
         shared_cflag     => "-Kpic",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "unixware-7-gcc" => {
         inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
@@ -1067,7 +1056,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "gnu-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 # SCO 5 - Ben Laurie says the -O breaks the SCO cc.
     "sco5-cc" => {
@@ -1080,7 +1068,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "svr3-shared",
         shared_cflag     => "-Kpic",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "sco5-gcc" => {
         inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
@@ -1093,7 +1080,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "svr3-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 
 #### IBM's AIX.
@@ -1114,8 +1100,6 @@ my %targets = (
         module_ldflags   => "-Wl,-G,-bsymbolic,-bexpall",
         shared_ldflag    => "-Wl,-G,-bsymbolic",
         shared_defflag   => "-Wl,-bE:",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
-        dso_extension    => ".so",
         lib_extension    => shared("_a.a"),
         shared_extension_simple => shared(".a"),
     },
@@ -1235,6 +1219,7 @@ my %targets = (
         dso_scheme       => "win32",
         apps_aux_src     => add("win32_init.c"),
         bn_ops           => "EXPORT_VAR_AS_FN",
+        perl_platform    => 'Windows::MSVC',
         # additional parameter to build_scheme denotes install-path "flavour"
         build_scheme     => add("VC-common", { separator => undef }),
     },
@@ -1375,30 +1360,37 @@ my %targets = (
     },
 
 #### MinGW
-    "mingw" => {
+    "mingw-common" => {
-        inherit_from     => [ "BASE_unix", asm("x86_asm"),
+        inherit_from     => [ 'BASE_unix' ],
-                              sub { $disabled{shared} ? () : "x86_uplink" } ],
+        template         => 1,
         CC               => "gcc",
         CFLAGS           => picker(default => "-Wall",
                                    debug   => "-g -O0",
-                                   release => "-O3 -fomit-frame-pointer"),
+                                   release => "-O3"),
-        cflags           => "-m32",
         cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
                                     threads("-D_MT")),
         lib_cppflags     => "-DL_ENDIAN",
-        sys_id           => "MINGW32",
         ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
-        bn_ops           => "BN_LLONG EXPORT_VAR_AS_FN",
+        bn_ops           => "EXPORT_VAR_AS_FN",
         thread_scheme    => "winthreads",
-        perlasm_scheme   => "coff",
         dso_scheme       => "win32",
         shared_target    => "mingw-shared",
         shared_cppflags  => add("_WINDLL"),
         shared_ldflag    => "-static-libgcc",
-        shared_rcflag    => "--target=pe-i386",
-        shared_extension => ".dll",
-        multilib         => "",
         apps_aux_src     => add("win32_init.c"),
+
+        perl_platform    => 'mingw',
+    },
+    "mingw" => {
+        inherit_from     => [ "mingw-common", asm("x86_asm"),
+                              sub { $disabled{shared} ? () : "x86_uplink" } ],
+        CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
+        cflags           => "-m32",
+        sys_id           => "MINGW32",
+        bn_ops           => add("BN_LLONG"),
+        perlasm_scheme   => "coff",
+        shared_rcflag    => "--target=pe-i386",
+        multilib         => "",
     },
     "mingw64" => {
         # As for OPENSSL_USE_APPLINK. Applink makes it possible to use
@@ -1409,28 +1401,13 @@ my %targets = (
         # consider its binaries for using with non-mingw64 run-time
         # environment. And as mingw64 is always consistent with itself,
         # Applink is never engaged and can as well be omitted.
-        inherit_from     => [ "BASE_unix", asm("x86_64_asm") ],
+        inherit_from     => [ "mingw-common", asm("x86_64_asm") ],
-        CC               => "gcc",
-        CFLAGS           => picker(default => "-Wall",
-                                   debug   => "-g -O0",
-                                   release => "-O3"),
         cflags           => "-m64",
-        cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
-                                    threads("-D_MT")),
-        lib_cppflags     => "-DL_ENDIAN",
         sys_id           => "MINGW64",
-        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
+        bn_ops           => add("SIXTY_FOUR_BIT"),
-        bn_ops           => "SIXTY_FOUR_BIT EXPORT_VAR_AS_FN",
-        thread_scheme    => "winthreads",
         perlasm_scheme   => "mingw64",
-        dso_scheme       => "win32",
-        shared_target    => "mingw-shared",
-        shared_cppflags  => add("_WINDLL"),
-        shared_ldflag    => "-static-libgcc",
         shared_rcflag    => "--target=pe-x86-64",
-        shared_extension => ".dll",
         multilib         => "64",
-        apps_aux_src     => add("win32_init.c"),
     },
 
 #### UEFI
@@ -1454,37 +1431,34 @@ my %targets = (
     },
 
 #### Cygwin
-    "Cygwin-x86" => {
+    "Cygwin-common" => {
         inherit_from     => [ "BASE_unix", asm("x86_asm") ],
-        CC               => "gcc",
+        template         => 1,
-        CFLAGS           => picker(default => "-Wall",
+
-                                   debug   => "-g -O0",
-                                   release => "-O3 -fomit-frame-pointer"),
-        lib_cppflags     => "-DTERMIOS -DL_ENDIAN",
-        sys_id           => "CYGWIN",
-        bn_ops           => "BN_LLONG",
-        thread_scheme    => "pthread",
-        perlasm_scheme   => "coff",
-        dso_scheme       => "dlfcn",
-        shared_target    => "cygwin-shared",
-        shared_cppflags  => "-D_WINDLL",
-        shared_extension => ".dll",
-    },
-    "Cygwin-x86_64" => {
-        inherit_from     => [ "BASE_unix", asm("x86_64_asm") ],
         CC               => "gcc",
         CFLAGS           => picker(default => "-Wall",
                                    debug   => "-g -O0",
                                    release => "-O3"),
         lib_cppflags     => "-DTERMIOS -DL_ENDIAN",
         sys_id           => "CYGWIN",
-        bn_ops           => "SIXTY_FOUR_BIT_LONG",
         thread_scheme    => "pthread",
-        perlasm_scheme   => "mingw64",
         dso_scheme       => "dlfcn",
         shared_target    => "cygwin-shared",
         shared_cppflags  => "-D_WINDLL",
-        shared_extension => ".dll",
+
+        perl_platform    => 'Cygwin',
+    },
+    "Cygwin-x86" => {
+        inherit_from     => [ "Cygwin-common", asm("x86_asm") ],
+        CFLAGS           => add(picker(release => "-O3 -fomit-frame-pointer")),
+        bn_ops           => "BN_LLONG",
+        perlasm_scheme   => "coff",
+    },
+    "Cygwin-x86_64" => {
+        inherit_from     => [ "Cygwin-common", asm("x86_64_asm") ],
+        CC               => "gcc",
+        bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        perlasm_scheme   => "mingw64",
     },
     # Backward compatibility for those using this target
     "Cygwin" => {
@@ -1571,7 +1545,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 
 ##### VxWorks for various targets
@@ -1687,7 +1660,6 @@ my %targets = (
         dso_scheme       => sub { env('LIBSSL_dlfcn') },
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => sub { env('RANLIB') },
     },
     "uClinux-dist64" => {
@@ -1700,7 +1672,6 @@ my %targets = (
         dso_scheme       => sub { env('LIBSSL_dlfcn') },
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => sub { env('RANLIB') },
     },
 

Configurations/15-android.conf

@@ -22,13 +22,18 @@
                 return $android_ndk = { bn_ops => "BN_AUTO" };
             }
 
-            my $ndk = $ENV{ANDROID_NDK};
+            my $ndk_var;
-            die "\$ANDROID_NDK is not defined"  if (!$ndk);
+            my $ndk;
+            foreach $ndk_var (qw(ANDROID_NDK_HOME ANDROID_NDK)) {
+                $ndk = $ENV{$ndk_var};
+                last if defined $ndk;
+            }
+            die "\$ANDROID_NDK_HOME is not defined"  if (!$ndk);
             if (!-d "$ndk/platforms" && !-f "$ndk/AndroidVersion.txt") {
                 # $ndk/platforms is traditional "all-inclusive" NDK, while
                 # $ndk/AndroidVersion.txt is so-called standalone toolchain
                 # tailored for specific target down to API level.
-                die "\$ANDROID_NDK=$ndk is invalid";
+                die "\$ANDROID_NDK_HOME=$ndk is invalid";
             }
             $ndk = canonpath($ndk);
 
@@ -90,7 +95,7 @@
                 (my $tridefault = $triarch) =~ s/^arm-/$arm-/;
                 (my $tritools   = $triarch) =~ s/(?:x|i6)86(_64)?-.*/x86$1/;
                 $cflags .= " -target $tridefault "
-                        .  "-gcc-toolchain \$(ANDROID_NDK)/toolchains"
+                        .  "-gcc-toolchain \$($ndk_var)/toolchains"
                         .  "/$tritools-4.9/prebuilt/$host";
                 $user{CC} = "clang" if ($user{CC} !~ m|clang|);
                 $user{CROSS_COMPILE} = undef;
@@ -127,13 +132,13 @@
                 die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
                 $incroot =~ s|^$ndk/||;
                 $cppflags  = "-D__ANDROID_API__=$api";
-                $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot/$triarch";
+                $cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
-                $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot";
+                $cppflags .= " -isystem \$($ndk_var)/$incroot";
             }
 
             $sysroot =~ s|^$ndk/||;
             $android_ndk = {
-                cflags   => "$cflags --sysroot=\$(ANDROID_NDK)/$sysroot",
+                cflags   => "$cflags --sysroot=\$($ndk_var)/$sysroot",
                 cppflags => $cppflags,
                 bn_ops   => $arch =~ m/64$/ ? "SIXTY_FOUR_BIT_LONG"
                                             : "BN_LLONG",

Configurations/50-haiku.conf

@@ -15,7 +15,7 @@ my %targets = (
         shared_target    => "gnu-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => "-shared",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+        perl_platform    => 'Unix',
     },
     "haiku-x86" => {
         inherit_from     => [ "haiku-common", asm("x86_elf_asm") ],

Configurations/90-team.norelease.conf

@@ -28,7 +28,6 @@ my %targets = (
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => "-m64",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "64",
     },
     "debug-linux-pentium" => {
@@ -77,7 +76,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "debug-test-64-clang" => {
         inherit_from     => [ 'BASE_unix', "x86_64_asm" ],
@@ -90,7 +88,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "darwin64-debug-test-64-clang" => {
         inherit_from     => [ 'BASE_unix', "x86_64_asm" ],

Configurations/README

@@ -446,23 +446,6 @@ support building static libraries and DLLs at the same time, so using
 static libraries on Windows can only be done when configured
 'no-shared'.
 
-One some platforms, shared libraries come with a name that's different
-from their static counterpart.  That's declared as follows:
-
-    SHARED_NAME[libfoo]=cygfoo-{- $config{shlibver} -}
-
-The example is from Cygwin, which has a required naming convention.
-
-Sometimes, it makes sense to rename an output file, for example a
-library:
-
-    RENAME[libfoo]=libbar
-
-That line has "libfoo" renamed to "libbar".  While it makes no
-sense at all to just have a rename like that (why not just use
-"libbar" everywhere?), it does make sense when it can be used
-conditionally.  See a little further below for an example.
-
 In some cases, it's desirable to include some source files in the
 shared form of a library only:
 
@@ -571,15 +554,6 @@ conditions based on something in the passed variables, for example:
       SOURCE[libfoo]=...
     ENDIF
 
-or:
-
-    # VMS has a cultural standard where all libraries are prefixed.
-    # For OpenSSL, the choice is 'ossl_'
-    IF[{- $config{target} =~ /^vms/ -}]
-     RENAME[libcrypto]=ossl_libcrypto
-     RENAME[libssl]=ossl_libssl
-    ENDIF
-
 
 Build-file programming with the "unified" build system
 ======================================================

Configurations/common.tmpl

@@ -52,18 +52,6 @@
      map { $replace{$_} // $_; } @newlist;
  }
 
- # is_installed checks if a given file will be installed (i.e. they are
- # not defined _NO_INST in build.info)
- sub is_installed {
-     my $product = shift;
-     if (grep { $product eq $_ }
-         map { (@{$unified_info{install}->{$_}}) }
-         keys %{$unified_info{install}}) {
-         return 1;
-     }
-     return 0;
- }
-
  # dogenerate is responsible for producing all the recipes that build
  # generated source files.  It recurses in case a dependency is also a
  # generated source file.
@@ -129,26 +117,28 @@
      return "" if $cache{$lib};
      unless ($disabled{shared} || $lib =~ /\.a$/) {
          my $obj2shlib = defined &obj2shlib ? \&obj2shlib : \&libobj2shlib;
-         $OUT .= $obj2shlib->(shlib => $unified_info{sharednames}->{$lib},
+         $OUT .= $obj2shlib->(lib => $lib,
-                              lib => $lib,
+                              attrs => $unified_info{attributes}->{$lib},
                               objs => $unified_info{shared_sources}->{$lib},
-                              deps => [ reducedepends(resolvedepends($lib)) ],
+                              deps => [ reducedepends(resolvedepends($lib)) ]);
-                              installed => is_installed($lib));
          foreach ((@{$unified_info{shared_sources}->{$lib}},
                    @{$unified_info{sources}->{$lib}})) {
              # If this is somehow a compiled object, take care of it that way
              # Otherwise, it might simply be generated
              if (defined $unified_info{sources}->{$_}) {
-                 doobj($_, $lib, intent => "shlib", installed => is_installed($lib));
+                 doobj($_, $lib, intent => "shlib",
+                       attrs => $unified_info{attributes}->{$lib});
              } else {
                  dogenerate($_, undef, undef, intent => "lib");
              }
          }
      }
      $OUT .= obj2lib(lib => $lib,
+                     attrs => $unified_info{attributes}->{$lib},
                      objs => [ @{$unified_info{sources}->{$lib}} ]);
      foreach (@{$unified_info{sources}->{$lib}}) {
-         doobj($_, $lib, intent => "lib", installed => is_installed($lib));
+         doobj($_, $lib, intent => "lib",
+               attrs => $unified_info{attributes}->{$lib});
      }
      $cache{$lib} = 1;
  }
@@ -160,14 +150,15 @@
      my $lib = shift;
      return "" if $cache{$lib};
      $OUT .= obj2dso(lib => $lib,
+                     attrs => $unified_info{attributes}->{$lib},
                      objs => $unified_info{shared_sources}->{$lib},
-                     deps => [ resolvedepends($lib) ],
+                     deps => [ resolvedepends($lib) ]);
-                     installed => is_installed($lib));
      foreach (@{$unified_info{shared_sources}->{$lib}}) {
          # If this is somehow a compiled object, take care of it that way
          # Otherwise, it might simply be generated
          if (defined $unified_info{sources}->{$_}) {
-             doobj($_, $lib, intent => "dso", installed => is_installed($lib));
+             doobj($_, $lib, intent => "dso",
+                   attrs => $unified_info{attributes}->{$lib});
          } else {
              dogenerate($_, undef, $lib, intent => "dso");
          }
@@ -182,11 +173,12 @@
      return "" if $cache{$bin};
      my $deps = [ reducedepends(resolvedepends($bin)) ];
      $OUT .= obj2bin(bin => $bin,
+                     attrs => $unified_info{attributes}->{$bin},
                      objs => [ @{$unified_info{sources}->{$bin}} ],
-                     deps => $deps,
+                     deps => $deps);
-                     installed => is_installed($bin));
      foreach (@{$unified_info{sources}->{$bin}}) {
-         doobj($_, $bin, intent => "bin", installed => is_installed($bin));
+         doobj($_, $bin, intent => "bin",
+               attrs => $unified_info{attributes}->{$bin});
      }
      $cache{$bin} = 1;
  }
@@ -197,8 +189,8 @@
      my $script = shift;
      return "" if $cache{$script};
      $OUT .= in2script(script => $script,
-                       sources => $unified_info{sources}->{$script},
+                       attrs => $unified_info{attributes}->{$script},
-                       installed => is_installed($script));
+                       sources => $unified_info{sources}->{$script});
      $cache{$script} = 1;
  }
 

Configurations/descrip.mms.tmpl

@@ -5,12 +5,9 @@
   use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
   use File::Basename;
 
-  # Our prefix, claimed when speaking with the VSI folks Tuesday
+  (our $osslprefix_q = platform->osslprefix()) =~ s/\$/\\\$/;
-  # January 26th 2016
-  our $osslprefix = 'OSSL$';
-  (our $osslprefix_q = $osslprefix) =~ s/\$/\\\$/;
 
-  our $sover_dirname = sprintf "%02d%02d", split(/\./, $config{shlib_version});
+  our $sover_dirname = platform->shlib_version_as_filename();
   our $osslver = sprintf "%02d%02d", split(/\./, $config{version});
 
   our $sourcedir = $config{sourcedir};
@@ -44,27 +41,43 @@
   # Because we need to make two computations of these data,
   # we store them in arrays for reuse
   our @libs =
-      map { (my $x = $_) =~ s/\.a$//; $x }
+      map { platform->staticname($_) }
       @{$unified_info{libraries}};
   our @shlibs =
-      map { $unified_info{sharednames}->{$_} || () }
+      map { platform->sharedname($_) // () }
-      grep(!/\.a$/, @{$unified_info{libraries}});
+      @{$unified_info{libraries}};
   our @install_libs =
-      map { (my $x = $_) =~ s/\.a$//; $x }
+      map { platform->staticname($_) }
-      @{$unified_info{install}->{libraries}};
+      grep { !$unified_info{attributes}->{$_}->{noinst} }
+      @{$unified_info{libraries}};
   our @install_shlibs =
-      map { $unified_info{sharednames}->{$_} || () }
+      map { platform->sharedname($_) // () }
-      grep(!/\.a$/, @{$unified_info{install}->{libraries}});
+      grep { !$unified_info{attributes}->{$_}->{noinst} }
+      @{$unified_info{libraries}};
+  our @install_engines =
+      grep { !$unified_info{attributes}->{$_}->{noinst} }
+      @{$unified_info{engines}};
+  our @install_programs =
+      grep { !$unified_info{attributes}->{$_}->{noinst} }
+      @{$unified_info{programs}};
+  our @install_bin_scripts =
+      grep { !$unified_info{attributes}->{$_}->{noinst}
+             && !$unified_info{attributes}->{$_}->{misc} }
+      @{$unified_info{scripts}};
+  our @install_misc_scripts =
+      grep { !$unified_info{attributes}->{$_}->{noinst}
+             && $unified_info{attributes}->{$_}->{misc} }
+      @{$unified_info{scripts}};
 
   # This is a horrible hack, but is needed because recursive inclusion of files
   # in different directories does not work well with HP C.
   my $sd = sourcedir("crypto", "async", "arch");
   foreach (grep /\[\.crypto\.async\.arch\].*\.o$/, keys %{$unified_info{sources}}) {
-      (my $x = $_) =~ s|\.o$|.OBJ|;
+      my $obj = platform->obj($_);
-      $unified_info{before}->{$x}
+      $unified_info{before}->{$obj}
           = qq(arch_include = F\$PARSE("$sd","A.;",,,"SYNTAX_ONLY") - "A.;"
         define arch 'arch_include');
-      $unified_info{after}->{$x}
+      $unified_info{after}->{$obj}
           = qq(deassign arch);
   }
   my $sd1 = sourcedir("ssl","record");
@@ -72,13 +85,13 @@
   my @ssl_locl_users = grep(/^\[\.(?:ssl\.(?:record|statem)|test)\].*\.o$/,
                             keys %{$unified_info{sources}});
   foreach (@ssl_locl_users) {
-      (my $x = $_) =~ s|\.o$|.OBJ|;
+      my $obj = platform->obj($_);
-      $unified_info{before}->{$x}
+      $unified_info{before}->{$obj}
           = qq(record_include = F\$PARSE("$sd1","A.;",,,"SYNTAX_ONLY") - "A.;"
         define record 'record_include'
         statem_include = F\$PARSE("$sd2","A.;",,,"SYNTAX_ONLY") - "A.;"
         define statem 'statem_include');
-      $unified_info{after}->{$x}
+      $unified_info{after}->{$obj}
           = qq(deassign statem
         deassign record);
   }
@@ -110,39 +123,27 @@ MINOR={- $config{minor} -}
 SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 SHLIB_TARGET={- $target{shared_target} -}
 
-EXE_EXT=.EXE
-LIB_EXT=.OLB
-SHLIB_EXT=.EXE
-OBJ_EXT=.OBJ
-DEP_EXT=.D
-
 LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @libs) -}
 SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @shlibs) -}
 ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{engines}}) -}
 PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{programs}}) -}
 SCRIPTS={- join(", ", map { "-\n\t".$_ } @{$unified_info{scripts}}) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- our @deps = map { (my $x = $_) =~ s|\.o$|\$(DEP_EXT)|; $x; }
+DEPS={- our @deps = map { platform->isobj($_) ? platform->dep($_) : $_ }
                     grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
                     keys %{$unified_info{sources}};
         join(", ", map { "-\n\t".$_ } @deps); -}
 {- output_on() if $disabled{makedepend}; "" -}
 GENERATED_MANDATORY={- join(", ", map { "-\n\t".$_ } @{$unified_info{depends}->{""}} ) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(", ", map { my $x = $_;
+             join(", ", map { platform->convertext($_) } @generated) -}
-                              $x =~ s|\.[sS]$|.asm|;
-                              $x =~ s|\.ld$|.OPT|;
-                              "-\n\t".$x }
-                        @generated) -}
 
 INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @install_libs) -}
 INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -}
-INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{engines}}) -}
+INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @install_engines) -}
-INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{programs}}) -}
+INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @install_programs) -}
-{- output_off() if $disabled{apps}; "" -}
+BIN_SCRIPTS={- join(", ", @install_bin_scripts) -}
-BIN_SCRIPTS=[.tools]c_rehash.pl
+MISC_SCRIPTS={- join(", ", @install_misc_scripts) -}
-MISC_SCRIPTS=[.apps]CA.pl, [.apps]tsget.pl
-{- output_on() if $disabled{apps}; "" -}
 
 APPS_OPENSSL={- use File::Spec::Functions;
                 catfile("apps","openssl") -}
@@ -165,9 +166,9 @@ OPENSSLDIR={- catdir($config{openssldir}) or
               $config{prefix} ? catdir($config{prefix},"COMMON")
                               : "SYS\$COMMON:[OPENSSL-COMMON]" -}
 # The same, but for C
-OPENSSLDIR_C={- $osslprefix -}DATAROOT:[000000]
+OPENSSLDIR_C={- platform->osslprefix() -}DATAROOT:[000000]
 # Where installed engines reside, for C
-ENGINESDIR_C={- $osslprefix -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
+ENGINESDIR_C={- platform->osslprefix() -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
 
 ##### User defined commands and flags ################################
 
@@ -565,7 +566,7 @@ install_engines : check_INSTALLTOP install_runtime_libs build_engines
         - CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
         {- join("\n        ",
                 map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" }
-                @{$unified_info{install}->{engines}}) -}
+                @install_engines) -}
         @ {- output_on() unless scalar @{$unified_info{engines}}; "" -} !
 
 install_runtime : install_programs
@@ -694,12 +695,10 @@ reconfigure reconf :
   # Helper function to figure out dependencies on libraries
   # It takes a list of library names and outputs a list of dependencies
   sub compute_lib_depends {
-      if ($disabled{shared}) {
+      # Depending on shared libraries:
-          return map { $_ =~ /\.a$/ ? $`.".OLB" : $_.".OLB" } @_;
+      # On Windows POSIX layers, we depend on {libname}.dll.a
-      }
+      # On Unix platforms, we depend on {shlibname}.so
-      return map { $_ =~ /\.a$/
+      return map { platform->sharedlib($_) // platform->staticlib($_) } @_;
-                   ? $`.".OLB"
-                   : $unified_info{sharednames}->{$_}.".EXE" } @_;
   }
 
   # Helper function to deal with inclusion directory specs.
@@ -750,8 +749,8 @@ reconfigure reconf :
       my $generator_incs = join("", map { ' "-I'.$_.'"' } @{$args{generator_incs}});
       my $deps = join(", -\n\t\t", @{$args{generator_deps}}, @{$args{deps}});
 
-      if ($args{src} =~ /\.ld$/) {
+      if (platform->isdef($args{src})) {
-          (my $target = $args{src}) =~ s/\.ld$/.OPT/;
+          my $target = platform->def($args{src});
           my $mkdef = sourcefile('util', 'mkdef.pl');
           my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
           my $ord_name =
@@ -763,7 +762,7 @@ reconfigure reconf :
 $target : $args{generator}->[0] $deps $mkdef
 	\$(PERL) $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name "--OS" "VMS"$case_insensitive > $target
 EOF
-      } elsif ($args{src} !~ /\.[sS]$/) {
+      } elsif (!platform->isasm($args{src})) {
           my $target = $args{src};
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
 	      my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
@@ -781,7 +780,7 @@ $target : $args{generator}->[0] $deps
 EOF
 	  }
       } else {
-          (my $target = $args{src}) =~ s/\.[sS]$/.asm/;
+          my $target = platform->asm($args{src});
           if ($args{generator}->[0] =~ /\.pl$/) {
               $generator = '$(PERL)'.$generator_incs.' '.$generator;
           } elsif ($args{generator}->[0] =~ /\.S$/) {
@@ -844,9 +843,8 @@ EOF
 
   sub src2obj {
       my %args = @_;
-      my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x
+      my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x } ( @{$args{srcs}} );
-                     } ( @{$args{srcs}} );
+      my $obj = platform->obj($args{obj});
-      (my $obj = $args{obj}) =~ s|\.o$||;
       my $deps = join(", -\n\t\t", @srcs, @{$args{deps}});
 
       # Because VMS C isn't very good at combining a /INCLUDE path with
@@ -858,23 +856,37 @@ EOF
       my $forward = dirname($args{srcs}->[0]);
       my $backward = abs2rel(rel2abs("."), rel2abs($forward));
       my $objd = abs2rel(rel2abs(dirname($obj)), rel2abs($forward));
-      my $objn = basename($obj);
+      my $objn = basename($obj, platform->objext());
       my $srcs =
           join(", ", map { abs2rel(rel2abs($_), rel2abs($forward)) } @srcs);
-      my $before = $unified_info{before}->{$obj.".OBJ"} || "\@ !";
+      my $before = $unified_info{before}->{$obj} || "\@ !";
-      my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !";
+      my $after = $unified_info{after}->{$obj} || "\@ !";
+
+      if ($srcs[0] =~ /\.asm$/) {
+          my $asflags = { shlib => ' $(LIB_ASFLAGS)',
+		          lib => ' $(LIB_ASFLAGS)',
+		          dso => ' $(DSO_ASFLAGS)',
+		          bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}};
+          return <<"EOF";
+$obj : $deps
+        ${before}
+        SET DEFAULT $forward
+        \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs
+        SET DEFAULT $backward
+EOF
+      }
 
       my $cflags;
-      if ($args{installed}) {
+      if ($args{attrs}->{noinst}) {
-          $cflags = { shlib => '$(LIB_CFLAGS)',
-                      lib => '$(LIB_CFLAGS)',
-                      dso => '$(DSO_CFLAGS)',
-                      bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
-      } else {
           $cflags = { shlib => '$(NO_INST_LIB_CFLAGS)',
                       lib => '$(NO_INST_LIB_CFLAGS)',
                       dso => '$(NO_INST_DSO_CFLAGS)',
                       bin => '$(NO_INST_BIN_CFLAGS)' } -> {$args{intent}};
+      } else {
+          $cflags = { shlib => '$(LIB_CFLAGS)',
+                      lib => '$(LIB_CFLAGS)',
+                      dso => '$(DSO_CFLAGS)',
+                      bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
       }
       $cflags .= { shlib => '$(LIB_CPPFLAGS)',
 		   lib => '$(LIB_CPPFLAGS)',
@@ -928,10 +940,10 @@ EOF
       }
 
       my $depbuild = $disabled{makedepend} ? ""
-          : " /MMS=(FILE=${objd}${objn}.D,TARGET=$obj.OBJ)";
+          : " /MMS=(FILE=${objd}${objn}.D,TARGET=$obj)";
 
       return <<"EOF";
-$obj.OBJ : $deps
+$obj : $deps
         ${before}
         SET DEFAULT $forward
         \@ $incs_on
@@ -941,20 +953,18 @@ $obj.OBJ : $deps
         \@ $incs_off
         SET DEFAULT $backward
         ${after}
-        - PURGE $obj.OBJ
+        - PURGE $obj
 EOF
   }
   sub obj2shlib {
       my %args = @_;
-      my $lib = $args{lib};
+      my $shlibname = platform->sharedname($args{lib});
-      my $shlib = $args{shlib};
+      my $shlib = platform->sharedlib($args{lib});
-      my $libd = dirname($lib);
+      my @objs = map { platform->convertext($_) }
-      my $libn = basename($lib);
+                 grep { platform->isobj($_) }
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x }
-                 grep { $_ =~ m|\.o$| }
                  @{$args{objs}};
-      my @defs = map { (my $x = $_) =~ s|\.ld$|.OPT|; $x }
+      my @defs = map { platform->convertext($_) }
-                 grep { $_ =~ m|\.ld$| }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       die "More than one symbol vector" if scalar @defs > 1;
@@ -978,16 +988,16 @@ EOF
                              "WRITE OPT_FILE \"$x\"" } @deps)
           || "\@ !";
       return <<"EOF"
-$shlib.EXE : $deps
+$shlib : $deps
         \$(PERL) $translatesyms_pl \$(BLDDIR)CXX\$DEMANGLER_DB. < $defs[0] > $defs[0]-translated
-        OPEN/WRITE/SHARE=READ OPT_FILE $lib-components.OPT
+        OPEN/WRITE/SHARE=READ OPT_FILE $shlibname-components.OPT
         $write_opt1
         $write_opt2
         CLOSE OPT_FILE
         LINK \$(LIB_LDFLAGS)/SHARE=\$\@ $defs[0]-translated/OPT,-
-                $lib-components.OPT/OPT \$(LIB_EX_LIBS)
+                $shlibname-components.OPT/OPT \$(LIB_EX_LIBS)
-        DELETE $defs[0]-translated;*,$lib-components.OPT;*
+        DELETE $defs[0]-translated;*,$shlibname-components.OPT;*
-        PURGE $shlib.EXE,$shlib.MAP
+        PURGE $shlibname.EXE,$shlibname.MAP
 EOF
         . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@
@@ -996,15 +1006,13 @@ EOF
   }
   sub obj2dso {
       my %args = @_;
-      my $lib = $args{lib};
+      my $dsoname = platform->dsoname($args{lib});
-      my $libd = dirname($lib);
+      my $dso = platform->dso($args{lib});
-      my $libn = basename($lib);
+      my @objs = map { platform->convertext($_) }
-      (my $libn_nolib = $libn) =~ s/^lib//;
+                 grep { platform->isobj($_) }
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x }
-                 grep { $_ =~ m|\.o$| }
                  @{$args{objs}};
-      my @defs = map { (my $x = $_) =~ s|\.ld$|.OPT|; $x }
+      my @defs = map { platform->convertext($_) }
-                 grep { $_ =~ m|\.ld$| }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       my $deps = join(", -\n\t\t", @objs, @defs, @deps);
@@ -1025,14 +1033,14 @@ EOF
                              "WRITE OPT_FILE \"$x\"" } @deps)
           || "\@ !";
       return <<"EOF"
-$lib.EXE : $deps
+$dso : $deps
-        OPEN/WRITE/SHARE=READ OPT_FILE $lib-components.OPT
+        OPEN/WRITE/SHARE=READ OPT_FILE $dsoname-components.OPT
         $write_opt1
         $write_opt2
         CLOSE OPT_FILE
         LINK \$(DSO_LDFLAGS)/SHARE=\$\@ $defs[0]/OPT,-
-		$lib-components.OPT/OPT \$(DSO_EX_LIBS)
+		$dsoname-components.OPT/OPT \$(DSO_EX_LIBS)
-        - PURGE $lib.EXE,$lib.OPT,$lib.MAP
+        - PURGE $dsoname.EXE,$dsoname.OPT,$dsoname.MAP
 EOF
         . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@
@@ -1041,24 +1049,26 @@ EOF
   }
   sub obj2lib {
       my %args = @_;
-      (my $lib = $args{lib}) =~ s/\.a$//;
+      my $lib = platform->staticlib($args{lib});
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x } @{$args{objs}};
+      my @objs = map { platform->convertext($_) }
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
       my $objs = join(", -\n\t\t", @objs);
-      my $fill_lib = join("\n\t", (map { "LIBRARY/REPLACE $lib.OLB $_" }
+      my $fill_lib = join("\n\t", (map { "LIBRARY/REPLACE $lib $_" } @objs));
-                                   @objs));
       return <<"EOF";
-$lib.OLB : $objs
+$lib : $objs
-        LIBRARY/CREATE/OBJECT $lib.OLB
+        LIBRARY/CREATE/OBJECT $lib
         $fill_lib
-        - PURGE $lib.OLB
+        - PURGE $lib
 EOF
   }
   sub obj2bin {
       my %args = @_;
-      my $bin = $args{bin};
+      my $bin = platform->bin($args{bin});
-      my $bind = dirname($bin);
+      my $binname = platform->binname($args{bin});
-      my $binn = basename($bin);
+      my @objs = map { platform->convertext($_) }
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x } @{$args{objs}};
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
       my $objs = join(",", @objs);
       my @deps = compute_lib_depends(@{$args{deps}});
       my $deps = join(", -\n\t\t", @objs, @deps);
@@ -1113,19 +1123,19 @@ EOF
       # isn't necessary.  If there are other warnings, however, we show them
       # and let it break the build.
       return <<"EOF"
-$bin.EXE : $deps
+$bin : $deps
         $analyse_objs
-        @ OPEN/WRITE/SHARE=READ OPT_FILE $bin.OPT
+        @ OPEN/WRITE/SHARE=READ OPT_FILE $binname.OPT
         $write_opt1
         $write_opt2
         @ CLOSE OPT_FILE
-        TYPE $bin.opt ! For debugging
+        TYPE $binname.OPT ! For debugging
-        - pipe SPAWN/WAIT/NOLOG/OUT=$bin.LINKLOG -
+        - pipe SPAWN/WAIT/NOLOG/OUT=$binname.LINKLOG -
-                    LINK \$(BIN_LDFLAGS)/EXEC=\$\@ $bin.OPT/OPT \$(BIN_EX_LIBS) ; -
+                    LINK \$(BIN_LDFLAGS)/EXEC=\$\@ $binname.OPT/OPT \$(BIN_EX_LIBS) ; -
                link_status = \$status ; link_severity = link_status .AND. 7
         @ search_severity = 1
         -@ IF link_severity .EQ. 0 THEN -
-                pipe SEARCH $bin.LINKLOG "%","-"/MATCH=AND | -
+                pipe SEARCH $binname.LINKLOG "%","-"/MATCH=AND | -
                      SPAWN/WAIT/NOLOG/OUT=NLA0: -
                           SEARCH SYS\$INPUT: "-W-MULDEF,"/MATCH=NOR ; -
                      search_severity = \$severity
@@ -1136,10 +1146,10 @@ $bin.EXE : $deps
         @ IF search_severity .EQ. 3 THEN link_severity = 1
         @ ! At this point, if link_severity shows that there was a fault
         @ ! or warning, make sure to restore the linking status.
-        -@ IF .NOT. link_severity THEN TYPE $bin.LINKLOG
+        -@ IF .NOT. link_severity THEN TYPE $binname.LINKLOG
-        -@ DELETE $bin.LINKLOG;*
+        -@ DELETE $binname.LINKLOG;*
         @ IF .NOT. link_severity THEN SPAWN/WAIT/NOLOG EXIT 'link_status'
-        - PURGE $bin.EXE,$bin.OPT
+        - PURGE $bin,$binname.OPT
 EOF
       . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@

Configurations/platform.pm

@@ -0,0 +1,18 @@
+package platform;
+
+use strict;
+use warnings;
+use vars qw(@ISA);
+
+# Callers must make sure @INC has the build directory
+use configdata;
+
+my $module = $target{perl_platform} || 'Unix';
+(my $module_path = $module) =~ s|::|/|g;
+
+require "platform/$module_path.pm";
+@ISA = ("platform::$module");
+
+1;
+
+__END__

Configurations/platform/BASE.pm

@@ -0,0 +1,96 @@
+package platform::BASE;
+
+use strict;
+use warnings;
+use Carp;
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+# Globally defined "platform specific" extensions, available for uniformity
+sub depext      { '.d' }
+
+# Functions to convert internal file representations to platform specific
+# ones.  Note that these all depend on extension functions that MUST be
+# defined per platform.
+#
+# Currently known internal or semi-internal extensions are:
+#
+# .a            For libraries that are made static only.
+#               Internal libraries only.
+# .o            For object files.
+# .s, .S        Assembler files.  This is an actual extension on Unix
+# .res          Resource file.  This is an actual extension on Windows
+
+sub binname     { return $_[1] } # Name of executable binary
+sub dsoname     { return $_[1] } # Name of dynamic shared object (DSO)
+sub sharedname  { return __isshared($_[1]) ? $_[1] : undef } # Name of shared lib
+sub staticname  { return __base($_[1], '.a') } # Name of static lib
+
+# Convenience function to convert the shlib version to an acceptable part
+# of a file or directory name.
+sub shlib_version_as_filename { return $_[1] }
+
+# Convenience functions to convert the possible extension of an input file name
+sub bin         { return $_[0]->binname($_[1]) . $_[0]->binext() }
+sub dso         { return $_[0]->dsoname($_[1]) . $_[0]->dsoext() }
+sub sharedlib   { return __concat($_[0]->sharedname($_[1]), $_[0]->shlibext()) }
+sub staticlib   { return $_[0]->staticname($_[1]) . $_[0]->libext() }
+
+# More convenience functions for intermediary files
+sub def         { return __base($_[1], '.ld') . $_[0]->defext() }
+sub obj         { return __base($_[1], '.o') . $_[0]->objext() }
+sub res         { return __base($_[1], '.res') . $_[0]->resext() }
+sub dep         { return __base($_[1], '.o') . $_[0]->depext() } # <- objname
+sub asm         { return __base($_[1], '.S', '.s') . $_[0]->asmext() }
+
+# Another set of convenience functions for standard checks of certain
+# internal extensions and conversion from internal to platform specific
+# extension.  Note that the latter doesn't deal with libraries because
+# of ambivalence
+sub isdef       { return $_[1] =~ m|\.ld$|;   }
+sub isobj       { return $_[1] =~ m|\.o$|;    }
+sub isres       { return $_[1] =~ m|\.res$|;  }
+sub isasm       { return $_[1] =~ m|\.[Ss]$|; }
+sub convertext {
+    if ($_[0]->isdef($_[1]))    { return $_[0]->def($_[1]); }
+    if ($_[0]->isobj($_[1]))    { return $_[0]->obj($_[1]); }
+    if ($_[0]->isres($_[1]))    { return $_[0]->res($_[1]); }
+    if ($_[0]->isasm($_[1]))    { return $_[0]->asm($_[1]); }
+    return $_[1];
+}
+
+# Helpers ############################################################
+
+# __base EXPR, LIST
+# This returns the given path (EXPR) with the matching suffix from LIST stripped
+sub __base {
+    my $path = shift;
+    foreach (@_) {
+        if ($path =~ m|\Q${_}\E$|) {
+            return $`;
+        }
+    }
+    return $path;
+}
+
+# __isshared EXPR
+# EXPR is supposed to be a library name.  This will return true if that library
+# can be assumed to be a shared library, otherwise false
+sub __isshared {
+    return !($disabled{shared} || $_[0] =~ /\.a$/);
+}
+
+# __concat LIST
+# Returns the concatenation of all elements of LIST if none of them is
+# undefined.  If one of them is undefined, returns undef instead.
+sub __concat {
+    my $result = '';
+    foreach (@_) {
+        return undef unless defined $_;
+        $result .= $_;
+    }
+    return $result;
+}
+
+1;

Configurations/platform/Cygwin.pm

@@ -0,0 +1,22 @@
+package platform::Cygwin;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::mingw;
+@ISA = qw(platform::mingw);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub sharedname {
+    my $class = shift;
+    my $lib = platform::mingw->sharedname(@_);
+    $lib =~ s|^lib|cyg| if defined $lib;
+    return $lib;
+}
+
+1;

Configurations/platform/Unix.pm

@@ -0,0 +1,68 @@
+package platform::Unix;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { $target{exe_extension} || '' }
+sub dsoext              { $target{dso_extension} || '.so' }
+# Because these are also used in scripts and not just Makefile, we must
+# convert $(SHLIB_VERSION_NUMBER) to the actual number.
+sub shlibext            { (my $x = $target{shared_extension}
+                               || '.so.$(SHLIB_VERSION_NUMBER)')
+                              =~ s|\.\$\(SHLIB_VERSION_NUMBER\)
+                                  |.$config{shlib_version}|x;
+                          $x; }
+sub libext              { $target{lib_extension} || '.a' }
+sub defext              { $target{def_extension} || '.ld' }
+sub objext              { $target{obj_extension} || '.o' }
+sub depext              { $target{obj_extension} || '.d' }
+
+# Other extra that aren't defined in platform::BASE
+sub shlibextsimple      { (my $x = $target{shared_extension} || '.so')
+                              =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||;
+                          $x; }
+sub shlibvariant        { $target{shlib_variant} || "" }
+sub makedepprog         { $disabled{makedepend} ? undef : $config{makedepprog} }
+
+# No conversion of assembler extension on Unix
+sub asm {
+    return $_[1];
+}
+
+# At some point, we might decide that static libraries are called something
+# other than the default...
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    # We currently return the same name anyway...  but we might choose to
+    # append '_static' or '_a' some time in the future.
+    return platform::BASE->staticname($_[1]);
+}
+
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    ($_[0]->shlibvariant() // ''));
+}
+
+sub sharedname_simple {
+    return platform::BASE::__isshared($_[1]) ? $_[1] : undef;
+}
+
+sub sharedlib_simple {
+    return platform::BASE::__concat($_[0]->sharedname_simple($_[1]),
+                                    $_[0]->shlibextsimple());
+}
+
+1;

Configurations/platform/VMS.pm

@@ -0,0 +1,64 @@
+package platform::VMS;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+# VMS has a cultural standard where all installed libraries are prefixed.
+# For OpenSSL, the choice is 'ossl$' (this prefix was claimed in a
+# conversation with VSI, Tuesday January 26 2016)
+sub osslprefix          { 'OSSL$' }
+
+sub binext              { '.EXE' }
+sub dsoext              { '.EXE' }
+sub shlibext            { '.EXE' }
+sub libext              { '.OLB' }
+sub defext              { '.OPT' }
+sub objext              { '.OBJ' }
+sub depext              { '.D' }
+sub asmext              { '.ASM' }
+
+# Other extra that aren't defined in platform::BASE
+sub shlibvariant        { $target{shlib_variant} || '' }
+
+sub optext              { '.OPT' }
+sub optname             { return $_[1] }
+sub opt                 { return $_[0]->optname($_[1]) . $_[0]->optext() }
+
+# Other projects include the pointer size in the name of installed libraries,
+# so we do too.
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    return platform::BASE::__concat($_[0]->osslprefix(),
+                                    platform::BASE->staticname($_[1]),
+                                    $target{pointer_size});
+}
+
+# To enable installation of multiple major OpenSSL releases, we include the
+# version number in installed shared library names.
+my $sover_filename =
+    join('', map { sprintf "%02d", $_ } split(m|\.|, $config{shlib_version}));
+sub shlib_version_as_filename {
+    return $sover_filename;
+}
+sub sharedname {
+    return platform::BASE::__concat($_[0]->osslprefix(),
+                                    platform::BASE->sharedname($_[1]),
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($_[0]->shlibvariant() // ''),
+                                    "_shr$target{pointer_size}");
+}
+
+1;

Configurations/platform/Windows.pm

@@ -0,0 +1,63 @@
+package platform::Windows;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { '.exe' }
+sub dsoext              { '.dll' }
+sub shlibext            { '.dll' }
+sub libext              { '.lib' }
+sub defext              { '.def' }
+sub objext              { '.obj' }
+sub depext              { '.d' }
+sub asmext              { '.asm' }
+
+# Other extra that aren't defined in platform::BASE
+sub resext              { '.res' }
+sub shlibextimport      { '.lib' }
+sub shlibvariant        { $target{shlib_variant} || '' }
+
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    # To make sure not to clash with an import library, we make the static
+    # variant of our installed libraries get '_static' added to their names.
+    return platform::BASE->staticname($_[1])
+        . ($disabled{shared} ? '' : '_static');
+}
+
+# To mark forward compatibility, we include the OpenSSL major release version
+# number in the installed shared library names.
+(my $sover_filename = $config{shlib_version}) =~ s|\.|_|g;
+sub shlib_version_as_filename {
+    return $sover_filename
+}
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    "-",
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($_[0]->shlibvariant() // ''));
+}
+
+sub sharedname_import {
+    return platform::BASE::__isshared($_[1]) ? $_[1] : undef;
+}
+
+sub sharedlib_import {
+    return platform::BASE::__concat($_[0]->sharedname_import($_[1]),
+                                    $_[0]->shlibextimport());
+}
+
+1;

Configurations/platform/Windows/MSVC.pm

@@ -0,0 +1,33 @@
+package platform::Windows::MSVC;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::Windows;
+@ISA = qw(platform::Windows);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub pdbext              { '.pdb' }
+
+sub staticlibpdb {
+    return platform::BASE::__concat($_[0]->staticname($_[1]), $_[0]->pdbext());
+}
+
+sub sharedlibpdb {
+    return platform::BASE::__concat($_[0]->sharedname($_[1]), $_[0]->pdbext());
+}
+
+sub dsopdb {
+    return platform::BASE::__concat($_[0]->dsoname($_[1]), $_[0]->pdbext());
+}
+
+sub binpdb {
+    return platform::BASE::__concat($_[0]->binname($_[1]), $_[0]->pdbext());
+}
+
+1;

Configurations/platform/mingw.pm

@@ -0,0 +1,45 @@
+package platform::mingw;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::Unix;
+@ISA = qw(platform::Unix);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { '.exe' }
+sub objext              { '.obj' }
+sub libext              { '.a' }
+sub dsoext              { '.dll' }
+sub defext              { '.def' }
+sub shlibext            { '.dll' }
+sub shlibextimport      { $target{shared_import_extension} || '.dll.a' }
+sub shlibextsimple      { undef }
+sub makedepprog         { $disabled{makedepend} ? undef : $config{makedepprog} }
+
+(my $sover_filename = $config{shlib_version}) =~ s|\.|_|g;
+sub shlib_version_as_filename {
+    return $sover_filename;
+}
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    "-",
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($config{target} eq "mingw64"
+                                         ? "-x64" : ""));
+}
+
+# With Mingw and other DLL producers, there isn't really any "simpler"
+# shared library name.  However, there is a static import library, so
+# we return that instead.
+sub sharedlib_simple {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    $_[0]->shlibextimport());
+}
+
+1;

Configurations/unix-Makefile.tmpl

@@ -3,17 +3,7 @@
 ##
 ## {- join("\n## ", @autowarntext) -}
 {-
-     our $objext = $target{obj_extension} || ".o";
+     our $makedepprog = platform->makedepprog();
-     our $defext = $target{def_extension} || ".ld";
-     our $depext = $target{dep_extension} || ".d";
-     our $exeext = $target{exe_extension} || "";
-     our $libext = $target{lib_extension} || ".a";
-     our $shlibext = $target{shared_extension} || ".so";
-     our $shlibvariant = $target{shlib_variant} || "";
-     our $shlibextsimple = $target{shared_extension_simple} || ".so";
-     our $shlibextimport = $target{shared_import_extension} || "";
-     our $dsoext = $target{dso_extension} || ".so";
-     our $makedepprog = $disabled{makedepend} ? undef : $config{makedepprog};
 
      sub windowsdll { $config{target} =~ /^(?:Cygwin|mingw)/ }
 
@@ -21,58 +11,8 @@
      # libcrypto.a and use libcrypto_a.a as static one.
      sub sharedaix  { !$disabled{shared} && $config{target} =~ /^aix/ }
 
-     our $sover_dirname = $config{shlib_version};
+     our $sover_dirname = platform->shlib_version_as_filename();
-     $sover_dirname =~ s|\.|_|g
-         if $config{target} =~ /^mingw/;
 
-     # shlib and shlib_simple both take a static library name and figure
-     # out what the shlib name should be.
-     #
-     # When OpenSSL is configured "no-shared", these functions will just
-     # return empty lists, making them suitable to join().
-     #
-     # With Windows DLL producers, shlib($libname) will return the shared
-     # library name (which usually is different from the static library
-     # name) with the default shared extension appended to it, while
-     # shlib_simple($libname) will return the static library name with
-     # the shared extension followed by ".a" appended to it.  The former
-     # result is used as the runtime shared library while the latter is
-     # used as the DLL import library.
-     #
-     # On all Unix systems, shlib($libname) will return the library name
-     # with the default shared extension, while shlib_simple($libname)
-     # will return the name from shlib($libname) with any SO version number
-     # removed.  On some systems, they may therefore return the exact same
-     # string.
-     sub shlib {
-         my $lib = shift;
-         return () if $disabled{shared} || $lib =~ /\.a$/;
-         return $unified_info{sharednames}->{$lib}. $shlibvariant. '$(SHLIB_EXT)';
-     }
-     sub shlib_simple {
-         my $lib = shift;
-         return () if $disabled{shared} || $lib =~ /\.a$/;
-
-         if (windowsdll()) {
-             return $lib . '$(SHLIB_EXT_IMPORT)';
-         }
-         return $lib .  '$(SHLIB_EXT_SIMPLE)';
-     }
-
-     # Easy fixing of static library names
-     sub lib {
-         (my $lib = shift) =~ s/\.a$//;
-         return $lib . $libext;
-     }
-
-     # dso is a complement to shlib / shlib_simple that returns the
-     # given libname with the simple shared extension (possible SO version
-     # removed).  This differs from shlib_simple() by being unconditional.
-     sub dso {
-         my $engine = shift;
-
-         return $engine . $dsoext;
-     }
      # This makes sure things get built in the order they need
      # to. You're welcome.
      sub dependmagic {
@@ -93,37 +33,66 @@ MAJOR={- $config{major} -}
 MINOR={- $config{minor} -}
 SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 SHLIB_TARGET={- $target{shared_target} -}
-SHLIB_EXT={- $shlibext -}
-SHLIB_EXT_SIMPLE={- $shlibextsimple -}
-SHLIB_EXT_IMPORT={- $shlibextimport -}
 
-LIBS={- join(" ", map { lib($_) } @{$unified_info{libraries}}) -}
+LIBS={- join(" ", map { platform->staticlib($_) // () } @{$unified_info{libraries}}) -}
-SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{libraries}}) -}
+SHLIBS={- join(" ", map { platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
-SHLIB_INFO={- join(" ", map { "\"".shlib($_).";".shlib_simple($_)."\"" } @{$unified_info{libraries}}) -}
+SHLIB_INFO={- join(" ", map { my $x = platform->sharedlib($_);
-ENGINES={- join(" ", map { dso($_) } @{$unified_info{engines}}) -}
+                              my $y = platform->sharedlib_simple($_);
-PROGRAMS={- join(" ", map { $_.$exeext } @{$unified_info{programs}}) -}
+                              $x ? "\"$x;$y\"" : () }
+                        @{$unified_info{libraries}}) -}
+ENGINES={- join(" ", map { platform->dso($_) } @{$unified_info{engines}}) -}
+PROGRAMS={- join(" ", map { platform->bin($_) } @{$unified_info{programs}}) -}
 SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
+DEPS={- join(" ", map { platform->isobj($_) ? platform->dep($_) : () }
                   grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
                   keys %{$unified_info{sources}}); -}
 {- output_on() if $disabled{makedepend}; "" -}
 GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}}) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(" ", map { my $x = $_;
+             join(" ", map { platform->convertext($_) } @generated ) -}
-                             $x =~ s|\.ld$|$defext|;
-                             $x }
-                       @generated ) -}
 
-INSTALL_LIBS={- join(" ", map { lib($_) } @{$unified_info{install}->{libraries}}) -}
+INSTALL_LIBS={-
-INSTALL_SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{install}->{libraries}}) -}
+        join(" ", map { platform->staticlib($_) // () }
-INSTALL_SHLIB_INFO={- join(" ", map { "\"".shlib($_).";".shlib_simple($_)."\"" } @{$unified_info{install}->{libraries}}) -}
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
-INSTALL_ENGINES={- join(" ", map { dso($_) } @{$unified_info{install}->{engines}}) -}
+                  @{$unified_info{libraries}})
-INSTALL_PROGRAMS={- join(" ", map { $_.$exeext } @{$unified_info{install}->{programs}}) -}
+-}
-{- output_off() if $disabled{apps}; "" -}
+INSTALL_SHLIBS={-
-BIN_SCRIPTS=$(BLDDIR)/tools/c_rehash
+        join(" ", map { platform->sharedlib($_) // () }
-MISC_SCRIPTS=$(BLDDIR)/apps/CA.pl $(BLDDIR)/apps/tsget.pl:tsget
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
-{- output_on() if $disabled{apps}; "" -}
+                  @{$unified_info{libraries}})
+-}
+INSTALL_SHLIB_INFO={-
+        join(" ", map { my $x = platform->sharedlib($_);
+                        my $y = platform->sharedlib_simple($_);
+                        $x ? "\"$x;$y\"" : () }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{libraries}})
+-}
+INSTALL_ENGINES={-
+        join(" ", map { platform->dso($_) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{engines}})
+-}
+INSTALL_PROGRAMS={-
+        join(" ", map { platform->bin($_) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{programs}})
+-}
+BIN_SCRIPTS={-
+        join(" ", map { my $x = $unified_info{attributes}->{$_}->{linkname};
+                        $x ? "$_:$x" : $_ }
+                  grep { !$unified_info{attributes}->{$_}->{noinst}
+                         && !$unified_info{attributes}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
+MISC_SCRIPTS={-
+        join(" ", map { my $x = $unified_info{attributes}->{$_}->{linkname};
+                        $x ? "$_:$x" : $_ }
+                  grep { !$unified_info{attributes}->{$_}->{noinst}
+                         && $unified_info{attributes}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
 
 APPS_OPENSSL={- use File::Spec::Functions;
                 catfile("apps","openssl") -}
@@ -374,7 +343,7 @@ test: tests
 	  BLDTOP=../$(BLDDIR) \
 	  RESULT_D=test-runs \
 	  PERL="$(PERL)" \
-	  EXE_EXT={- $exeext -} \
+	  EXE_EXT={- platform->binext() -} \
 	  OPENSSL_ENGINES=`cd ../$(BLDDIR)/engines 2>/dev/null && pwd` \
 	  OPENSSL_DEBUG_MEMORY=on \
 	    $(PERL) ../$(SRCDIR)/test/run_tests.pl $(TESTS) )
@@ -410,13 +379,13 @@ libclean:
 		fi; \
 	done
 	$(RM) $(LIBS)
-	$(RM) *.{- $defext -}
+	$(RM) *{- platform->defext() -}
 
 clean: libclean
 	$(RM) $(PROGRAMS) $(TESTPROGS) $(ENGINES) $(SCRIPTS)
 	$(RM) $(GENERATED_MANDATORY) $(GENERATED)
-	-$(RM) `find . -name .git -prune -o -name '*{- $depext -}' -print`
+	-$(RM) `find . -name .git -prune -o -name '*{- platform->depext() -}' -print`
-	-$(RM) `find . -name .git -prune -o -name '*{- $objext -}' -print`
+	-$(RM) `find . -name .git -prune -o -name '*{- platform->objext() -}' -print`
 	$(RM) core
 	$(RM) tags TAGS doc-nits
 	$(RM) -r test/test-runs
@@ -628,7 +597,7 @@ uninstall_engines:
 	@set -e; for e in dummy $(INSTALL_ENGINES); do \
 		if [ "$$e" = "dummy" ]; then continue; fi; \
 		fn=`basename $$e`; \
-		if [ "$$fn" = '{- dso("ossltest") -}' ]; then \
+		if [ "$$fn" = '{- platform->dso("ossltest") -}' ]; then \
 			continue; \
 		fi; \
 		$(ECHO) "$(RM) $(DESTDIR)$(ENGINESDIR)/$$fn"; \
@@ -887,7 +856,7 @@ FORCE:
 
 # Building targets ###################################################
 
-libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { shlib_simple($_) } @{$unified_info{libraries}}) -}
+libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // () } @{$unified_info{libraries}}) -}
 libcrypto.pc:
 	@ ( echo 'prefix=$(INSTALLTOP)'; \
 	    echo 'exec_prefix=$${prefix}'; \
@@ -958,14 +927,10 @@ reconfigure reconf:
   # Helper function to figure out dependencies on libraries
   # It takes a list of library names and outputs a list of dependencies
   sub compute_lib_depends {
-      if ($disabled{shared}) {
-          return map { lib($_) } @_;
-      }
-
       # Depending on shared libraries:
       # On Windows POSIX layers, we depend on {libname}.dll.a
       # On Unix platforms, we depend on {shlibname}.so
-      return map { $_ =~ /\.a$/ ? $`.$libext : shlib_simple($_) } @_;
+      return map { platform->sharedlib_simple($_) // platform->staticlib($_) } @_;
   }
 
   sub generatesrc {
@@ -976,17 +941,16 @@ reconfigure reconf:
       my $defs = join("", map { " -D".$_ } @{$args{defs}});
       my $deps = join(" ", @{$args{generator_deps}}, @{$args{deps}});
 
-      if ($args{src} =~ /\.ld$/) {
+      if (platform->isdef($args{src})) {
-          (my $target = $args{src}) =~ s/\.ld$/${defext}/;
+          my $target = platform->def($args{src});
           (my $mkdef_os = $target{shared_target}) =~ s|-shared$||;
           my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
-          my $ord_name =
+          my $ord_name = $args{generator}->[1] || $args{product};
-              $args{generator}->[1] || basename($args{product}, $dsoext);
           return <<"EOF";
 $target: $args{generator}->[0] $deps \$(SRCDIR)/util/mkdef.pl
 	\$(PERL) \$(SRCDIR)/util/mkdef.pl$ord_ver --ordinals $args{generator}->[0]  --name $ord_name --OS $mkdef_os > $target
 EOF
-      } elsif ($args{src} !~ /\.[sS]$/) {
+      } elsif (!platform->isasm($args{src})) {
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
               my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
                                                    "util", "dofile.pl")),
@@ -1038,7 +1002,8 @@ EOF
   # last in the line.  We may therefore need to put back a line ending.
   sub src2obj {
       my %args = @_;
-      (my $obj = $args{obj}) =~ s|\.o$||;
+      my $obj = platform->obj($args{obj});
+      my $dep = platform->dep($args{obj});
       my @srcs = @{$args{srcs}};
       my $srcs = join(" ",  @srcs);
       my $deps = join(" ", @srcs, @{$args{deps}});
@@ -1074,7 +1039,7 @@ EOF
       # extension-specific rules
       if (grep /\.s$/, @srcs) {
           $recipe .= <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	$cmd $cmdflags -c -o \$\@ $srcs
 EOF
       } elsif (grep /\.S$/, @srcs) {
@@ -1084,30 +1049,30 @@ EOF
           # The platform is long discontinued by vendor so there is
           # hardly a point to drag it along...
           $recipe .= <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	$cmd $incs $defs $cmdflags -c -o \$\@ $srcs
 EOF
       } elsif (defined $makedepprog && $makedepprog !~ /\/makedepend/
                && !grep /\.rc$/, @srcs) {
           $recipe .= <<"EOF";
-$obj$objext: $deps
+$obj: $deps
-	$cmd $incs $defs $cmdflags -MMD -MF $obj$depext.tmp -MT \$\@ -c -o \$\@ $srcs
+	$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
-	\@touch $obj$depext.tmp
+	\@touch $dep.tmp
-	\@if cmp $obj$depext.tmp $obj$depext > /dev/null 2> /dev/null; then \\
+	\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
-		rm -f $obj$depext.tmp; \\
+		rm -f $dep.tmp; \\
 	else \\
-		mv $obj$depext.tmp $obj$depext; \\
+		mv $dep.tmp $dep; \\
 	fi
 EOF
       } else {
           $recipe .= <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	$cmd $incs $defs $cmdflags $cmdcompile -o \$\@ $srcs
 EOF
           if (defined $makedepprog  && $makedepprog =~ /\/makedepend/) {
               $recipe .= <<"EOF";
 	\$(MAKEDEPEND) -f- -Y -- $incs $cmdflags -- $srcs 2>/dev/null \\
-	    > $obj$depext
+	    > $dep
 EOF
           }
       }
@@ -1116,11 +1081,6 @@ EOF
   # We *know* this routine is only called when we've configure 'shared'.
   sub obj2shlib {
       my %args = @_;
-      my $lib = $args{lib};
-      my $shlib = $args{shlib};
-      my $libd = dirname($lib);
-      my $libn = basename($lib);
-      (my $libname = $libn) =~ s/^lib//;
       my @linkdirs = ();
       foreach (@{args{deps}}) {
           my $d = dirname($_);
@@ -1130,19 +1090,18 @@ EOF
       my $linklibs = join("", map { my $f = basename($_);
                                     (my $l = $f) =~ s/^lib//;
                                     " -l$l" } @{$args{deps}});
-      my @objs = map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
+      my @objs = map { platform->obj($_) }
-                 grep { $_ !~ m/\.ld$/ }
+                 grep { !platform->isdef($_) }
                  @{$args{objs}};
-      my @defs = map { (my $x = $_) =~ s|\.ld$||; "$x$defext" }
+      my @defs = map { platform->def($_) }
-                 grep { $_ =~ /\.ld$/ }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       die "More than one exported symbol map" if scalar @defs > 1;
       my $objs = join(" ", @objs);
       my $deps = join(" ", @objs, @defs, @deps);
-      my $simple = shlib_simple($lib);
+      my $simple = platform->sharedlib_simple($args{lib});
-      my $full = shlib($lib);
+      my $full = platform->sharedlib($args{lib});
-      my $target = "$simple $full";
       my $shared_soname = "";
       $shared_soname .= ' '.$target{shared_sonameflag}.basename($full)
           if defined $target{shared_sonameflag};
@@ -1151,39 +1110,40 @@ EOF
           if defined $target{shared_impflag};
       my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs);
       my $recipe = <<"EOF";
-$target: $deps
+$simple: $full
+EOF
+      if (sharedaix()) {
+          $recipe .= <<"EOF";
+	rm -f $simple && \\
+	\$(AR) r $simple $full
+EOF
+      } elsif ($simple ne $full) {
+          $recipe .= <<"EOF";
+	rm -f $simple && \\
+	ln -s $full $simple
+EOF
+      }
+      $recipe .= <<"EOF";
+$full: $deps
 	\$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\
 		-o $full$shared_def $objs \\
                 $linklibs \$(LIB_EX_LIBS)
 EOF
       if (windowsdll()) {
           $recipe .= <<"EOF";
-	rm -f apps/$shlib'\$(SHLIB_EXT)'
+	rm -f apps/$full
-	rm -f test/$shlib'\$(SHLIB_EXT)'
+	rm -f test/$full
-	rm -f fuzz/$shlib'\$(SHLIB_EXT)'
+	rm -f fuzz/$full
-	cp -p $shlib'\$(SHLIB_EXT)' apps/
+	cp -p $full apps/
-	cp -p $shlib'\$(SHLIB_EXT)' test/
+	cp -p $full test/
-	cp -p $shlib'\$(SHLIB_EXT)' fuzz/
+	cp -p $full fuzz/
-EOF
-      } elsif (sharedaix()) {
-          $recipe .= <<"EOF";
-	rm -f $simple && \\
-	\$(AR) r $simple $full
-EOF
-      } else {
-          $recipe .= <<"EOF";
-	if [ '$simple' != '$full' ]; then \\
-		rm -f $simple; \\
-		ln -s $full $simple; \\
-	fi
 EOF
       }
+      return $recipe;
   }
   sub obj2dso {
       my %args = @_;
-      my $dso = $args{lib};
+      my $dso = platform->dso($args{lib});
-      my $dsod = dirname($dso);
-      my $dson = basename($dso);
       my @linkdirs = ();
       foreach (@{args{deps}}) {
           my $d = dirname($_);
@@ -1193,43 +1153,39 @@ EOF
       my $linklibs = join("", map { my $f = basename($_);
                                     (my $l = $f) =~ s/^lib//;
                                     " -l$l" } @{$args{deps}});
-      my @objs = map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
+      my @objs = map { platform->obj($_) }
-                 grep { $_ !~ m/\.ld$/ }
+                 grep { !platform->isdef($_) }
                  @{$args{objs}};
-      my @defs = map { (my $x = $_) =~ s|\.ld$||; "$x$defext" }
+      my @defs = map { platform->def($_) }
-                 grep { $_ =~ /\.ld$/ }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       my $objs = join(" ", @objs);
       my $deps = join(" ", @objs, @defs, @deps);
-      my $target = dso($dso);
       my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs);
       return <<"EOF";
-$target: $deps
+$dso: $deps
 	\$(CC) \$(DSO_CFLAGS) $linkflags\$(DSO_LDFLAGS) \\
-		-o $target$shared_def $objs \\
+		-o $dso$shared_def $objs \\
                 $linklibs \$(DSO_EX_LIBS)
 EOF
   }
   sub obj2lib {
       my %args = @_;
-      (my $lib = $args{lib}) =~ s/\.a$//;
+      my $lib = platform->staticlib($args{lib});
-      my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+      my @objs = map { platform->obj($_) } @{$args{objs}};
       my $objs = join(" ", @objs);
       return <<"EOF";
-$lib$libext: $objs
+$lib: $objs
 	\$(AR) \$(ARFLAGS) \$\@ \$\?
 	\$(RANLIB) \$\@ || echo Never mind.
 EOF
   }
   sub obj2bin {
       my %args = @_;
-      my $bin = $args{bin};
+      my $bin = platform->bin($args{bin});
-      my $bind = dirname($bin);
+      my $objs = join(" ", map { platform->obj($_) } @{$args{objs}});
-      my $binn = basename($bin);
+      my $deps = join(" ", compute_lib_depends(@{$args{deps}}));
-      my $objs = join(" ", map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
-                           @{$args{objs}});
-      my $deps = join(" ",compute_lib_depends(@{$args{deps}}));
       my @linkdirs = ();
       foreach (@{args{deps}}) {
           next if $_ =~ /\.a$/;
@@ -1238,7 +1194,7 @@ EOF
       }
       my $linkflags = join("", map { "-L$_ " } @linkdirs);
       my $linklibs = join("", map { if ($_ =~ s/\.a$//) {
-                                        " $_$libext";
+                                        " ".platform->staticlib($_);
                                     } else {
                                         my $f = basename($_);
                                         (my $l = $f) =~ s/^lib//;
@@ -1252,10 +1208,10 @@ EOF
           $cmdflags = '$(BIN_CXXFLAGS)';
       }
       return <<"EOF";
-$bin$exeext: $objs $deps
+$bin: $objs $deps
-	rm -f $bin$exeext
+	rm -f $bin
 	\$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS) \\
-		-o $bin$exeext $objs \\
+		-o $bin $objs \\
 		$linklibs \$(BIN_EX_LIBS)
 EOF
   }
@@ -1276,11 +1232,11 @@ EOF
   sub generatedir {
       my %args = @_;
       my $dir = $args{dir};
-      my @deps = map { s|\.o$|$objext|; $_ } @{$args{deps}};
+      my @deps = map { platform->convertext($_) } @{$args{deps}};
       my @actions = ();
-      my %extinfo = ( dso => $dsoext,
+      my %extinfo = ( dso => platform->dsoext(),
-                      lib => $libext,
+                      lib => platform->libext(),
-                      bin => $exeext );
+                      bin => platform->binext() );
 
       # We already have a 'test' target, and the top directory is just plain
       # silly

Configurations/windows-makefile.tmpl

@@ -3,17 +3,7 @@
 ##
 ## {- join("\n## ", @autowarntext) -}
 {-
- our $objext = $target{obj_extension} || ".obj";
+ our $sover_dirname = platform->shlib_version_as_filename();
- our $resext = $target{res_extension} || ".res";
- our $depext = $target{dep_extension} || ".d";
- our $defext = $target{dep_extension} || ".def";
- our $exeext = $target{exe_extension} || ".exe";
- our $libext = $target{lib_extension} || ".lib";
- our $shlibext = $target{shared_extension} || ".dll";
- our $shlibextimport = $target{shared_import_extension} || ".lib";
- our $dsoext = $target{dso_extension} || ".dll";
-
- (our $sover_dirname = $config{shlib_version}) =~ s|\.|_|g;
 
  my $build_scheme = $target{build_scheme};
  my $install_flavour = $build_scheme->[$#$build_scheme]; # last element
@@ -32,31 +22,6 @@
  $win_installroot = $ENV{$win_installroot};
  $win_commonroot = $ENV{$win_commonroot};
 
- sub shlib {
-     my $lib = shift;
-     return () if $disabled{shared} || $lib =~ /\.a$/;
-     return () unless defined $unified_info{sharednames}->{$lib};
-     return $unified_info{sharednames}->{$lib} . $shlibext;
- }
-
- sub lib {
-     (my $lib = shift) =~ s/\.a$//;
-     $lib .= '_static'
-         if (defined $unified_info{sharednames}->{$lib});
-     return $lib . $libext;
- }
-
- sub shlib_import {
-     my $lib = shift;
-     return () if $disabled{shared} || $lib =~ /\.a$/;
-     return $lib . $shlibextimport;
- }
-
- sub dso {
-     my $dso = shift;
-
-     return $dso . $dsoext;
- }
  # This makes sure things get built in the order they need
  # to. You're welcome.
  sub dependmagic {
@@ -77,38 +42,73 @@ MINOR={- $config{minor} -}
 
 SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 
-LIBS={- join(" ", map { ( shlib_import($_), lib($_) ) } @{$unified_info{libraries}}) -}
+LIBS={- join(" ", map { ( platform->sharedlib_import($_), platform->staticlib($_) ) } @{$unified_info{libraries}}) -}
-SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{libraries}}) -}
+SHLIBS={- join(" ", map { platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
-SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; shlib($_) } @{$unified_info{libraries}}) -}
+SHLIBPDBS={- join(" ", map { platform->sharedlibpdb($_) // () } @{$unified_info{libraries}}) -}
-ENGINES={- join(" ", map { dso($_) } @{$unified_info{engines}}) -}
+ENGINES={- join(" ", map { platform->dso($_) } @{$unified_info{engines}}) -}
-ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; dso($_) } @{$unified_info{engines}}) -}
+ENGINEPDBS={- join(" ", map { platform->dsopdb($_) } @{$unified_info{engines}}) -}
-PROGRAMS={- our @PROGRAMS = map { $_.$exeext } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
+PROGRAMS={- our @PROGRAMS = map { platform->bin($_) } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
 PROGRAMPDBS={- join(" ", map { $_.".pdb" } @{$unified_info{programs}}) -}
 SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
+DEPS={- join(" ", map { platform->isobj($_) ? platform->dep($_) : () }
                   grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
                   keys %{$unified_info{sources}}); -}
 {- output_on() if $disabled{makedepend}; "" -}
 GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}} ) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(" ", map { my $x = $_;
+             join(" ", map { platform->convertext($_) } @generated) -}
-                             $x =~ s|\.[sS]$|.asm|;
-                             $x =~ s|\.ld$|$defext|;
-                             $x }
-                       @generated) -}
 
-INSTALL_LIBS={- join(" ", map { quotify1(shlib_import($_) or lib($_)) } @{$unified_info{install}->{libraries}}) -}
+INSTALL_LIBS={-
-INSTALL_SHLIBS={- join(" ", map { quotify_l(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
+        join(" ", map { quotify1(platform->sharedlib_import($_)
-INSTALL_SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; quotify_l(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
+                                 // platform->staticlib($_)) }
-INSTALL_ENGINES={- join(" ", map { quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
-INSTALL_ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
+                  @{$unified_info{libraries}})
-INSTALL_PROGRAMS={- join(" ", map { quotify1($_.$exeext) } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
+-}
-INSTALL_PROGRAMPDBS={- join(" ", map { quotify1($_.".pdb") } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
+INSTALL_SHLIBS={-
-{- output_off() if $disabled{apps}; "" -}
+        join(" ", map { my $x = platform->sharedlib($_);
-BIN_SCRIPTS="$(BLDDIR)\tools\c_rehash.pl"
+                        $x ? quotify_l($x) : () }
-MISC_SCRIPTS="$(BLDDIR)\apps\CA.pl" "$(BLDDIR)\apps\tsget.pl"
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
-{- output_on() if $disabled{apps}; "" -}
+                  @{$unified_info{libraries}})
+-}
+INSTALL_SHLIBPDBS={-
+        join(" ", map { my $x = platform->sharedlibpdb($_);
+                        $x ? quotify_l($x) : () }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{libraries}})
+-}
+INSTALL_ENGINES={-
+        join(" ", map { quotify1(platform->dso($_)) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{engines}})
+-}
+INSTALL_ENGINEPDBS={-
+        join(" ", map { quotify1(platform->dsopdb($_)) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{engines}})
+-}
+INSTALL_PROGRAMS={-
+        join(" ", map { quotify1(platform->bin($_)) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{programs}})
+-}
+INSTALL_PROGRAMPDBS={-
+        join(" ", map { quotify1(platform->binpdb($_)) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst} }
+                  @{$unified_info{programs}})
+-}
+BIN_SCRIPTS={-
+        join(" ", map { quotify1($_) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst}
+                         && !$unified_info{attributes}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
+MISC_SCRIPTS={-
+        join(" ", map { quotify1($_) }
+                  grep { !$unified_info{attributes}->{$_}->{noinst}
+                         && $unified_info{attributes}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
 
 APPS_OPENSSL={- use File::Spec::Functions;
                 "\"".catfile("apps","openssl")."\"" -}
@@ -317,7 +317,7 @@ PROCESSOR= {- $config{processor} -}
 {- dependmagic('build_programs'); -}: build_programs_nodep
 
 build_generated: $(GENERATED_MANDATORY)
-build_libs_nodep: $(LIBS) {- join(" ",map { shlib_import($_) } @{$unified_info{libraries}}) -}
+build_libs_nodep: $(LIBS) {- join(" ",map { platform->sharedlib_import($_) // () } @{$unified_info{libraries}}) -}
 build_engines_nodep: $(ENGINES)
 build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
 
@@ -497,9 +497,9 @@ reconfigure reconf:
  # It takes a list of library names and outputs a list of dependencies
  sub compute_lib_depends {
      if ($disabled{shared}) {
-	 return map { lib($_) } @_;
+	 return map { platform->staticlib($_) } @_;
      }
-     return map { shlib_import($_) or lib($_) } @_;
+     return map { platform->sharedlib_import($_) // platform->staticlib($_) } @_;
  }
 
   sub generatesrc {
@@ -512,19 +512,19 @@ reconfigure reconf:
       my $deps = @{$args{deps}} ?
           '"'.join('" "', @{$args{generator_deps}}, @{$args{deps}}).'"' : '';
 
-      if ($args{src} =~ /\.ld$/) {
+      if (platform->isdef($args{src})) {
-          (my $target = $args{src}) =~ s/\.ld$/$defext/;
+          my $target = platform->def($args{src});
           my $mkdef = abs2rel(rel2abs(catfile($config{sourcedir},
                                               "util", "mkdef.pl")),
                               rel2abs($config{builddir}));
           my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
           my $ord_name =
-              $args{generator}->[1] || basename($args{product}, $dsoext);
+              $args{generator}->[1] || platform->dsoname($args{product});
           return <<"EOF";
 $target: $args{generator}->[0] $deps $mkdef
 	\$(PERL) $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name --OS windows > $target
 EOF
-      } elsif ($args{src} !~ /\.[sS]$/) {
+      } elsif (!platform->isasm($args{src})) {
           my $target = $args{src};
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
               my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
@@ -542,7 +542,7 @@ $target: "$args{generator}->[0]" $deps
 EOF
 	  }
       } else {
-          (my $target = $args{src}) =~ s/\.[sS]$/.asm/;
+          my $target = platform->asm($args{src});
           if ($args{generator}->[0] =~ /\.pl$/) {
               $generator = '"$(PERL)"'.$generator_incs.' '.$generator;
           } elsif ($args{generator}->[0] =~ /\.S$/) {
@@ -586,8 +586,7 @@ EOF
 
  sub src2obj {
      my %args = @_;
-     my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x
+     my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x } ( @{$args{srcs}} );
-                    } ( @{$args{srcs}} );
      my $srcs = '"'.join('" "',  @srcs).'"';
      my $deps = '"'.join('" "', @srcs, @{$args{deps}}).'"';
      my $incs = join("", map { ' /I "'.$_.'"' } @{$args{incs}});
@@ -607,29 +606,31 @@ EOF
 		     bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}};
      my $makedepprog = $config{makedepprog};
      if ($srcs[0] =~ /\.rc$/) {
+         my $res = platform->res($args{obj});
          return <<"EOF";
-$args{obj}: $deps
+$res: $deps
 	\$(RC) \$(RCOUTFLAG)\$\@ $srcs
 EOF
      }
-     (my $obj = $args{obj}) =~ s|\.o$||;
+     my $obj = platform->obj($args{obj});
+     my $dep = platform->dep($args{obj});
      if ($srcs[0] =~ /\.asm$/) {
          return <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	\$(AS) $asflags \$(ASOUTFLAG)\$\@ $srcs
 EOF
      } elsif ($srcs[0] =~ /.S$/) {
          return <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	\$(CC) /EP /D__ASSEMBLER__ $cflags $defs $srcs > \$@.asm && \$(AS) $asflags \$(ASOUTFLAG)\$\@ \$@.asm
 EOF
      }
      my $recipe = <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	\$(CC) $cflags $defs -c \$(COUTFLAG)\$\@ $srcs
 EOF
      $recipe .= <<"EOF"	unless $disabled{makedepend};
-	\$(CC) $cflags $defs /Zs /showIncludes $srcs 2>&1 > $obj$depext
+	\$(CC) $cflags $defs /Zs /showIncludes $srcs 2>&1 > $dep
 EOF
      return $recipe;
  }
@@ -640,19 +641,19 @@ EOF
  sub obj2shlib {
      my %args = @_;
      my $lib = $args{lib};
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x }
+     my @objs = map { platform->convertext($_) }
-                grep { $_ =~ m/\.(?:o|res)$/ }
+                grep { platform->isobj($_) || platform->isres($_) }
                 @{$args{objs}};
-     my @defs = map { (my $x = $_) =~ s|\.ld$||; "$x$defext" }
+     my @defs = map { platform->def($_) }
-                grep { $_ =~ /\.ld$/ }
+                grep { platform->isdef($_) }
                 @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      die "More than one exported symbols list" if scalar @defs > 1;
      my $linklibs = join("", map { "$_\n" } @deps);
      my $objs = join("\n", @objs);
      my $deps = join(" ", @objs, @defs, @deps);
-     my $import = shlib_import($lib);
+     my $import = platform->sharedlib_import($lib);
-     my $dll =  shlib($lib);
+     my $dll =  platform->sharedlib($lib);
      my $shared_def = join("", map { " /def:$_" } @defs);
      return <<"EOF"
 # The import library may look like a static library, but it is not.
@@ -679,13 +680,13 @@ EOF
  }
  sub obj2dso {
      my %args = @_;
-     my $dso = $args{lib};
+     my $dso = platform->dso($args{lib});
-     my $dso_n = basename($dso);
+     my $dso_n = platform->dsoname($args{lib});
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x }
+     my @objs = map { platform->convertext($_) }
-                grep { $_ =~ m/\.(?:o|res)$/ }
+                grep { platform->isobj($_) || platform->isres($_) }
                 @{$args{objs}};
-     my @defs = map { (my $x = $_) =~ s|\.ld$|$defext|; $x }
+     my @defs = map { platform->def($_) }
-                grep { $_ =~ /\.ld$/ }
+                grep { platform->isdef($_) }
                 @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      my $objs = join("\n", @objs);
@@ -693,21 +694,21 @@ EOF
      my $deps = join(" ", @objs, @defs, @deps);
      my $shared_def = join("", map { " /def:$_" } @defs);
      return <<"EOF";
-$dso$dsoext: $deps
+$dso: $deps
-	IF EXIST $dso$dsoext.manifest DEL /F /Q $dso$dsoext.manifest
+	IF EXIST $dso.manifest DEL /F /Q $dso.manifest
 	\$(LD) \$(LDFLAGS) \$(DSO_LDFLAGS) \\
-		\$(LDOUTFLAG)$dso$dsoext$shared_def @<< || (DEL /Q \$(\@B).* $dso.* && EXIT 1)
+		\$(LDOUTFLAG)$dso$shared_def @<< || (DEL /Q \$(\@B).* $dso_n.* && EXIT 1)
 $objs
 $linklibs \$(DSO_EX_LIBS)
 <<
-	IF EXIST $dso$dsoext.manifest \\
+	IF EXIST $dso.manifest \\
-	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso$dsoext.manifest \$(MTOUTFLAG)$dso$dsoext
+	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso.manifest \$(MTOUTFLAG)$dso
 EOF
  }
  sub obj2lib {
      my %args = @_;
-     my $lib = lib($args{lib});
+     my $lib = platform->staticlib($args{lib});
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+     my @objs = map { platform->obj($_) } @{$args{objs}};
      my $objs = join("\n", @objs);
      my $deps = join(" ", @objs);
      return <<"EOF";
@@ -719,22 +720,24 @@ EOF
  }
  sub obj2bin {
      my %args = @_;
-     my $bin = $args{bin};
+     my $bin = platform->bin($args{bin});
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+     my @objs = map { platform->convertext($_) }
+                grep { platform->isobj($_) || platform->isres($_) }
+                @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      my $objs = join("\n", @objs);
      my $linklibs = join("", map { "$_\n" } @deps);
      my $deps = join(" ", @objs, @deps);
      return <<"EOF";
-$bin$exeext: $deps
+$bin: $deps
-	IF EXIST $bin$exeext.manifest DEL /F /Q $bin$exeext.manifest
+	IF EXIST $bin.manifest DEL /F /Q $bin.manifest
-	\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin$exeext @<<
+	\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin @<<
 $objs
 setargv.obj
 $linklibs\$(BIN_EX_LIBS)
 <<
-	IF EXIST $bin$exeext.manifest \\
+	IF EXIST $bin.manifest \\
-	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin$exeext.manifest \$(MTOUTFLAG)$bin$exeext
+	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin.manifest \$(MTOUTFLAG)$bin
 EOF
   }
   sub in2script {
@@ -753,11 +756,11 @@ EOF
   sub generatedir {
       my %args = @_;
       my $dir = $args{dir};
-      my @deps = map { s|\.o$|$objext|; $_ } @{$args{deps}};
+      my @deps = map { platform->convertext($_) } @{$args{deps}};
       my @actions = ();
-      my %extinfo = ( dso => $dsoext,
+      my %extinfo = ( dso => platform->dsoext(),
-                      lib => $libext,
+                      lib => platform->libext(),
-                      bin => $exeext );
+                      bin => platform->binext() );
 
       # We already have a 'test' target, and the top directory is just plain
       # silly

Configure

@@ -1125,19 +1125,8 @@ foreach my $feature (@{$target{enable}}) {
 
 $target{CXXFLAGS}//=$target{CFLAGS} if $target{CXX};
 $target{cxxflags}//=$target{cflags} if $target{CXX};
-$target{exe_extension}="";
+$target{exe_extension}=".exe" if ($config{target} eq "DJGPP");
-$target{exe_extension}=".exe" if ($config{target} eq "DJGPP"
-                                  || $config{target} =~ /^(?:Cygwin|mingw)/);
 $target{exe_extension}=".pm"  if ($config{target} =~ /vos/);
-$target{def_extension}=".ld";
-$target{def_extension}=".def" if $config{target} =~ /^mingw|VC-/;
-$target{def_extension}=".opt" if $config{target} =~ /^vms/;
-($target{shared_extension_simple}=$target{shared_extension})
-    =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||
-    unless defined($target{shared_extension_simple});
-$target{dso_extension}//=$target{shared_extension_simple};
-($target{shared_import_extension}=$target{shared_extension_simple}.".a")
-    if ($config{target} =~ /^(?:Cygwin|mingw)/);
 
 # Fill %config with values from %user, and in case those are undefined or
 # empty, use values from %target (acting as a default).
@@ -1721,25 +1710,20 @@ if ($builder eq "unified") {
         my $f = 'build.info';
         # The basic things we're trying to build
         my @programs = ();
-        my @programs_install = ();
         my @libraries = ();
-        my @libraries_install = ();
         my @engines = ();
-        my @engines_install = ();
         my @scripts = ();
-        my @scripts_install = ();
         my @extra = ();
         my @overrides = ();
         my @intermediates = ();
         my @rawlines = ();
 
+        my %attributes = ();
         my %sources = ();
         my %shared_sources = ();
         my %includes = ();
         my %defines = ();
         my %depends = ();
-        my %renames = ();
-        my %sharednames = ();
         my %generate = ();
 
         # We want to detect configdata.pm in the source tree, so we
@@ -1805,40 +1789,84 @@ if ($builder eq "unified") {
                     }
                 }
             },
-            qr/^\s*PROGRAMS(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s*PROGRAMS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
+                    my @a = tokenize($1, qr|\s*,\s*|);
-                    my @x = tokenize($2);
+                    my @p = tokenize($2);
-                    push @programs, @x;
+                    push @programs, @p;
-                    push @programs_install, @x unless $install;
+                    foreach my $a (@a) {
+                        my $ak = $a;
+                        my $av = 1;
+                        if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) {
+                            $ak = $1;
+                            $av = $2;
+                        }
+                        foreach my $p (@p) {
+                            $attributes{$p}->{$ak} = $av;
+                        }
+                    }
+                    push @programs, @p;
                 }
             },
-            qr/^\s*LIBS(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s*LIBS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
+                    my @a = tokenize($1, qr|\s*,\s*|);
-                    my @x = tokenize($2);
+                    my @l = tokenize($2);
-                    push @libraries, @x;
+                    push @libraries, @l;
-                    push @libraries_install, @x unless $install;
+                    foreach my $a (@a) {
+                        my $ak = $a;
+                        my $av = 1;
+                        if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) {
+                            $ak = $1;
+                            $av = $2;
+                        }
+                        foreach my $l (@l) {
+                            $attributes{$l}->{$ak} = $av;
+                        }
+                    }
+                    push @libraries, @l;
                 }
             },
-            qr/^\s*ENGINES(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s*ENGINES(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
+                    my @a = tokenize($1, qr|\s*,\s*|);
-                    my @x = tokenize($2);
+                    my @e = tokenize($2);
-                    push @engines, @x;
+                    push @engines, @e;
-                    push @engines_install, @x unless $install;
+                    foreach my $a (@a) {
+                        my $ak = $a;
+                        my $av = 1;
+                        if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) {
+                            $ak = $1;
+                            $av = $2;
+                        }
+                        foreach my $e (@e) {
+                            $attributes{$e}->{$ak} = $av;
+                        }
+                    }
+                    push @engines, @e;
                 }
             },
-            qr/^\s*SCRIPTS(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s*SCRIPTS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
+                    my @a = tokenize($1, qr|\s*,\s*|);
-                    my @x = tokenize($2);
+                    my @s = tokenize($2);
-                    push @scripts, @x;
+                    push @scripts, @s;
-                    push @scripts_install, @x unless $install;
+                    foreach my $a (@a) {
+                        my $ak = $a;
+                        my $av = 1;
+                        if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) {
+                            $ak = $1;
+                            $av = $2;
+                        }
+                        foreach my $s (@s) {
+                            $attributes{$s}->{$ak} = $av;
+                        }
+                    }
+                    push @scripts, @s;
                 }
             },
             qr/^\s*EXTRA\s*=\s*(.*)\s*$/
@@ -1870,11 +1898,9 @@ if ($builder eq "unified") {
             => sub { push @{$generate{$1}}, $2
                          if !@skip || $skip[$#skip] > 0 },
             qr/^\s*RENAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$renames{$1}}, tokenize($2)
+            => sub { warn "RENAME is no longer supported\n" },
-                         if !@skip || $skip[$#skip] > 0 },
+             qr/^\s*SHARED_NAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            qr/^\s*SHARED_NAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
+            => sub { warn "SHARED_NAME is no longer supported\n" },
-            => sub { push @{$sharednames{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
             qr/^\s*BEGINRAW\[((?:\\.|[^\\\]])+)\]\s*$/
             => sub {
                 my $lineiterator = shift;
@@ -1908,146 +1934,51 @@ if ($builder eq "unified") {
             );
         die "runaway IF?" if (@skip);
 
-        foreach (keys %renames) {
-            die "$_ renamed to more than one thing: "
-                ,join(" ", @{$renames{$_}}),"\n"
-                if scalar @{$renames{$_}} > 1;
-            my $dest = cleanfile($buildd, $_, $blddir);
-            my $to = cleanfile($buildd, $renames{$_}->[0], $blddir);
-            die "$dest renamed to more than one thing: "
-                ,$unified_info{rename}->{$dest}, $to
-                unless !defined($unified_info{rename}->{$dest})
-                or $unified_info{rename}->{$dest} eq $to;
-            $unified_info{rename}->{$dest} = $to;
-        }
-
-        foreach (@programs) {
-            my $program = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$program}) {
-                $program = $unified_info{rename}->{$program};
-            }
-            $unified_info{programs}->{$program} = 1;
-        }
-
-        foreach (@programs_install) {
-            my $program = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$program}) {
-                $program = $unified_info{rename}->{$program};
-            }
-            $unified_info{install}->{programs}->{$program} = 1;
-        }
-
-        foreach (@libraries) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{libraries}->{$library} = 1;
-        }
-
-        foreach (@libraries_install) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{install}->{libraries}->{$library} = 1;
-        }
-
         die <<"EOF" if scalar @engines and !$config{dynamic_engines};
 ENGINES can only be used if configured with 'dynamic-engine'.
 This is usually a fault in a build.info file.
 EOF
-        foreach (@engines) {
+
-            my $library = cleanfile($buildd, $_, $blddir);
+        foreach (keys %attributes) {
-            if ($unified_info{rename}->{$library}) {
+            my $dest = $_;
-                $library = $unified_info{rename}->{$library};
+            my $ddest = cleanfile($buildd, $_, $blddir);
+            foreach (keys %{$attributes{$dest} // {}}) {
+                $unified_info{attributes}->{$ddest}->{$_} =
+                    $attributes{$dest}->{$_};
             }
-            $unified_info{engines}->{$library} = 1;
         }
 
-        foreach (@engines_install) {
+        {
-            my $library = cleanfile($buildd, $_, $blddir);
+            my %infos = ( programs  => [ @programs  ],
-            if ($unified_info{rename}->{$library}) {
+                          libraries => [ @libraries ],
-                $library = $unified_info{rename}->{$library};
+                          engines   => [ @engines   ],
+                          scripts   => [ @scripts   ],
+                          extra     => [ @extra     ],
+                          overrides => [ @overrides ] );
+            foreach my $k (keys %infos) {
+                foreach (@{$infos{$k}}) {
+                    my $item = cleanfile($buildd, $_, $blddir);
+                    $unified_info{$k}->{$item} = 1;
+                }
             }
-            $unified_info{install}->{engines}->{$library} = 1;
-        }
-
-        foreach (@scripts) {
-            my $script = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$script}) {
-                $script = $unified_info{rename}->{$script};
-            }
-            $unified_info{scripts}->{$script} = 1;
-        }
-
-        foreach (@scripts_install) {
-            my $script = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$script}) {
-                $script = $unified_info{rename}->{$script};
-            }
-            $unified_info{install}->{scripts}->{$script} = 1;
-        }
-
-        foreach (@extra) {
-            my $extra = cleanfile($buildd, $_, $blddir);
-            $unified_info{extra}->{$extra} = 1;
-        }
-
-        foreach (@overrides) {
-            my $override = cleanfile($buildd, $_, $blddir);
-            $unified_info{overrides}->{$override} = 1;
         }
 
         push @{$unified_info{rawlines}}, @rawlines;
 
-        unless ($disabled{shared}) {
+        # Check that we haven't defined any library as both shared and
-            # Check sharednames.
+        # explicitly static.  That is forbidden.
-            foreach (keys %sharednames) {
+        my @doubles = ();
-                my $dest = cleanfile($buildd, $_, $blddir);
+        foreach (grep /\.a$/, keys %{$unified_info{libraries}}) {
-                if ($unified_info{rename}->{$dest}) {
+            (my $l = $_) =~ s/\.a$//;
-                    $dest = $unified_info{rename}->{$dest};
+            push @doubles, $l if defined $unified_info{libraries}->{$l};
-                }
-                die "shared_name for $dest with multiple values: "
-                    ,join(" ", @{$sharednames{$_}}),"\n"
-                    if scalar @{$sharednames{$_}} > 1;
-                my $to = cleanfile($buildd, $sharednames{$_}->[0], $blddir);
-                die "shared_name found for a library $dest that isn't defined\n"
-                    unless $unified_info{libraries}->{$dest};
-                die "shared_name for $dest with multiple values: "
-                    ,$unified_info{sharednames}->{$dest}, ", ", $to
-                    unless !defined($unified_info{sharednames}->{$dest})
-                    or $unified_info{sharednames}->{$dest} eq $to;
-                $unified_info{sharednames}->{$dest} = $to;
-            }
-
-            # Additionally, we set up sharednames for libraries that don't
-            # have any, as themselves.  Only for libraries that aren't
-            # explicitly static.
-            foreach (grep !/\.a$/, keys %{$unified_info{libraries}}) {
-                if (!defined $unified_info{sharednames}->{$_}) {
-                    $unified_info{sharednames}->{$_} = $_
-                }
-            }
-
-            # Check that we haven't defined any library as both shared and
-            # explicitly static.  That is forbidden.
-            my @doubles = ();
-            foreach (grep /\.a$/, keys %{$unified_info{libraries}}) {
-                (my $l = $_) =~ s/\.a$//;
-                push @doubles, $l if defined $unified_info{sharednames}->{$l};
-            }
-            die "these libraries are both explicitly static and shared:\n  ",
-                join(" ", @doubles), "\n"
-                if @doubles;
         }
+        die "these libraries are both explicitly static and shared:\n  ",
+            join(" ", @doubles), "\n"
+            if @doubles;
 
         foreach (keys %sources) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             foreach (@{$sources{$dest}}) {
                 my $s = cleanfile($sourced, $_, $blddir);
 
@@ -2080,9 +2011,6 @@ EOF
         foreach (keys %shared_sources) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             foreach (@{$shared_sources{$dest}}) {
                 my $s = cleanfile($sourced, $_, $blddir);
 
@@ -2121,9 +2049,6 @@ EOF
         foreach (keys %generate) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             die "more than one generator for $dest: "
                     ,join(" ", @{$generate{$_}}),"\n"
                     if scalar @{$generate{$_}} > 1;
@@ -2140,9 +2065,6 @@ EOF
             # a generated file in the build tree.
             if ($ddest ne "" && ($ddest eq $src_configdata || ! -f $ddest)) {
                 $ddest = cleanfile($buildd, $_, $blddir);
-                if ($unified_info{rename}->{$ddest}) {
-                    $ddest = $unified_info{rename}->{$ddest};
-                }
             }
             foreach (@{$depends{$dest}}) {
                 my $d = cleanfile($sourced, $_, $blddir);
@@ -2165,11 +2087,7 @@ EOF
                 # should be added back after treatment.
                 $d =~ /(\.a)?$/;
                 my $e = $1 // "";
-                $d = $`;
+                $d = $`.$e;
-                if ($unified_info{rename}->{$d}) {
-                    $d = $unified_info{rename}->{$d};
-                }
-                $d .= $e;
                 $unified_info{depends}->{$ddest}->{$d} = 1;
             }
         }
@@ -2182,9 +2100,6 @@ EOF
             # a generated file in the build tree.
             if ($ddest eq $src_configdata || ! -f $ddest) {
                 $ddest = cleanfile($buildd, $_, $blddir);
-                if ($unified_info{rename}->{$ddest}) {
-                    $ddest = $unified_info{rename}->{$ddest};
-                }
             }
             foreach (@{$includes{$dest}}) {
                 my $is = cleandir($sourced, $_, $blddir);
@@ -2348,7 +2263,7 @@ EOF
         $unified_info{$_} = [ sort keys %{$unified_info{$_}} ];
     }
     # Two level structures
-    foreach my $l1 (("install", "sources", "shared_sources", "ldadd", "depends")) {
+    foreach my $l1 (("sources", "shared_sources", "ldadd", "depends")) {
         foreach my $l2 (sort keys %{$unified_info{$l1}}) {
             my @items =
                 sort
@@ -3609,39 +3524,50 @@ sub collect_information {
 }
 
 # tokenize($line)
+# tokenize($line,$separator)
 # $line is a line of text to split up into tokens
-# returns a list of tokens
+# $separator [optional] is a regular expression that separates the tokens,
+# the default being spaces.  Do not use quotes of any kind as separators,
+# that will give undefined results.
+# Returns a list of tokens.
 #
-# Tokens are divided by spaces.  If the tokens include spaces, they
+# Tokens are divided by separator (spaces by default).  If the tokens include
-# have to be quoted with single or double quotes.  Double quotes
+# the separators, they have to be quoted with single or double quotes.
-# inside a double quoted token must be escaped.  Escaping is done
+# Double quotes inside a double quoted token must be escaped.  Escaping is done
 # with backslash.
 # Basically, the same quoting rules apply for " and ' as in any
 # Unix shell.
 sub tokenize {
     my $line = my $debug_line = shift;
+    my $separator = shift // qr|\s+|;
     my @result = ();
 
-    while ($line =~ s|^\s+||, $line ne "") {
+    if ($ENV{CONFIGURE_DEBUG_TOKENIZE}) {
+        print STDERR "DEBUG[tokenize]: \$separator = $separator\n";
+    }
+
+    while ($line =~ s|^${separator}||, $line ne "") {
         my $token = "";
-        while ($line ne "" && $line !~ m|^\s|) {
+    again:
-            if ($line =~ m/^"((?:[^"\\]+|\\.)*)"/) {
+        $line =~ m/^(.*?)(${separator}|"|'|$)/;
-                $token .= $1;
+        $token .= $1;
-                $line = $';
+        $line = $2.$';
-            } elsif ($line =~ m/^'([^']*)'/) {
+
-                $token .= $1;
+        if ($line =~ m/^"((?:[^"\\]+|\\.)*)"/) {
-                $line = $';
+            $token .= $1;
-            } elsif ($line =~ m/^(\S+)/) {
+            $line = $';
-                $token .= $1;
+            goto again;
-                $line = $';
+        } elsif ($line =~ m/^'([^']*)'/) {
-            }
+            $token .= $1;
+            $line = $';
+            goto again;
         }
         push @result, $token;
     }
 
     if ($ENV{CONFIGURE_DEBUG_TOKENIZE}) {
-	print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
+        print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
-	print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
+        print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
     }
     return @result;
 }

NOTES.ANDROID

@@ -23,7 +23,7 @@
  platform. Though you still need to know the prefix to extend your PATH,
  in order to invoke $(CROSS_COMPILE)gcc and company. (Configure will fail
  and give you a hint if you get it wrong.) Apart from PATH adjustment
- you need to set ANDROID_NDK environment to point at NDK directory
+ you need to set ANDROID_NDK_HOME environment to point at NDK directory
  as /some/where/android-ndk-<ver>. Both variables are significant at both
  configuration and compilation times. NDK customarily supports multiple
  Android API levels, e.g. android-14, android-21, etc. By default latest 
@@ -32,13 +32,13 @@
  target platform version. For example, to compile for ICS on ARM with
  NDK 10d:
 
-    export ANDROID_NDK=/some/where/android-ndk-10d
+    export ANDROID_NDK_HOME=/some/where/android-ndk-10d
-    PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
+    PATH=$ANDROID_NDK_HOME/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
     ./Configure android-arm -D__ANDROID_API__=14
     make
 
  Caveat lector! Earlier OpenSSL versions relied on additional CROSS_SYSROOT
- variable set to $ANDROID_NDK/platforms/android-<api>/arch-<arch> to
+ variable set to $ANDROID_NDK_HOME/platforms/android-<api>/arch-<arch> to
  appoint headers-n-libraries' location. It's still recognized in order
  to facilitate migration from older projects. However, since API level
  appears in CROSS_SYSROOT value, passing -D__ANDROID_API__=N can be in
@@ -53,9 +53,9 @@
 
  Another option is to create so called "standalone toolchain" tailored
  for single specific platform including Android API level, and assign its
- location to ANDROID_NDK. In such case you have to pass matching target
+ location to ANDROID_NDK_HOME. In such case you have to pass matching
- name to Configure and shouldn't use -D__ANDROID_API__=N. PATH adjusment
+ target name to Configure and shouldn't use -D__ANDROID_API__=N. PATH
- becomes simpler, $ANDROID_NDK/bin:$PATH suffices.
+ adjustment becomes simpler, $ANDROID_NDK_HOME/bin:$PATH suffices.
 
  Running tests (on Linux)
  ------------------------

apps/apps.c

@@ -1557,7 +1557,7 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
 #else
     BIO_snprintf(buf, sizeof(buf), "%s-attr", dbfile);
 #endif
-    dbattr_conf = app_load_config(buf);
+    dbattr_conf = app_load_config_quiet(buf);
 
     retdb = app_malloc(sizeof(*retdb), "new DB");
     retdb->db = tmpdb;
@@ -2192,7 +2192,7 @@ double app_tminterval(int stop, int usertime)
 
     return ret;
 }
-#elif defined(OPENSSL_SYSTEM_VXWORKS)
+#elif defined(OPENSSL_SYS_VXWORKS)
 # include <time.h>
 
 double app_tminterval(int stop, int usertime)

apps/build.info

@@ -12,7 +12,7 @@
    our @apps_init_src = split(/\s+/, $target{apps_init_src});
    "" -}
 IF[{- !$disabled{apps} -}]
-  LIBS_NO_INST=libapps.a
+  LIBS{noinst}=libapps.a
   SOURCE[libapps.a]={- join(" ", @apps_lib_src) -}
   INCLUDE[libapps.a]=.. ../include
 
@@ -32,7 +32,10 @@ ENDIF
   GENERATE[progs.h]=progs.pl $(APPS_OPENSSL)
   DEPEND[progs.h]=../configdata.pm
 
-  SCRIPTS=CA.pl tsget.pl
+  SCRIPTS{misc}=CA.pl
   SOURCE[CA.pl]=CA.pl.in
+  # linkname tells build files that a symbolic link or copy of this script
+  # without extension must be installed as well.  Unix or Unix lookalike only.
+  SCRIPTS{misc,linkname=tsget}=tsget.pl
   SOURCE[tsget.pl]=tsget.in
 ENDIF

apps/cms.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -65,7 +65,7 @@ struct cms_key_param_st {
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENCRYPT,
-    OPT_DECRYPT, OPT_SIGN, OPT_SIGN_RECEIPT, OPT_RESIGN,
+    OPT_DECRYPT, OPT_SIGN, OPT_CADES, OPT_SIGN_RECEIPT, OPT_RESIGN,
     OPT_VERIFY, OPT_VERIFY_RETCODE, OPT_VERIFY_RECEIPT,
     OPT_CMSOUT, OPT_DATA_OUT, OPT_DATA_CREATE, OPT_DIGEST_VERIFY,
     OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
@@ -102,6 +102,7 @@ const OPTIONS cms_options[] = {
     {"sign", OPT_SIGN, '-', "Sign message"},
     {"sign_receipt", OPT_SIGN_RECEIPT, '-', "Generate a signed receipt for the message"},
     {"resign", OPT_RESIGN, '-', "Resign a signed message"},
+    {"cades", OPT_CADES, '-', "Include signer certificate digest"},
     {"verify", OPT_VERIFY, '-', "Verify signed message"},
     {"verify_retcode", OPT_VERIFY_RETCODE, '-'},
     {"verify_receipt", OPT_VERIFY_RECEIPT, '<'},
@@ -326,6 +327,9 @@ int cms_main(int argc, char **argv)
         case OPT_BINARY:
             flags |= CMS_BINARY;
             break;
+        case OPT_CADES:
+            flags |= CMS_CADES;
+            break;
         case OPT_KEYID:
             flags |= CMS_USE_KEYID;
             break;

apps/ocsp.c

@@ -53,6 +53,20 @@ NON_EMPTY_TRANSLATION_UNIT
 #  define LOG_ERR       2
 # endif
 
+# if defined(OPENSSL_SYS_VXWORKS)
+/* not supported */
+int setpgid(pid_t pid, pid_t pgid)
+{
+    errno = ENOSYS;
+    return 0;
+}
+/* not supported */
+pid_t fork(void)
+{
+    errno = ENOSYS;
+    return (pid_t) -1;
+}
+# endif
 /* Maximum leeway in validity period: default 5 minutes */
 # define MAX_VALIDITY_PERIOD    (5 * 60)
 

apps/rehash.c

@@ -51,6 +51,26 @@
 # endif
 # define MAX_COLLISIONS  256
 
+# if defined(OPENSSL_SYS_VXWORKS)
+/*
+ * VxWorks has no symbolic links
+ */
+
+#  define lstat(path, buf) stat(path, buf)
+
+int symlink(const char *target, const char *linkpath)
+{
+    errno = ENOSYS;
+    return -1;
+}
+
+ssize_t readlink(const char *pathname, char *buf, size_t bufsiz)
+{
+    errno = ENOSYS;
+    return -1;
+}
+# endif
+
 typedef struct hentry_st {
     struct hentry_st *next;
     char *filename;

apps/s_client.c

@@ -74,6 +74,7 @@ static void print_stuff(BIO *berr, SSL *con, int full);
 static int ocsp_resp_cb(SSL *s, void *arg);
 #endif
 static int ldap_ExtendedResponse_parse(const char *buf, long rem);
+static char *base64encode (const void *buf, size_t len);
 
 static int saved_errno;
 
@@ -590,7 +591,8 @@ typedef enum OPTION_choice {
     OPT_V_ENUM,
     OPT_X_ENUM,
     OPT_S_ENUM,
-    OPT_FALLBACKSCSV, OPT_NOCMDS, OPT_PROXY, OPT_DANE_TLSA_DOMAIN,
+    OPT_FALLBACKSCSV, OPT_NOCMDS, OPT_PROXY, OPT_PROXY_USER, OPT_PROXY_PASS,
+    OPT_DANE_TLSA_DOMAIN,
 #ifndef OPENSSL_NO_CT
     OPT_CT, OPT_NOCT, OPT_CTLOG_FILE,
 #endif
@@ -608,6 +610,8 @@ const OPTIONS s_client_options[] = {
     {"bind", OPT_BIND, 's', "bind local address for connection"},
     {"proxy", OPT_PROXY, 's',
      "Connect to via specified proxy to the real server"},
+    {"proxy_user", OPT_PROXY_USER, 's', "UserID for proxy authentication"},
+    {"proxy_pass", OPT_PROXY_PASS, 's', "Proxy authentication password source"},
 #ifdef AF_UNIX
     {"unix", OPT_UNIX, 's', "Connect over the specified Unix-domain socket"},
 #endif
@@ -894,8 +898,10 @@ int s_client_main(int argc, char **argv)
     STACK_OF(X509_CRL) *crls = NULL;
     const SSL_METHOD *meth = TLS_client_method();
     const char *CApath = NULL, *CAfile = NULL;
-    char *cbuf = NULL, *sbuf = NULL;
+    char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL;
-    char *mbuf = NULL, *proxystr = NULL, *connectstr = NULL, *bindstr = NULL;
+    char *proxystr = NULL, *proxyuser = NULL;
+    char *proxypassarg = NULL, *proxypass = NULL;
+    char *connectstr = NULL, *bindstr = NULL;
     char *cert_file = NULL, *key_file = NULL, *chain_file = NULL;
     char *chCApath = NULL, *chCAfile = NULL, *host = NULL;
     char *port = OPENSSL_strdup(PORT);
@@ -1075,6 +1081,12 @@ int s_client_main(int argc, char **argv)
             proxystr = opt_arg();
             starttls_proto = PROTO_CONNECT;
             break;
+        case OPT_PROXY_USER:
+            proxyuser = opt_arg();
+            break;
+        case OPT_PROXY_PASS:
+            proxypassarg = opt_arg();
+            break;
 #ifdef AF_UNIX
         case OPT_UNIX:
             connect_type = use_unix;
@@ -1619,7 +1631,17 @@ int s_client_main(int argc, char **argv)
 #endif
 
     if (!app_passwd(passarg, NULL, &pass, NULL)) {
-        BIO_printf(bio_err, "Error getting password\n");
+        BIO_printf(bio_err, "Error getting private key password\n");
+        goto end;
+    }
+
+    if (!app_passwd(proxypassarg, NULL, &proxypass, NULL)) {
+        BIO_printf(bio_err, "Error getting proxy password\n");
+        goto end;
+    }
+
+    if (proxypass != NULL && proxyuser == NULL) {
+        BIO_printf(bio_err, "Error: Must specify proxy_user with proxy_pass\n");
         goto end;
     }
 
@@ -2322,7 +2344,33 @@ int s_client_main(int argc, char **argv)
             BIO *fbio = BIO_new(BIO_f_buffer());
 
             BIO_push(fbio, sbio);
-            BIO_printf(fbio, "CONNECT %s HTTP/1.0\r\n\r\n", connectstr);
+            BIO_printf(fbio, "CONNECT %s HTTP/1.0\r\n", connectstr);
+            /* 
+             * Workaround for broken proxies which would otherwise close
+             * the connection when entering tunnel mode (eg Squid 2.6)
+             */
+            BIO_printf(fbio, "Proxy-Connection: Keep-Alive\r\n");
+
+            /* Support for basic (base64) proxy authentication */
+            if (proxyuser != NULL) {
+                size_t l;
+                char *proxyauth, *proxyauthenc;
+
+                l = strlen(proxyuser);
+                if (proxypass != NULL)
+                    l += strlen(proxypass);
+                proxyauth = app_malloc(l + 2, "Proxy auth string");
+                BIO_snprintf(proxyauth, l + 2, "%s:%s", proxyuser,
+                             (proxypass != NULL) ? proxypass : "");
+                proxyauthenc = base64encode(proxyauth, strlen(proxyauth));
+                BIO_printf(fbio, "Proxy-Authorization: Basic %s\r\n",
+                           proxyauthenc);
+                OPENSSL_clear_free(proxyauth, strlen(proxyauth));
+                OPENSSL_clear_free(proxyauthenc, strlen(proxyauthenc));
+            }
+
+            /* Terminate the HTTP CONNECT request */
+            BIO_printf(fbio, "\r\n");
             (void)BIO_flush(fbio);
             /*
              * The first line is the HTTP response.  According to RFC 7230,
@@ -3035,9 +3083,7 @@ int s_client_main(int argc, char **argv)
                 BIO_printf(bio_err, "RENEGOTIATING\n");
                 SSL_renegotiate(con);
                 cbuf_len = 0;
-            }
+	    } else if (!c_ign_eof && (cbuf[0] == 'K' || cbuf[0] == 'k' )
-
-            if (!c_ign_eof && (cbuf[0] == 'K' || cbuf[0] == 'k' )
                     && cmdletters) {
                 BIO_printf(bio_err, "KEYUPDATE\n");
                 SSL_key_update(con,
@@ -3128,6 +3174,8 @@ int s_client_main(int argc, char **argv)
     OPENSSL_clear_free(cbuf, BUFSIZZ);
     OPENSSL_clear_free(sbuf, BUFSIZZ);
     OPENSSL_clear_free(mbuf, BUFSIZZ);
+    if (proxypass != NULL)
+        OPENSSL_clear_free(proxypass, strlen(proxypass));
     release_engine(e);
     BIO_free(bio_c_out);
     bio_c_out = NULL;
@@ -3467,4 +3515,27 @@ static int ldap_ExtendedResponse_parse(const char *buf, long rem)
     return ret;
 }
 
+/*
+ * BASE64 encoder: used only for encoding basic proxy authentication credentials
+ */
+static char *base64encode (const void *buf, size_t len)
+{
+    int i;
+    size_t outl;
+    char  *out;
+
+    /* Calculate size of encoded data */
+    outl = (len / 3);
+    if (len % 3 > 0)
+        outl++;
+    outl <<= 2;
+    out = app_malloc(outl + 1, "base64 encode buffer");
+
+    i = EVP_EncodeBlock((unsigned char *)out, buf, len);
+    assert(i <= (int)outl);
+    if (i < 0)
+        *out = '\0'; 
+    return out;
+}
+
 #endif                          /* OPENSSL_NO_SOCK */

apps/speed.c

@@ -100,7 +100,7 @@
 #include <openssl/modes.h>
 
 #ifndef HAVE_FORK
-# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
+# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_VXWORKS)
 #  define HAVE_FORK 0
 # else
 #  define HAVE_FORK 1
@@ -1522,11 +1522,11 @@ int speed_main(int argc, char **argv)
         {"nistp192", NID_X9_62_prime192v1, 192},
         {"nistp224", NID_secp224r1, 224},
         {"nistp256", NID_X9_62_prime256v1, 256},
-        {"nistp384", NID_secp384r1, 384}, 
+        {"nistp384", NID_secp384r1, 384},
         {"nistp521", NID_secp521r1, 521},
         /* Binary Curves */
         {"nistk163", NID_sect163k1, 163},
-        {"nistk233", NID_sect233k1, 233}, 
+        {"nistk233", NID_sect233k1, 233},
         {"nistk283", NID_sect283k1, 283},
         {"nistk409", NID_sect409k1, 409},
         {"nistk571", NID_sect571k1, 571},

build.info

@@ -2,15 +2,6 @@
 # %skipdir there for further explanations.
 SUBDIRS=crypto ssl apps test util tools fuzz engines
 
-{-
-     my @sover = split(/\./, $config{shlib_version});
-     our $sover_filename;
-     $sover_filename = join('.', @sover)
-         if $config{target} =~ /^mingw/ || $config{target} =~ /^VC-/;
-     $sover_filename = join('', map { sprintf "%02d", $_ } @sover)
-         if $config{target} =~ /^vms/;
-     "";
--}
 LIBS=libcrypto libssl
 INCLUDE[libcrypto]=. crypto/include include
 INCLUDE[libssl]=. include
@@ -44,26 +35,3 @@ IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
   SHARED_SOURCE[libcrypto]=libcrypto.rc
   SHARED_SOURCE[libssl]=libssl.rc
 ENDIF
-
-IF[{- $config{target} =~ /^Cygwin/ -}]
- SHARED_NAME[libcrypto]=cygcrypto-{- $sover_filename -}
- SHARED_NAME[libssl]=cygssl-{- $sover_filename -}
-ELSIF[{- $config{target} =~ /^mingw/ -}]
- SHARED_NAME[libcrypto]=libcrypto-{- $sover_filename -}{- $config{target} eq "mingw64" ? "-x64" : "" -}
- SHARED_NAME[libssl]=libssl-{- $sover_filename -}{- $config{target} eq "mingw64" ? "-x64" : "" -}
-ELSIF[{- $config{target} =~ /^VC-/ -}]
- SHARED_NAME[libcrypto]=libcrypto-{- $sover_filename -}{- $target{multilib} -}
- SHARED_NAME[libssl]=libssl-{- $sover_filename -}{- $target{multilib} -}
-ENDIF
-
-# VMS has a cultural standard where all libraries are prefixed.
-# For OpenSSL, the choice is 'ossl$' (this prefix was claimed in a
-# conversation with VSI, Tuesday January 26 2016)
-# Also, it seems it's usual to have the pointer size the libraries
-# were built for as part of the name.
-IF[{- $config{target} =~ /^vms/ -}]
- RENAME[libcrypto]=ossl$libcrypto{- $target{pointer_size} -}
- RENAME[libssl]=ossl$libssl{- $target{pointer_size} -}
- SHARED_NAME[libcrypto]=ossl$libcrypto{- $sover_filename -}_shr{- $target{pointer_size} -}
- SHARED_NAME[libssl]=ossl$libssl{- $sover_filename -}_shr{- $target{pointer_size} -}
-ENDIF

crypto/async/async_locl.h

@@ -59,6 +59,9 @@ struct async_wait_ctx_st {
     struct fd_lookup_st *fds;
     size_t numadd;
     size_t numdel;
+    ASYNC_callback_fn callback;
+    void *callback_arg;
+    int status;
 };
 
 DEFINE_STACK_OF(ASYNC_JOB)

crypto/async/async_wait.c

@@ -182,6 +182,41 @@ int ASYNC_WAIT_CTX_clear_fd(ASYNC_WAIT_CTX *ctx, const void *key)
     return 0;
 }
 
+int ASYNC_WAIT_CTX_set_callback(ASYNC_WAIT_CTX *ctx,
+                                ASYNC_callback_fn callback,
+                                void *callback_arg)
+{
+      if (ctx == NULL)
+          return 0;
+
+      ctx->callback = callback;
+      ctx->callback_arg = callback_arg;
+      return 1;
+}
+
+int ASYNC_WAIT_CTX_get_callback(ASYNC_WAIT_CTX *ctx,
+                                ASYNC_callback_fn *callback,
+                                void **callback_arg)
+{
+      if (ctx->callback == NULL)
+          return 0;
+
+      *callback = ctx->callback;
+      *callback_arg = ctx->callback_arg;
+      return 1;
+}
+
+int ASYNC_WAIT_CTX_set_status(ASYNC_WAIT_CTX *ctx, int status)
+{
+      ctx->status = status;
+      return 1;
+}
+
+int ASYNC_WAIT_CTX_get_status(ASYNC_WAIT_CTX *ctx)
+{
+      return ctx->status;
+}
+
 void async_wait_ctx_reset_counts(ASYNC_WAIT_CTX *ctx)
 {
     struct fd_lookup_st *curr, *prev = NULL;

crypto/bio/b_addr.c

@@ -782,7 +782,12 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
                  * anyway [above getaddrinfo/gai_strerror is]. We just let
                  * system administrator figure this out...
                  */
+# if defined(OPENSSL_SYS_VXWORKS)
+                /* h_errno doesn't exist on VxWorks */
+                SYSerr(SYS_F_GETHOSTBYNAME, 1000 );
+# else
                 SYSerr(SYS_F_GETHOSTBYNAME, 1000 + h_errno);
+# endif
 #else
                 SYSerr(SYS_F_GETHOSTBYNAME, WSAGetLastError());
 #endif

crypto/bio/bss_mem.c

@@ -20,7 +20,7 @@ static long mem_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int mem_new(BIO *h);
 static int secmem_new(BIO *h);
 static int mem_free(BIO *data);
-static int mem_buf_free(BIO *data, int free_all);
+static int mem_buf_free(BIO *data);
 static int mem_buf_sync(BIO *h);
 
 static const BIO_METHOD mem_method = {
@@ -140,10 +140,20 @@ static int secmem_new(BIO *bi)
 
 static int mem_free(BIO *a)
 {
-    return mem_buf_free(a, 1);
+    BIO_BUF_MEM *bb;
+
+    if (a == NULL)
+        return 0;
+
+    bb = (BIO_BUF_MEM *)a->ptr;
+    if (!mem_buf_free(a))
+        return 0;
+    OPENSSL_free(bb->readp);
+    OPENSSL_free(bb);
+    return 1;
 }
 
-static int mem_buf_free(BIO *a, int free_all)
+static int mem_buf_free(BIO *a)
 {
     if (a == NULL)
         return 0;
@@ -155,11 +165,6 @@ static int mem_buf_free(BIO *a, int free_all)
         if (a->flags & BIO_FLAGS_MEM_RDONLY)
             b->data = NULL;
         BUF_MEM_free(b);
-        if (free_all) {
-            OPENSSL_free(bb->readp);
-            OPENSSL_free(bb);
-        }
-        a->ptr = NULL;
     }
     return 1;
 }
@@ -266,11 +271,10 @@ static long mem_ctrl(BIO *b, int cmd, long num, void *ptr)
         }
         break;
     case BIO_C_SET_BUF_MEM:
-        mem_buf_free(b, 0);
+        mem_buf_free(b);
         b->shutdown = (int)num;
         bbm->buf = ptr;
         *bbm->readp = *bbm->buf;
-        b->ptr = bbm;
         break;
     case BIO_C_GET_BUF_MEM_PTR:
         if (ptr != NULL) {

crypto/bn/bn_depr.c

@@ -40,7 +40,7 @@ BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
         goto err;
 
     /* we have a prime :-) */
-    return ret;
+    return rnd;
  err:
     BN_free(rnd);
     return NULL;

crypto/build.info

@@ -5,7 +5,7 @@ SUBDIRS=objects buffer bio stack lhash rand evp asn1 pem x509 x509v3 conf \
         md2 md4 md5 sha mdc2 gmac hmac ripemd whrlpool poly1305 blake2 \
         siphash sm3 des aes rc2 rc4 rc5 idea aria bf cast camellia \
         seed sm4 chacha modes bn ec rsa dsa dh sm2 dso engine \
-        err comp ocsp cms ts srp cmac ct async kmac
+        err comp ocsp cms ts srp cmac ct async kmac ess
 
 LIBS=../libcrypto
 SOURCE[../libcrypto]=\

crypto/cms/cms_err.c

@@ -27,6 +27,10 @@ static const ERR_STRING_DATA CMS_str_functs[] = {
     {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_ADD1_SIGNER, 0), "CMS_add1_signer"},
     {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_ADD1_SIGNINGTIME, 0),
      "cms_add1_signingTime"},
+    {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_ADD1_SIGNING_CERT, 0),
+     "CMS_add1_signing_cert"},
+    {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_ADD1_SIGNING_CERT_V2, 0),
+     "CMS_add1_signing_cert_v2"},
     {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_COMPRESS, 0), "CMS_compress"},
     {ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_COMPRESSEDDATA_CREATE, 0),
      "cms_CompressedData_create"},

crypto/cms/cms_ess.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -14,11 +14,13 @@
 #include <openssl/x509v3.h>
 #include <openssl/err.h>
 #include <openssl/cms.h>
+#include <openssl/ess.h>
 #include "cms_lcl.h"
+#include "internal/ess_int.h"
 
 IMPLEMENT_ASN1_FUNCTIONS(CMS_ReceiptRequest)
 
-/* ESS services: for now just Signed Receipt related */
+/* ESS services */
 
 int CMS_get1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest **prr)
 {
@@ -335,3 +337,70 @@ ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si)
     CMS_ReceiptRequest_free(rr);
     return os;
 }
+
+/*
+ * Add signer certificate's V2 digest to a SignerInfo
+ * structure
+ */
+
+int CMS_add1_signing_cert_v2(CMS_SignerInfo *si,
+                             ESS_SIGNING_CERT_V2 *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp;
+    int len;
+
+    /* Add SigningCertificateV2 signed attribute to the signer info. */
+    len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
+    if ((pp = OPENSSL_malloc(len)) == NULL)
+        goto err;
+    p = pp;
+    i2d_ESS_SIGNING_CERT_V2(sc, &p);
+    if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len))
+        goto err;
+    OPENSSL_free(pp);
+    pp = NULL;
+    if (!CMS_signed_add1_attr_by_NID(si, NID_id_smime_aa_signingCertificateV2,
+                                     V_ASN1_SEQUENCE, seq, -1))
+        goto err;
+    ASN1_STRING_free(seq);
+    return 1;
+ err:
+    CMSerr(CMS_F_CMS_ADD1_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+    return 0;
+}
+
+/*
+ * Add signer certificate's digest to a SignerInfo
+ * structure
+ */
+
+int CMS_add1_signing_cert(CMS_SignerInfo *si, ESS_SIGNING_CERT *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp;
+    int len;
+
+    /* Add SigningCertificate signed attribute to the signer info. */
+    len = i2d_ESS_SIGNING_CERT(sc, NULL);
+    if ((pp = OPENSSL_malloc(len)) == NULL)
+        goto err;
+    p = pp;
+    i2d_ESS_SIGNING_CERT(sc, &p);
+    if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len))
+        goto err;
+    OPENSSL_free(pp);
+    pp = NULL;
+    if (!CMS_signed_add1_attr_by_NID(si, NID_id_smime_aa_signingCertificate,
+                                     V_ASN1_SEQUENCE, seq, -1))
+        goto err;
+    ASN1_STRING_free(seq);
+    return 1;
+ err:
+    CMSerr(CMS_F_CMS_ADD1_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+    return 0;
+}

crypto/cms/cms_sd.c

@@ -332,6 +332,27 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
                 !CMS_SignerInfo_sign(si))
                 goto err;
         }
+        if (flags & CMS_CADES) {
+            ESS_SIGNING_CERT *sc = NULL;
+            ESS_SIGNING_CERT_V2 *sc2 = NULL;
+            int add_sc;
+
+            if (md == EVP_sha1() || md == NULL) {
+                if ((sc = ESS_SIGNING_CERT_new_init(signer,
+                                                    NULL, 1)) == NULL)
+                    goto err;
+                add_sc = CMS_add1_signing_cert(si, sc);
+                ESS_SIGNING_CERT_free(sc);
+            } else {
+                if ((sc2 = ESS_SIGNING_CERT_V2_new_init(md, signer,
+                                                        NULL, 1)) == NULL)
+                    goto err;
+                add_sc = CMS_add1_signing_cert_v2(si, sc2);
+                ESS_SIGNING_CERT_V2_free(sc2);
+            }
+            if (!add_sc)
+                goto err;
+        }
     }
 
     if (!(flags & CMS_NOCERTS)) {

crypto/cryptlib.c

@@ -460,4 +460,14 @@ uint32_t OPENSSL_rdtsc(void)
 {
     return 0;
 }
+
+size_t OPENSSL_instrument_bus(unsigned int *out, size_t cnt)
+{
+    return 0;
+}
+
+size_t OPENSSL_instrument_bus2(unsigned int *out, size_t cnt, size_t max)
+{
+    return 0;
+}
 #endif

crypto/err/err.c

@@ -64,6 +64,7 @@ static ERR_STRING_DATA ERR_str_libraries[] = {
     {ERR_PACK(ERR_LIB_KDF, 0, 0), "KDF routines"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, 0, 0), "STORE routines"},
     {ERR_PACK(ERR_LIB_SM2, 0, 0), "SM2 routines"},
+    {ERR_PACK(ERR_LIB_ESS, 0, 0), "ESS routines"},
     {0, NULL},
 };
 
@@ -790,20 +791,31 @@ int ERR_get_next_error_library(void)
     return ret;
 }
 
-void ERR_set_error_data(char *data, int flags)
+static int err_set_error_data_int(char *data, int flags)
 {
     ERR_STATE *es;
     int i;
 
     es = ERR_get_state();
     if (es == NULL)
-        return;
+        return 0;
 
     i = es->top;
 
     err_clear_data(es, i);
     es->err_data[i] = data;
     es->err_data_flags[i] = flags;
+
+    return 1;
+}
+
+void ERR_set_error_data(char *data, int flags)
+{
+    /*
+     * This function is void so we cannot propagate the error return. Since it
+     * is also in the public API we can't change the return type.
+     */
+    err_set_error_data_int(data, flags);
 }
 
 void ERR_add_error_data(int num, ...)
@@ -843,7 +855,8 @@ void ERR_add_error_vdata(int num, va_list args)
         }
         OPENSSL_strlcat(str, a, (size_t)s + 1);
     }
-    ERR_set_error_data(str, ERR_TXT_MALLOCED | ERR_TXT_STRING);
+    if (!err_set_error_data_int(str, ERR_TXT_MALLOCED | ERR_TXT_STRING))
+        OPENSSL_free(str);
 }
 
 int ERR_set_mark(void)

crypto/err/err_all.c

@@ -38,6 +38,7 @@
 #include <openssl/asyncerr.h>
 #include <openssl/kdferr.h>
 #include <openssl/storeerr.h>
+#include <openssl/esserr.h>
 
 int err_load_crypto_strings_int(void)
 {
@@ -91,6 +92,7 @@ int err_load_crypto_strings_int(void)
 # ifndef OPENSSL_NO_CT
         ERR_load_CT_strings() == 0 ||
 # endif
+        ERR_load_ESS_strings() == 0 ||
         ERR_load_ASYNC_strings() == 0 ||
 #endif
         ERR_load_KDF_strings() == 0 ||

crypto/err/openssl.ec

@@ -34,6 +34,7 @@ L ASYNC         include/openssl/async.h         crypto/async/async_err.c
 L KDF           include/openssl/kdf.h           crypto/kdf/kdf_err.c
 L SM2           crypto/include/internal/sm2.h   crypto/sm2/sm2_err.c
 L OSSL_STORE    include/openssl/store.h         crypto/store/store_err.c
+L ESS           include/openssl/ess.h           crypto/ess/ess_err.c
 
 # additional header files to be scanned for function names
 L NONE          include/openssl/x509_vfy.h      NONE

crypto/err/openssl.txt

@@ -1,4 +1,4 @@
-# Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 1999-2019 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -242,6 +242,8 @@ CMS_F_CMS_ADD1_RECEIPTREQUEST:158:CMS_add1_ReceiptRequest
 CMS_F_CMS_ADD1_RECIPIENT_CERT:101:CMS_add1_recipient_cert
 CMS_F_CMS_ADD1_SIGNER:102:CMS_add1_signer
 CMS_F_CMS_ADD1_SIGNINGTIME:103:cms_add1_signingTime
+CMS_F_CMS_ADD1_SIGNING_CERT:181:CMS_add1_signing_cert
+CMS_F_CMS_ADD1_SIGNING_CERT_V2:182:CMS_add1_signing_cert_v2
 CMS_F_CMS_COMPRESS:104:CMS_compress
 CMS_F_CMS_COMPRESSEDDATA_CREATE:105:cms_CompressedData_create
 CMS_F_CMS_COMPRESSEDDATA_INIT_BIO:106:cms_CompressedData_init_bio
@@ -709,6 +711,12 @@ ENGINE_F_INT_CTRL_HELPER:172:int_ctrl_helper
 ENGINE_F_INT_ENGINE_CONFIGURE:188:int_engine_configure
 ENGINE_F_INT_ENGINE_MODULE_INIT:187:int_engine_module_init
 ENGINE_F_OSSL_HMAC_INIT:200:ossl_hmac_init
+ESS_F_ESS_CERT_ID_NEW_INIT:100:ESS_CERT_ID_new_init
+ESS_F_ESS_CERT_ID_V2_NEW_INIT:101:ESS_CERT_ID_V2_new_init
+ESS_F_ESS_SIGNING_CERT_ADD:104:ESS_SIGNING_CERT_add
+ESS_F_ESS_SIGNING_CERT_NEW_INIT:102:ESS_SIGNING_CERT_new_init
+ESS_F_ESS_SIGNING_CERT_V2_ADD:105:ESS_SIGNING_CERT_V2_add
+ESS_F_ESS_SIGNING_CERT_V2_NEW_INIT:103:ESS_SIGNING_CERT_V2_new_init
 EVP_F_AESNI_INIT_KEY:165:aesni_init_key
 EVP_F_AES_GCM_CTRL:196:aes_gcm_ctrl
 EVP_F_AES_GCM_TLS_CIPHER:207:aes_gcm_tls_cipher
@@ -1558,12 +1566,6 @@ SSL_F_WPACKET_START_SUB_PACKET_LEN__:634:WPACKET_start_sub_packet_len__
 SSL_F_WRITE_STATE_MACHINE:586:write_state_machine
 TS_F_DEF_SERIAL_CB:110:def_serial_cb
 TS_F_DEF_TIME_CB:111:def_time_cb
-TS_F_ESS_ADD_SIGNING_CERT:112:ess_add_signing_cert
-TS_F_ESS_ADD_SIGNING_CERT_V2:147:ess_add_signing_cert_v2
-TS_F_ESS_CERT_ID_NEW_INIT:113:ess_CERT_ID_new_init
-TS_F_ESS_CERT_ID_V2_NEW_INIT:156:ess_cert_id_v2_new_init
-TS_F_ESS_SIGNING_CERT_NEW_INIT:114:ess_SIGNING_CERT_new_init
-TS_F_ESS_SIGNING_CERT_V2_NEW_INIT:157:ess_signing_cert_v2_new_init
 TS_F_INT_TS_RESP_VERIFY_TOKEN:149:int_ts_RESP_verify_token
 TS_F_PKCS7_TO_TS_TST_INFO:148:PKCS7_to_TS_TST_INFO
 TS_F_TS_ACCURACY_SET_MICROS:115:TS_ACCURACY_set_micros
@@ -2223,6 +2225,9 @@ ENGINE_R_UNIMPLEMENTED_CIPHER:146:unimplemented cipher
 ENGINE_R_UNIMPLEMENTED_DIGEST:147:unimplemented digest
 ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD:101:unimplemented public key method
 ENGINE_R_VERSION_INCOMPATIBILITY:145:version incompatibility
+ESS_R_ESS_SIGNING_CERTIFICATE_ERROR:102:ess signing certificate error
+ESS_R_ESS_SIGNING_CERT_ADD_ERROR:100:ess signing cert add error
+ESS_R_ESS_SIGNING_CERT_V2_ADD_ERROR:101:ess signing cert v2 add error
 EVP_R_AES_KEY_SETUP_FAILED:143:aes key setup failed
 EVP_R_ARIA_KEY_SETUP_FAILED:176:aria key setup failed
 EVP_R_BAD_DECRYPT:100:bad decrypt

crypto/ess/build.info

@@ -0,0 +1,3 @@
+LIBS=../../libcrypto
+SOURCE[../../libcrypto]= \
+        ess_lib.c ess_asn1.c ess_err.c

crypto/ess/ess_asn1.c

@@ -0,0 +1,57 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
+#include <openssl/ess.h>
+#include <openssl/x509v3.h>
+#include "internal/ess_int.h"
+
+/* ASN1 stuff for ESS Structure */
+
+ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
+        ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
+        ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
+} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
+
+ASN1_SEQUENCE(ESS_CERT_ID) = {
+        ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
+        ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
+        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
+        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
+
+ASN1_SEQUENCE(ESS_CERT_ID_V2) = {
+        ASN1_OPT(ESS_CERT_ID_V2, hash_alg, X509_ALGOR),
+        ASN1_SIMPLE(ESS_CERT_ID_V2, hash, ASN1_OCTET_STRING),
+        ASN1_OPT(ESS_CERT_ID_V2, issuer_serial, ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID_V2)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = {
+        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT_V2, cert_ids, ESS_CERT_ID_V2),
+        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT_V2, policy_info, POLICYINFO)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)

crypto/ess/ess_err.c

@@ -0,0 +1,53 @@
+/*
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/esserr.h>
+
+#ifndef OPENSSL_NO_ERR
+
+static const ERR_STRING_DATA ESS_str_functs[] = {
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_CERT_ID_NEW_INIT, 0),
+     "ESS_CERT_ID_new_init"},
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_CERT_ID_V2_NEW_INIT, 0),
+     "ESS_CERT_ID_V2_new_init"},
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_SIGNING_CERT_ADD, 0),
+     "ESS_SIGNING_CERT_add"},
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_SIGNING_CERT_NEW_INIT, 0),
+     "ESS_SIGNING_CERT_new_init"},
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_SIGNING_CERT_V2_ADD, 0),
+     "ESS_SIGNING_CERT_V2_add"},
+    {ERR_PACK(ERR_LIB_ESS, ESS_F_ESS_SIGNING_CERT_V2_NEW_INIT, 0),
+     "ESS_SIGNING_CERT_V2_new_init"},
+    {0, NULL}
+};
+
+static const ERR_STRING_DATA ESS_str_reasons[] = {
+    {ERR_PACK(ERR_LIB_ESS, 0, ESS_R_ESS_SIGNING_CERTIFICATE_ERROR),
+    "ess signing certificate error"},
+    {ERR_PACK(ERR_LIB_ESS, 0, ESS_R_ESS_SIGNING_CERT_ADD_ERROR),
+    "ess signing cert add error"},
+    {ERR_PACK(ERR_LIB_ESS, 0, ESS_R_ESS_SIGNING_CERT_V2_ADD_ERROR),
+    "ess signing cert v2 add error"},
+    {0, NULL}
+};
+
+#endif
+
+int ERR_load_ESS_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+    if (ERR_func_error_string(ESS_str_functs[0].error) == NULL) {
+        ERR_load_strings_const(ESS_str_functs);
+        ERR_load_strings_const(ESS_str_reasons);
+    }
+#endif
+    return 1;
+}

crypto/ess/ess_lib.c

@@ -0,0 +1,269 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <string.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/ess.h>
+#include "internal/ess_int.h"
+
+static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
+                                               X509 *cert, int issuer_needed);
+
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+                                            STACK_OF(X509) *certs,
+                                            int issuer_needed)
+{
+    ESS_CERT_ID *cid = NULL;
+    ESS_SIGNING_CERT *sc;
+    int i;
+
+    if ((sc = ESS_SIGNING_CERT_new()) == NULL)
+        goto err;
+    if (sc->cert_ids == NULL
+        && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
+        goto err;
+
+    if ((cid = ESS_CERT_ID_new_init(signcert, issuer_needed)) == NULL
+        || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+        goto err;
+    for (i = 0; i < sk_X509_num(certs); ++i) {
+        X509 *cert = sk_X509_value(certs, i);
+        if ((cid = ESS_CERT_ID_new_init(cert, 1)) == NULL
+            || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+            goto err;
+    }
+
+    return sc;
+ err:
+    ESS_SIGNING_CERT_free(sc);
+    ESS_CERT_ID_free(cid);
+    ESSerr(ESS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
+{
+    ESS_CERT_ID *cid = NULL;
+    GENERAL_NAME *name = NULL;
+    unsigned char cert_sha1[SHA_DIGEST_LENGTH];
+
+    /* Call for side-effect of computing hash and caching extensions */
+    X509_check_purpose(cert, -1, 0);
+    if ((cid = ESS_CERT_ID_new()) == NULL)
+        goto err;
+    X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
+    if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
+        goto err;
+
+    /* Setting the issuer/serial if requested. */
+    if (!issuer_needed)
+        return cid;
+
+    if (cid->issuer_serial == NULL
+        && (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
+        goto err;
+    if ((name = GENERAL_NAME_new()) == NULL)
+        goto err;
+    name->type = GEN_DIRNAME;
+    if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
+        goto err;
+    if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
+        goto err;
+    name = NULL;            /* Ownership is lost. */
+    ASN1_INTEGER_free(cid->issuer_serial->serial);
+    if (!(cid->issuer_serial->serial =
+          ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
+        goto err;
+
+    return cid;
+ err:
+    GENERAL_NAME_free(name);
+    ESS_CERT_ID_free(cid);
+    ESSerr(ESS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new_init(const EVP_MD *hash_alg,
+                                                  X509 *signcert,
+                                                  STACK_OF(X509) *certs,
+                                                  int issuer_needed)
+{
+    ESS_CERT_ID_V2 *cid = NULL;
+    ESS_SIGNING_CERT_V2 *sc;
+    int i;
+
+    if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL)
+        goto err;
+    if ((cid = ESS_CERT_ID_V2_new_init(hash_alg, signcert, issuer_needed)) == NULL)
+        goto err;
+    if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+        goto err;
+    cid = NULL;
+
+    for (i = 0; i < sk_X509_num(certs); ++i) {
+        X509 *cert = sk_X509_value(certs, i);
+
+        if ((cid = ESS_CERT_ID_V2_new_init(hash_alg, cert, 1)) == NULL)
+            goto err;
+        if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+            goto err;
+        cid = NULL;
+    }
+
+    return sc;
+ err:
+    ESS_SIGNING_CERT_V2_free(sc);
+    ESS_CERT_ID_V2_free(cid);
+    ESSerr(ESS_F_ESS_SIGNING_CERT_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
+                                               X509 *cert, int issuer_needed)
+{
+    ESS_CERT_ID_V2 *cid;
+    GENERAL_NAME *name = NULL;
+    unsigned char hash[EVP_MAX_MD_SIZE];
+    unsigned int hash_len = sizeof(hash);
+    X509_ALGOR *alg = NULL;
+
+    memset(hash, 0, sizeof(hash));
+
+    if ((cid = ESS_CERT_ID_V2_new()) == NULL)
+        goto err;
+
+    if (hash_alg != EVP_sha256()) {
+        alg = X509_ALGOR_new();
+        if (alg == NULL)
+            goto err;
+        X509_ALGOR_set_md(alg, hash_alg);
+        if (alg->algorithm == NULL)
+            goto err;
+        cid->hash_alg = alg;
+        alg = NULL;
+    } else {
+        cid->hash_alg = NULL;
+    }
+
+    if (!X509_digest(cert, hash_alg, hash, &hash_len))
+        goto err;
+
+    if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
+        goto err;
+
+    if (!issuer_needed)
+        return cid;
+
+    if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
+        goto err;
+    if ((name = GENERAL_NAME_new()) == NULL)
+        goto err;
+    name->type = GEN_DIRNAME;
+    if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
+        goto err;
+    if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
+        goto err;
+    name = NULL;            /* Ownership is lost. */
+    ASN1_INTEGER_free(cid->issuer_serial->serial);
+    cid->issuer_serial->serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+    if (cid->issuer_serial->serial == NULL)
+        goto err;
+
+    return cid;
+ err:
+    X509_ALGOR_free(alg);
+    GENERAL_NAME_free(name);
+    ESS_CERT_ID_V2_free(cid);
+    ESSerr(ESS_F_ESS_CERT_ID_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_get(PKCS7_SIGNER_INFO *si)
+{
+    ASN1_TYPE *attr;
+    const unsigned char *p;
+    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
+    if (!attr)
+        return NULL;
+    p = attr->value.sequence->data;
+    return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
+}
+
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_get(PKCS7_SIGNER_INFO *si)
+{
+    ASN1_TYPE *attr;
+    const unsigned char *p;
+
+    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
+    if (attr == NULL)
+        return NULL;
+    p = attr->value.sequence->data;
+    return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
+}
+
+int ESS_SIGNING_CERT_add(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp = NULL;
+    int len;
+
+    len = i2d_ESS_SIGNING_CERT(sc, NULL);
+    if ((pp = OPENSSL_malloc(len)) == NULL) {
+        ESSerr(ESS_F_ESS_SIGNING_CERT_ADD, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    p = pp;
+    i2d_ESS_SIGNING_CERT(sc, &p);
+    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
+        ESSerr(ESS_F_ESS_SIGNING_CERT_ADD, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    OPENSSL_free(pp);
+    pp = NULL;
+    return PKCS7_add_signed_attribute(si,
+                                      NID_id_smime_aa_signingCertificate,
+                                      V_ASN1_SEQUENCE, seq);
+ err:
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+
+    return 0;
+}
+
+int ESS_SIGNING_CERT_V2_add(PKCS7_SIGNER_INFO *si,
+                            ESS_SIGNING_CERT_V2 *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp = NULL;
+    int len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
+
+    if ((pp = OPENSSL_malloc(len)) == NULL) {
+        ESSerr(ESS_F_ESS_SIGNING_CERT_V2_ADD, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    p = pp;
+    i2d_ESS_SIGNING_CERT_V2(sc, &p);
+    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
+        ESSerr(ESS_F_ESS_SIGNING_CERT_V2_ADD, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    OPENSSL_free(pp);
+    pp = NULL;
+    return PKCS7_add_signed_attribute(si,
+                                      NID_id_smime_aa_signingCertificateV2,
+                                      V_ASN1_SEQUENCE, seq);
+ err:
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+    return 0;
+}

crypto/include/internal/dso_conf.h.in

@@ -25,6 +25,6 @@
         @macros = ( "DSO_DLFCN" );
     }
     join("\n", map { "# define $_" } @macros); -}
-# define DSO_EXTENSION "{- $target{dso_extension} -}"
+# define DSO_EXTENSION "{- platform->dsoext() -}"
 {- output_on() if $disabled{dso} -}
 #endif

crypto/include/internal/ess_int.h

@@ -0,0 +1,78 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/* internal ESS related stuff */
+
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_get(PKCS7_SIGNER_INFO *si);
+int ESS_SIGNING_CERT_add(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
+
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_get(PKCS7_SIGNER_INFO *si);
+int ESS_SIGNING_CERT_V2_add(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT_V2 *sc);
+
+/*-
+ * IssuerSerial ::= SEQUENCE {
+ *        issuer                  GeneralNames,
+ *        serialNumber            CertificateSerialNumber
+ * }
+ */
+
+struct ESS_issuer_serial {
+    STACK_OF(GENERAL_NAME) *issuer;
+    ASN1_INTEGER *serial;
+};
+
+/*-
+ * ESSCertID ::=  SEQUENCE {
+ *        certHash                Hash,
+ *        issuerSerial            IssuerSerial OPTIONAL
+ * }
+ */
+
+struct ESS_cert_id {
+    ASN1_OCTET_STRING *hash;    /* Always SHA-1 digest. */
+    ESS_ISSUER_SERIAL *issuer_serial;
+};
+
+/*-
+ * SigningCertificate ::=  SEQUENCE {
+ *        certs                   SEQUENCE OF ESSCertID,
+ *        policies                SEQUENCE OF PolicyInformation OPTIONAL
+ * }
+ */
+
+struct ESS_signing_cert {
+    STACK_OF(ESS_CERT_ID) *cert_ids;
+    STACK_OF(POLICYINFO) *policy_info;
+};
+
+/*-
+ * ESSCertIDv2 ::=  SEQUENCE {
+ *        hashAlgorithm           AlgorithmIdentifier DEFAULT id-sha256,
+ *        certHash                Hash,
+ *        issuerSerial            IssuerSerial OPTIONAL
+ * }
+ */
+
+struct ESS_cert_id_v2_st {
+    X509_ALGOR *hash_alg;       /* Default: SHA-256 */
+    ASN1_OCTET_STRING *hash;
+    ESS_ISSUER_SERIAL *issuer_serial;
+};
+
+/*-
+ * SigningCertificateV2 ::= SEQUENCE {
+ *        certs                   SEQUENCE OF ESSCertIDv2,
+ *        policies                SEQUENCE OF PolicyInformation OPTIONAL
+ * }
+ */
+
+struct ESS_signing_cert_v2_st {
+    STACK_OF(ESS_CERT_ID_V2) *cert_ids;
+    STACK_OF(POLICYINFO) *policy_info;
+};

crypto/ppc_arch.h

@@ -22,5 +22,7 @@ extern unsigned int OPENSSL_ppccap_P;
 # define PPC_CRYPTO207   (1<<2)
 # define PPC_FPU         (1<<3)
 # define PPC_MADD300     (1<<4)
+# define PPC_MFTB        (1<<5)
+# define PPC_MFSPR268    (1<<6)
 
 #endif

crypto/ppccap.c

@@ -168,6 +168,45 @@ void OPENSSL_altivec_probe(void);
 void OPENSSL_crypto207_probe(void);
 void OPENSSL_madd300_probe(void);
 
+long OPENSSL_rdtsc_mftb(void);
+long OPENSSL_rdtsc_mfspr268(void);
+
+uint32_t OPENSSL_rdtsc(void)
+{
+    if (OPENSSL_ppccap_P & PPC_MFTB)
+        return OPENSSL_rdtsc_mftb();
+    else if (OPENSSL_ppccap_P & PPC_MFSPR268)
+        return OPENSSL_rdtsc_mfspr268();
+    else
+        return 0;
+}
+
+size_t OPENSSL_instrument_bus_mftb(unsigned int *, size_t);
+size_t OPENSSL_instrument_bus_mfspr268(unsigned int *, size_t);
+
+size_t OPENSSL_instrument_bus(unsigned int *out, size_t cnt)
+{
+    if (OPENSSL_ppccap_P & PPC_MFTB)
+        return OPENSSL_instrument_bus_mftb(out, cnt);
+    else if (OPENSSL_ppccap_P & PPC_MFSPR268)
+        return OPENSSL_instrument_bus_mfspr268(out, cnt);
+    else
+        return 0;
+}
+
+size_t OPENSSL_instrument_bus2_mftb(unsigned int *, size_t, size_t);
+size_t OPENSSL_instrument_bus2_mfspr268(unsigned int *, size_t, size_t);
+
+size_t OPENSSL_instrument_bus2(unsigned int *out, size_t cnt, size_t max)
+{
+    if (OPENSSL_ppccap_P & PPC_MFTB)
+        return OPENSSL_instrument_bus2_mftb(out, cnt, max);
+    else if (OPENSSL_ppccap_P & PPC_MFSPR268)
+        return OPENSSL_instrument_bus2_mfspr268(out, cnt, max);
+    else
+        return 0;
+}
+
 #if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
 # if __GLIBC_PREREQ(2, 16)
 #  include <sys/auxv.h>
@@ -300,8 +339,6 @@ void OPENSSL_cpuid_setup(void)
         if (hwcap & HWCAP_ARCH_3_00) {
             OPENSSL_ppccap_P |= PPC_MADD300;
         }
-
-        return;
     }
 #endif
 
@@ -322,15 +359,16 @@ void OPENSSL_cpuid_setup(void)
     sigprocmask(SIG_SETMASK, &ill_act.sa_mask, &oset);
     sigaction(SIGILL, &ill_act, &ill_oact);
 
+#ifndef OSSL_IMPLEMENT_GETAUXVAL
     if (sigsetjmp(ill_jmp,1) == 0) {
         OPENSSL_fpu_probe();
         OPENSSL_ppccap_P |= PPC_FPU;
 
         if (sizeof(size_t) == 4) {
-#ifdef __linux
+# ifdef __linux
             struct utsname uts;
             if (uname(&uts) == 0 && strcmp(uts.machine, "ppc64") == 0)
-#endif
+# endif
                 if (sigsetjmp(ill_jmp, 1) == 0) {
                     OPENSSL_ppc64_probe();
                     OPENSSL_ppccap_P |= PPC_FPU64;
@@ -355,6 +393,15 @@ void OPENSSL_cpuid_setup(void)
         OPENSSL_madd300_probe();
         OPENSSL_ppccap_P |= PPC_MADD300;
     }
+#endif
+
+    if (sigsetjmp(ill_jmp, 1) == 0) {
+        OPENSSL_rdtsc_mftb();
+        OPENSSL_ppccap_P |= PPC_MFTB;
+    } else if (sigsetjmp(ill_jmp, 1) == 0) {
+        OPENSSL_rdtsc_mfspr268();
+        OPENSSL_ppccap_P |= PPC_MFSPR268;
+    }
 
     sigaction(SIGILL, &ill_oact, NULL);
     sigprocmask(SIG_SETMASK, &oset, NULL);

crypto/ppccpuid.pl

@@ -124,26 +124,23 @@ Ladd:	lwarx	r5,0,r3
 	.long	0
 .size	.OPENSSL_atomic_add,.-.OPENSSL_atomic_add
 
-.globl	.OPENSSL_rdtsc
+.globl	.OPENSSL_rdtsc_mftb
 .align	4
-.OPENSSL_rdtsc:
+.OPENSSL_rdtsc_mftb:
-___
-$code.=<<___	if ($flavour =~ /64/);
 	mftb	r3
-___
-$code.=<<___	if ($flavour !~ /64/);
-Loop_rdtsc:
-	mftbu	r5
-	mftb	r3
-	mftbu	r4
-	cmplw	r4,r5
-	bne	Loop_rdtsc
-___
-$code.=<<___;
 	blr
 	.long	0
 	.byte	0,12,0x14,0,0,0,0,0
-.size	.OPENSSL_rdtsc,.-.OPENSSL_rdtsc
+.size	.OPENSSL_rdtsc_mftb,.-.OPENSSL_rdtsc_mftb
+
+.globl	.OPENSSL_rdtsc_mfspr268
+.align	4
+.OPENSSL_rdtsc_mfspr268:
+	mfspr	r3,268
+	blr
+	.long	0
+	.byte	0,12,0x14,0,0,0,0,0
+.size	.OPENSSL_rdtsc_mfspr268,.-.OPENSSL_rdtsc_mfspr268
 
 .globl	.OPENSSL_cleanse
 .align	4
@@ -210,9 +207,9 @@ my ($tick,$lasttick)=("r6","r7");
 my ($diff,$lastdiff)=("r8","r9");
 
 $code.=<<___;
-.globl	.OPENSSL_instrument_bus
+.globl	.OPENSSL_instrument_bus_mftb
 .align	4
-.OPENSSL_instrument_bus:
+.OPENSSL_instrument_bus_mftb:
 	mtctr	$cnt
 
 	mftb	$lasttick		# collect 1st tick
@@ -240,11 +237,11 @@ Loop:	mftb	$tick
 	.long	0
 	.byte	0,12,0x14,0,0,0,2,0
 	.long	0
-.size	.OPENSSL_instrument_bus,.-.OPENSSL_instrument_bus
+.size	.OPENSSL_instrument_bus_mftb,.-.OPENSSL_instrument_bus_mftb
 
-.globl	.OPENSSL_instrument_bus2
+.globl	.OPENSSL_instrument_bus2_mftb
 .align	4
-.OPENSSL_instrument_bus2:
+.OPENSSL_instrument_bus2_mftb:
 	mr	r0,$cnt
 	slwi	$cnt,$cnt,2
 
@@ -292,7 +289,91 @@ Ldone2:
 	.long	0
 	.byte	0,12,0x14,0,0,0,3,0
 	.long	0
-.size	.OPENSSL_instrument_bus2,.-.OPENSSL_instrument_bus2
+.size	.OPENSSL_instrument_bus2_mftb,.-.OPENSSL_instrument_bus2_mftb
+
+.globl	.OPENSSL_instrument_bus_mfspr268
+.align	4
+.OPENSSL_instrument_bus_mfspr268:
+	mtctr	$cnt
+
+	mfspr	$lasttick,268		# collect 1st tick
+	li	$diff,0
+
+	dcbf	0,$out			# flush cache line
+	lwarx	$tick,0,$out		# load and lock
+	add	$tick,$tick,$diff
+	stwcx.	$tick,0,$out
+	stwx	$tick,0,$out
+
+Loop3:	mfspr	$tick,268
+	sub	$diff,$tick,$lasttick
+	mr	$lasttick,$tick
+	dcbf	0,$out			# flush cache line
+	lwarx	$tick,0,$out		# load and lock
+	add	$tick,$tick,$diff
+	stwcx.	$tick,0,$out
+	stwx	$tick,0,$out
+	addi	$out,$out,4		# ++$out
+	bdnz	Loop3
+
+	mr	r3,$cnt
+	blr
+	.long	0
+	.byte	0,12,0x14,0,0,0,2,0
+	.long	0
+.size	.OPENSSL_instrument_bus_mfspr268,.-.OPENSSL_instrument_bus_mfspr268
+
+.globl	.OPENSSL_instrument_bus2_mfspr268
+.align	4
+.OPENSSL_instrument_bus2_mfspr268:
+	mr	r0,$cnt
+	slwi	$cnt,$cnt,2
+
+	mfspr	$lasttick,268		# collect 1st tick
+	li	$diff,0
+
+	dcbf	0,$out			# flush cache line
+	lwarx	$tick,0,$out		# load and lock
+	add	$tick,$tick,$diff
+	stwcx.	$tick,0,$out
+	stwx	$tick,0,$out
+
+	mfspr	$tick,268		# collect 1st diff
+	sub	$diff,$tick,$lasttick
+	mr	$lasttick,$tick
+	mr	$lastdiff,$diff
+Loop4:
+	dcbf	0,$out			# flush cache line
+	lwarx	$tick,0,$out		# load and lock
+	add	$tick,$tick,$diff
+	stwcx.	$tick,0,$out
+	stwx	$tick,0,$out
+
+	addic.	$max,$max,-1
+	beq	Ldone4
+
+	mfspr	$tick,268
+	sub	$diff,$tick,$lasttick
+	mr	$lasttick,$tick
+	cmplw	7,$diff,$lastdiff
+	mr	$lastdiff,$diff
+
+	mfcr	$tick			# pull cr
+	not	$tick,$tick		# flip bits
+	rlwinm	$tick,$tick,1,29,29	# isolate flipped eq bit and scale
+
+	sub.	$cnt,$cnt,$tick		# conditional --$cnt
+	add	$out,$out,$tick		# conditional ++$out
+	bne	Loop4
+
+Ldone4:
+	srwi	$cnt,$cnt,2
+	sub	r3,r0,$cnt
+	blr
+	.long	0
+	.byte	0,12,0x14,0,0,0,3,0
+	.long	0
+.size	.OPENSSL_instrument_bus2_mfspr268,.-.OPENSSL_instrument_bus2_mfspr268
 ___
 }
 

crypto/rand/rand_unix.c

@@ -93,6 +93,27 @@ static uint64_t get_timer_bits(void);
 # error "UEFI and VXWorks only support seeding NONE"
 #endif
 
+#if defined(OPENSSL_SYS_VXWORKS)
+/* empty implementation */
+int rand_pool_init(void)
+{
+    return 1;
+}
+
+void rand_pool_cleanup(void)
+{
+}
+
+void rand_pool_keep_random_devices_open(int keep)
+{
+}
+
+size_t rand_pool_acquire_entropy(RAND_POOL *pool)
+{
+    return rand_pool_entropy_available(pool);
+}
+#endif
+
 #if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) \
     || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_VXWORKS) \
     || defined(OPENSSL_SYS_UEFI))

crypto/ts/ts_asn1.c

@@ -201,47 +201,6 @@ int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
 }
 #endif
 
-ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
-        ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
-        ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
-} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
-
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
-
-ASN1_SEQUENCE(ESS_CERT_ID) = {
-        ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
-        ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
-} static_ASN1_SEQUENCE_END(ESS_CERT_ID)
-
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
-
-ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
-        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
-        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
-} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
-
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
-
-ASN1_SEQUENCE(ESS_CERT_ID_V2) = {
-        ASN1_OPT(ESS_CERT_ID_V2, hash_alg, X509_ALGOR),
-        ASN1_SIMPLE(ESS_CERT_ID_V2, hash, ASN1_OCTET_STRING),
-        ASN1_OPT(ESS_CERT_ID_V2, issuer_serial, ESS_ISSUER_SERIAL)
-} static_ASN1_SEQUENCE_END(ESS_CERT_ID_V2)
-
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID_V2)
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID_V2)
-
-ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = {
-        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT_V2, cert_ids, ESS_CERT_ID_V2),
-        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT_V2, policy_info, POLICYINFO)
-} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT_V2)
-
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT_V2)
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)
-
 /* Getting encapsulated TS_TST_INFO object from PKCS7. */
 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
 {

crypto/ts/ts_err.c

@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -16,18 +16,6 @@
 static const ERR_STRING_DATA TS_str_functs[] = {
     {ERR_PACK(ERR_LIB_TS, TS_F_DEF_SERIAL_CB, 0), "def_serial_cb"},
     {ERR_PACK(ERR_LIB_TS, TS_F_DEF_TIME_CB, 0), "def_time_cb"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT, 0),
-     "ess_add_signing_cert"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT_V2, 0),
-     "ess_add_signing_cert_v2"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_NEW_INIT, 0),
-     "ess_CERT_ID_new_init"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_V2_NEW_INIT, 0),
-     "ess_cert_id_v2_new_init"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_NEW_INIT, 0),
-     "ess_SIGNING_CERT_new_init"},
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, 0),
-     "ess_signing_cert_v2_new_init"},
     {ERR_PACK(ERR_LIB_TS, TS_F_INT_TS_RESP_VERIFY_TOKEN, 0),
      "int_ts_RESP_verify_token"},
     {ERR_PACK(ERR_LIB_TS, TS_F_PKCS7_TO_TS_TST_INFO, 0),

crypto/ts/ts_lcl.h

@@ -98,67 +98,6 @@ struct TS_status_info_st {
     ASN1_BIT_STRING *failure_info;
 };
 
-/*-
- * IssuerSerial ::= SEQUENCE {
- *         issuer                   GeneralNames,
- *         serialNumber             CertificateSerialNumber
- *         }
- */
-struct ESS_issuer_serial {
-    STACK_OF(GENERAL_NAME) *issuer;
-    ASN1_INTEGER *serial;
-};
-
-/*-
- * ESSCertID ::=  SEQUENCE {
- *         certHash                 Hash,
- *         issuerSerial             IssuerSerial OPTIONAL
- * }
- */
-struct ESS_cert_id {
-    ASN1_OCTET_STRING *hash;    /* Always SHA-1 digest. */
-    ESS_ISSUER_SERIAL *issuer_serial;
-};
-
-/*-
- * SigningCertificate ::=  SEQUENCE {
- *        certs        SEQUENCE OF ESSCertID,
- *        policies     SEQUENCE OF PolicyInformation OPTIONAL
- * }
- */
-struct ESS_signing_cert {
-    STACK_OF(ESS_CERT_ID) *cert_ids;
-    STACK_OF(POLICYINFO) *policy_info;
-};
-
-/*-
- * ESSCertIDv2 ::=  SEQUENCE {
- *        hashAlgorithm           AlgorithmIdentifier
- *                DEFAULT {algorithm id-sha256},
- *        certHash                Hash,
- *        issuerSerial            IssuerSerial OPTIONAL
- * }
- */
-
-struct ESS_cert_id_v2_st {
-    X509_ALGOR *hash_alg;       /* Default: SHA-256 */
-    ASN1_OCTET_STRING *hash;
-    ESS_ISSUER_SERIAL *issuer_serial;
-};
-
-/*-
- * SigningCertificateV2 ::= SEQUENCE {
- *        certs                   SEQUENCE OF ESSCertIDv2,
- *        policies                SEQUENCE OF PolicyInformation OPTIONAL
- * }
- */
-
-struct ESS_signing_cert_v2_st {
-    STACK_OF(ESS_CERT_ID_V2) *cert_ids;
-    STACK_OF(POLICYINFO) *policy_info;
-};
-
-
 struct TS_resp_ctx {
     X509 *signer_cert;
     EVP_PKEY *signer_key;

crypto/ts/ts_rsp_sign.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -15,6 +15,7 @@
 #include <openssl/pkcs7.h>
 #include <openssl/crypto.h>
 #include "ts_lcl.h"
+#include "internal/ess_int.h"
 
 static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
 static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
@@ -29,20 +30,7 @@ static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
 static int ts_RESP_process_extensions(TS_RESP_CTX *ctx);
 static int ts_RESP_sign(TS_RESP_CTX *ctx);
 
-static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
-                                                   STACK_OF(X509) *certs);
-static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed);
 static int ts_TST_INFO_content_new(PKCS7 *p7);
-static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
-
-static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
-                                                         X509 *signcert,
-                                                         STACK_OF(X509)
-                                                         *certs);
-static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
-                                               X509 *cert, int issuer_needed);
-static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
-                                   ESS_SIGNING_CERT_V2 *sc);
 
 static ASN1_GENERALIZEDTIME
 *TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *, long, long,
@@ -681,20 +669,20 @@ static int ts_RESP_sign(TS_RESP_CTX *ctx)
     certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
     if (ctx->ess_cert_id_digest == NULL
         || ctx->ess_cert_id_digest == EVP_sha1()) {
-        if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
+        if ((sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs, 0)) == NULL)
             goto err;
 
-        if (!ess_add_signing_cert(si, sc)) {
+        if (!ESS_SIGNING_CERT_add(si, sc)) {
             TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
             goto err;
         }
     } else {
-        sc2 = ess_signing_cert_v2_new_init(ctx->ess_cert_id_digest,
+        sc2 = ESS_SIGNING_CERT_V2_new_init(ctx->ess_cert_id_digest,
-                                           ctx->signer_cert, certs);
+                                           ctx->signer_cert, certs, 0);
         if (sc2 == NULL)
             goto err;
 
-        if (!ess_add_signing_cert_v2(si, sc2)) {
+        if (!ESS_SIGNING_CERT_V2_add(si, sc2)) {
             TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR);
             goto err;
         }
@@ -731,77 +719,6 @@ static int ts_RESP_sign(TS_RESP_CTX *ctx)
     return ret;
 }
 
-static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
-                                                   STACK_OF(X509) *certs)
-{
-    ESS_CERT_ID *cid;
-    ESS_SIGNING_CERT *sc = NULL;
-    int i;
-
-    if ((sc = ESS_SIGNING_CERT_new()) == NULL)
-        goto err;
-    if (sc->cert_ids == NULL
-        && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
-        goto err;
-
-    if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL
-        || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
-        goto err;
-    for (i = 0; i < sk_X509_num(certs); ++i) {
-        X509 *cert = sk_X509_value(certs, i);
-        if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL
-            || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
-            goto err;
-    }
-
-    return sc;
- err:
-    ESS_SIGNING_CERT_free(sc);
-    TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE);
-    return NULL;
-}
-
-static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed)
-{
-    ESS_CERT_ID *cid = NULL;
-    GENERAL_NAME *name = NULL;
-    unsigned char cert_sha1[SHA_DIGEST_LENGTH];
-
-    /* Call for side-effect of computing hash and caching extensions */
-    X509_check_purpose(cert, -1, 0);
-    if ((cid = ESS_CERT_ID_new()) == NULL)
-        goto err;
-    X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
-    if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
-        goto err;
-
-    /* Setting the issuer/serial if requested. */
-    if (issuer_needed) {
-        if (cid->issuer_serial == NULL
-            && (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
-            goto err;
-        if ((name = GENERAL_NAME_new()) == NULL)
-            goto err;
-        name->type = GEN_DIRNAME;
-        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
-            goto err;
-        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
-            goto err;
-        name = NULL;            /* Ownership is lost. */
-        ASN1_INTEGER_free(cid->issuer_serial->serial);
-        if (!(cid->issuer_serial->serial =
-              ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
-            goto err;
-    }
-
-    return cid;
- err:
-    GENERAL_NAME_free(name);
-    ESS_CERT_ID_free(cid);
-    TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE);
-    return NULL;
-}
-
 static int ts_TST_INFO_content_new(PKCS7 *p7)
 {
     PKCS7 *ret = NULL;
@@ -829,159 +746,6 @@ static int ts_TST_INFO_content_new(PKCS7 *p7)
     return 0;
 }
 
-static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
-{
-    ASN1_STRING *seq = NULL;
-    unsigned char *p, *pp = NULL;
-    int len;
-
-    len = i2d_ESS_SIGNING_CERT(sc, NULL);
-    if ((pp = OPENSSL_malloc(len)) == NULL) {
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-    p = pp;
-    i2d_ESS_SIGNING_CERT(sc, &p);
-    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-    OPENSSL_free(pp);
-    pp = NULL;
-    return PKCS7_add_signed_attribute(si,
-                                      NID_id_smime_aa_signingCertificate,
-                                      V_ASN1_SEQUENCE, seq);
- err:
-    ASN1_STRING_free(seq);
-    OPENSSL_free(pp);
-
-    return 0;
-}
-
-static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
-                                                         X509 *signcert,
-                                                         STACK_OF(X509) *certs)
-{
-    ESS_CERT_ID_V2 *cid = NULL;
-    ESS_SIGNING_CERT_V2 *sc = NULL;
-    int i;
-
-    if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL)
-        goto err;
-    if ((cid = ess_cert_id_v2_new_init(hash_alg, signcert, 0)) == NULL)
-        goto err;
-    if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
-        goto err;
-    cid = NULL;
-
-    for (i = 0; i < sk_X509_num(certs); ++i) {
-        X509 *cert = sk_X509_value(certs, i);
-
-        if ((cid = ess_cert_id_v2_new_init(hash_alg, cert, 1)) == NULL)
-            goto err;
-        if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
-            goto err;
-        cid = NULL;
-    }
-
-    return sc;
- err:
-    ESS_SIGNING_CERT_V2_free(sc);
-    ESS_CERT_ID_V2_free(cid);
-    TSerr(TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
-    return NULL;
-}
-
-static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
-                                               X509 *cert, int issuer_needed)
-{
-    ESS_CERT_ID_V2 *cid = NULL;
-    GENERAL_NAME *name = NULL;
-    unsigned char hash[EVP_MAX_MD_SIZE];
-    unsigned int hash_len = sizeof(hash);
-    X509_ALGOR *alg = NULL;
-
-    memset(hash, 0, sizeof(hash));
-
-    if ((cid = ESS_CERT_ID_V2_new()) == NULL)
-        goto err;
-
-    if (hash_alg != EVP_sha256()) {
-        alg = X509_ALGOR_new();
-        if (alg == NULL)
-            goto err;
-        X509_ALGOR_set_md(alg, hash_alg);
-        if (alg->algorithm == NULL)
-            goto err;
-        cid->hash_alg = alg;
-        alg = NULL;
-    } else {
-        cid->hash_alg = NULL;
-    }
-
-    if (!X509_digest(cert, hash_alg, hash, &hash_len))
-        goto err;
-
-    if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
-        goto err;
-
-    if (issuer_needed) {
-        if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
-            goto err;
-        if ((name = GENERAL_NAME_new()) == NULL)
-            goto err;
-        name->type = GEN_DIRNAME;
-        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
-            goto err;
-        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
-            goto err;
-        name = NULL;            /* Ownership is lost. */
-        ASN1_INTEGER_free(cid->issuer_serial->serial);
-        cid->issuer_serial->serial =
-                ASN1_INTEGER_dup(X509_get_serialNumber(cert));
-        if (cid->issuer_serial->serial == NULL)
-            goto err;
-    }
-
-    return cid;
- err:
-    X509_ALGOR_free(alg);
-    GENERAL_NAME_free(name);
-    ESS_CERT_ID_V2_free(cid);
-    TSerr(TS_F_ESS_CERT_ID_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
-    return NULL;
-}
-
-static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
-                                   ESS_SIGNING_CERT_V2 *sc)
-{
-    ASN1_STRING *seq = NULL;
-    unsigned char *p, *pp = NULL;
-    int len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
-
-    if ((pp = OPENSSL_malloc(len)) == NULL) {
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    p = pp;
-    i2d_ESS_SIGNING_CERT_V2(sc, &p);
-    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    OPENSSL_free(pp);
-    pp = NULL;
-    return PKCS7_add_signed_attribute(si,
-                                      NID_id_smime_aa_signingCertificateV2,
-                                      V_ASN1_SEQUENCE, seq);
- err:
-    ASN1_STRING_free(seq);
-    OPENSSL_free(pp);
-    return 0;
-}
-
 static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
         ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec,
         unsigned precision)

crypto/ts/ts_rsp_verify.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -13,12 +13,12 @@
 #include <openssl/ts.h>
 #include <openssl/pkcs7.h>
 #include "ts_lcl.h"
+#include "internal/ess_int.h"
 
 static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
                           X509 *signer, STACK_OF(X509) **chain);
 static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
                                   STACK_OF(X509) *chain);
-static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si);
 static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
 static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert);
 static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
@@ -38,7 +38,6 @@ static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
 static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names,
                         GENERAL_NAME *name);
 static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert);
-static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si);
 
 /*
  * This must be large enough to hold all values in ts_status_text (with
@@ -201,9 +200,9 @@ end:
 static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
                                   STACK_OF(X509) *chain)
 {
-    ESS_SIGNING_CERT *ss = ess_get_signing_cert(si);
+    ESS_SIGNING_CERT *ss = ESS_SIGNING_CERT_get(si);
     STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
-    ESS_SIGNING_CERT_V2 *ssv2 = ess_get_signing_cert_v2(si);
+    ESS_SIGNING_CERT_V2 *ssv2 = ESS_SIGNING_CERT_V2_get(si);
     STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2 = NULL;
     X509 *cert;
     int i = 0;
@@ -257,29 +256,6 @@ static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
     return ret;
 }
 
-static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
-{
-    ASN1_TYPE *attr;
-    const unsigned char *p;
-    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
-    if (!attr)
-        return NULL;
-    p = attr->value.sequence->data;
-    return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
-}
-
-static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si)
-{
-    ASN1_TYPE *attr;
-    const unsigned char *p;
-
-    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
-    if (attr == NULL)
-        return NULL;
-    p = attr->value.sequence->data;
-    return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
-}
-
 /* Returns < 0 if certificate is not found, certificate index otherwise. */
 static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
 {

crypto/ui/ui_openssl.c

@@ -101,6 +101,12 @@
 
 # endif
 
+# if defined(OPENSSL_SYS_VXWORKS)
+#  undef TERMIOS
+#  undef TERMIO
+#  undef SGTTY
+# endif
+
 # ifdef TERMIOS
 #  include <termios.h>
 #  define TTY_STRUCT             struct termios

doc/man1/cms.pod

@@ -15,6 +15,7 @@ B<openssl> B<cms>
 [B<-verify>]
 [B<-cmsout>]
 [B<-resign>]
+[B<-cades>]
 [B<-data_create>]
 [B<-data_out>]
 [B<-digest_create>]
@@ -158,6 +159,12 @@ Takes an input message and writes out a PEM encoded CMS structure.
 
 Resign a message: take an existing message and one or more new signers.
 
+=item B<-cades>
+
+Add an ESS signing-certificate or ESS signing-certificate-v2 signed-attribute to the SignerInfo, in order to make
+the signature comply with the requirements for a CAdES Basic Electronic Signature (CAdES-BES). See the NOTES
+section for more details.
+
 =item B<-data_create>
 
 Create a CMS B<Data> type.
@@ -553,6 +560,40 @@ The B<-debug_decrypt> option can be used to disable the MMA attack protection
 and return an error if no recipient can be found: this option should be used
 with caution. For a fuller description see L<CMS_decrypt(3)>).
 
+=head1 CAdES Basic Electronic Signature (CAdES-BES)
+
+A CAdES Basic Electronic Signature (CAdES-BES), as defined in the European Standard ETSI EN 319 122-1 V1.1.1, contains:
+
+=over 4
+
+=item *
+
+The signed user data as defined in CMS (RFC 3852);
+
+=item *
+
+Content-type of the EncapsulatedContentInfo value being signed;
+
+=item *
+
+Message-digest of the eContent OCTET STRING within encapContentInfo being signed;
+
+=item *
+
+An ESS signing-certificate or ESS signing-certificate-v2 attribute, as defined in Enhanced Security Services (ESS), RFC 2634 and RFC 5035.
+An ESS signing-certificate attribute only allows for the use of SHA-1 as a digest algorithm.
+An ESS signing-certificate-v2 attribute allows for the use of any digest algorithm.
+
+=item *
+
+The digital signature value computed on the user data and, when present, on the signed attributes.
+
+Note that currently the B<-cades> option applies only to the B<-sign> operation and is ignored during
+the B<-verify> operation, i.e. the signing certification is not checked during the verification process.
+This feature might be added in a future version.
+
+=back
+
 =head1 EXIT CODES
 
 =over 4

doc/man1/ec.pod

@@ -101,10 +101,6 @@ Prints out the public, private key components and parameters.
 
 This option prevents output of the encoded version of the key.
 
-=item B<-modulus>
-
-This option prints out the value of the public key component of the key.
-
 =item B<-pubin>
 
 By default, a private key is read from the input file. With this option a

doc/man1/s_client.pod

@@ -12,6 +12,8 @@ B<openssl> B<s_client>
 [B<-connect host:port>]
 [B<-bind host:port>]
 [B<-proxy host:port>]
+[B<-proxy_user userid>]
+[B<-proxy_pass arg>]
 [B<-unix path>]
 [B<-4>]
 [B<-6>]
@@ -175,6 +177,21 @@ When used with the B<-connect> flag, the program uses the host and port
 specified with this flag and issues an HTTP CONNECT command to connect
 to the desired server.
 
+=item B<-proxy_user userid>
+
+When used with the B<-proxy> flag, the program will attempt to authenticate
+with the specified proxy using basic (base64) authentication.
+NB: Basic authentication is insecure; the credentials are sent to the proxy
+in easily reversible base64 encoding before any TLS/SSL session is established.
+Therefore these credentials are easily recovered by anyone able to sniff/trace
+the network. Use with caution.
+
+=item B<-proxy_pass arg>
+
+The proxy password source, used with the B<-proxy_user> flag.
+For more information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS>
+section in L<openssl(1)>.
+
 =item B<-unix path>
 
 Connect over the specified Unix-domain socket.

doc/man3/ASYNC_WAIT_CTX_new.pod

@@ -4,13 +4,22 @@
 
 ASYNC_WAIT_CTX_new, ASYNC_WAIT_CTX_free, ASYNC_WAIT_CTX_set_wait_fd,
 ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds,
-ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd - functions to manage
+ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd,
-waiting for asynchronous jobs to complete
+ASYNC_WAIT_CTX_set_callback, ASYNC_WAIT_CTX_get_callback,
+ASYNC_WAIT_CTX_set_status, ASYNC_WAIT_CTX_get_status, ASYNC_callback_fn,
+ASYNC_STATUS_UNSUPPORTED, ASYNC_STATUS_ERR, ASYNC_STATUS_OK,
+ASYNC_STATUS_EAGAIN
+- functions to manage waiting for asynchronous jobs to complete
 
 =head1 SYNOPSIS
 
  #include <openssl/async.h>
 
+ #define ASYNC_STATUS_UNSUPPORTED    0
+ #define ASYNC_STATUS_ERR            1
+ #define ASYNC_STATUS_OK             2
+ #define ASYNC_STATUS_EAGAIN         3
+ typedef int (*ASYNC_callback_fn)(void *arg);
  ASYNC_WAIT_CTX *ASYNC_WAIT_CTX_new(void);
  void ASYNC_WAIT_CTX_free(ASYNC_WAIT_CTX *ctx);
  int ASYNC_WAIT_CTX_set_wait_fd(ASYNC_WAIT_CTX *ctx, const void *key,
@@ -26,6 +35,14 @@ waiting for asynchronous jobs to complete
                                     size_t *numaddfds, OSSL_ASYNC_FD *delfd,
                                     size_t *numdelfds);
  int ASYNC_WAIT_CTX_clear_fd(ASYNC_WAIT_CTX *ctx, const void *key);
+ int ASYNC_WAIT_CTX_set_callback(ASYNC_WAIT_CTX *ctx,
+                                 ASYNC_callback_fn callback,
+                                 void *callback_arg);
+ int ASYNC_WAIT_CTX_get_callback(ASYNC_WAIT_CTX *ctx,
+                                 ASYNC_callback_fn *callback,
+                                 void **callback_arg);
+ int ASYNC_WAIT_CTX_set_status(ASYNC_WAIT_CTX *ctx, int status);
+ int ASYNC_WAIT_CTX_get_status(ASYNC_WAIT_CTX *ctx);
 
 
 =head1 DESCRIPTION
@@ -103,14 +120,58 @@ code that the job should be resumed by making the wait file descriptor
 "readable". Once resumed the engine should clear the wake signal on the wait
 file descriptor.
 
+As well as a file descriptor, user code may also be notified via a callback. The
+callback and data pointers are stored within the ASYNC_WAIT_CTX along with an
+additional status field that can be used for the notification of retries from an
+engine. This additional method can be used when the user thinks that a file
+descriptor is too costly in terms of CPU cycles or in some context where a file
+descriptor is not appropriate.
+
+ASYNC_WAIT_CTX_set_callback() sets the callback and the callback argument. The
+callback will be called to notify user code when an engine completes a
+cryptography operation. It is a requirement that the callback function is small
+and non-blocking as it will be run in the context of a polling mechanism or an
+interrupt.
+
+ASYNC_WAIT_CTX_get_callback() returns the callback set in the ASYNC_WAIT_CTX
+structure.
+
+ASYNC_WAIT_CTX_set_status() allows an engine to set the current engine status.
+The possible status values are the following:
+ASYNC_STATUS_UNSUPPORTED: The engine does not support the callback mechanism.
+This is the default value. The engine must call ASYNC_WAIT_CTX_set_status() to
+set the status to some value other than ASYNC_STATUS_UNSUPPORTED if it intends
+to enable the callback mechanism.
+ASYNC_STATUS_ERR: The engine has a fatal problem with this request. The user
+code should clean up this session.
+ASYNC_STATUS_OK: The request has been successfully submitted.
+ASYNC_STATUS_EAGAIN: The engine has some problem which will be recovered soon,
+such as a buffer is full, so user code should resume the job.
+
+ASYNC_WAIT_CTX_get_status() allows user code to obtain the current status value.
+If the status is any value other than ASYNC_STATUS_OK then the user code should
+not expect to receive a callback from the engine even if one has been set.
+
+An example of the usage of the callback method might be the following. User
+code would initiate cryptographic operations, and the engine code would dispatch
+this operation to hardware, and if the dispatch is successful, then the engine
+code would call ASYNC_pause_job() to return control to the user code. After
+that, user code can perform other tasks. When the hardware completes the
+operation, normally it is detected by a polling function or an interrupt, as the
+user code set a callback by calling ASYNC_WAIT_CTX_set_callback() previously,
+then the registered callback will be called.
+
 =head1 RETURN VALUES
 
 ASYNC_WAIT_CTX_new() returns a pointer to the newly allocated ASYNC_WAIT_CTX or
 NULL on error.
 
 ASYNC_WAIT_CTX_set_wait_fd, ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds,
-ASYNC_WAIT_CTX_get_changed_fds and ASYNC_WAIT_CTX_clear_fd all return 1 on
+ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd,
-success or 0 on error.
+ASYNC_WAIT_CTX_set_callback, ASYNC_WAIT_CTX_get_callback and
+ASYNC_WAIT_CTX_set_status all return 1 on success or 0 on error.
+ASYNC_WAIT_CTX_get_status() returs the engine status.
+
 
 =head1 NOTES
 
@@ -132,6 +193,10 @@ ASYNC_WAIT_CTX_get_fd(), ASYNC_WAIT_CTX_get_all_fds(),
 ASYNC_WAIT_CTX_get_changed_fds() and ASYNC_WAIT_CTX_clear_fd()
 were added in OpenSSL 1.1.0.
 
+ASYNC_WAIT_CTX_set_callback(), ASYNC_WAIT_CTX_get_callback(),
+ASYNC_WAIT_CTX_set_status(), and ASYNC_WAIT_CTX_get_status()
+were added in OpenSSL 3.0.0.
+
 =head1 COPYRIGHT
 
 Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.

doc/man3/ASYNC_start_job.pod

@@ -107,22 +107,26 @@ ASYNC_pause_job() is called whilst not within the context of a job then no
 action is taken and ASYNC_pause_job() returns immediately.
 
 ASYNC_get_wait_ctx() can be used to get a pointer to the ASYNC_WAIT_CTX
-for the B<job>. ASYNC_WAIT_CTXs can have a "wait" file descriptor associated
+for the B<job>. ASYNC_WAIT_CTXs contain two different ways to notify
-with them. Applications can wait for the file descriptor to be ready for "read"
+applications that a job is ready to be resumed. One is a "wait" file
-using a system function call such as select or poll (being ready for "read"
+descriptor, and the other is a "callback" mechanism.
-indicates that the job should be resumed). If no file descriptor is made
-available then an application will have to periodically "poll" the job by
-attempting to restart it to see if it is ready to continue.
 
-An example of typical usage might be an async capable engine. User code would
+The "wait" file descriptor associated with ASYNC_WAIT_CTX is used for
-initiate cryptographic operations. The engine would initiate those operations
+applications to wait for the file descriptor to be ready for "read" using a
-asynchronously and then call L<ASYNC_WAIT_CTX_set_wait_fd(3)> followed by
+system function call such as select or poll (being ready for "read" indicates
-ASYNC_pause_job() to return control to the user code. The user code can then
+that the job should be resumed). If no file descriptor is made available then
-perform other tasks or wait for the job to be ready by calling "select" or other
+an application will have to periodically "poll" the job by attempting to restart
-similar function on the wait file descriptor. The engine can signal to the user
+it to see if it is ready to continue.
-code that the job should be resumed by making the wait file descriptor
+
-"readable". Once resumed the engine should clear the wake signal on the wait
+ASYNC_WAIT_CTXs also have a "callback" mechanism to notify applications. The
-file descriptor.
+callback is set by an application, and it will be automatically called when an
+engine completes a cryptography operation, so that the application can resume
+the paused work flow without polling. An engine could be written to look whether
+the callback has been set. If it has then it would use the callback mechanism
+in preference to the file descriptor notifications. If a callback is not set
+then the engine may use file descriptor based notifications. Please note that
+not all engines may support the callback mechanism, so the callback may not be
+used even if it has been set. See ASYNC_WAIT_CTX_new() for more details.
 
 The ASYNC_block_pause() function will prevent the currently active job from
 pausing. The block will remain in place until a subsequent call to

doc/man3/CMS_add1_signing_cert.pod

@@ -0,0 +1,45 @@
+=pod
+
+=head1 NAME
+
+CMS_add1_signing_cert, CMS_add1_signing_cert_v2
+- add ESS signing-certificate signed attribute to a
+CMS_SignerInfo data structure
+
+=head1 SYNOPSIS
+
+ #include <openssl/cms.h>
+
+ int CMS_add1_signing_cert(CMS_SignerInfo *si, ESS_SIGNING_CERT *sc);
+
+ int CMS_add1_signing_cert_v2(CMS_SignerInfo *si, ESS_SIGNING_CERT_V2 *sc2);
+
+=head1 DESCRIPTION
+
+CMS_add1_signing_cert() adds an ESS Signing Certificate B<sc> (version 1) signed
+attribute to the CMS_SignerInfo B<si>.
+CMS_add1_signing_cert_v2() adds an ESS Signing Certificate B<sc2> (version 2) signed
+attribute to the CMS_SignerInfo B<si>.
+The ESS Signing Certificate attributes version 1 and 2 are defined in RFC 5035
+which updates Section 5.4 of RFC 2634.
+
+=head1 NOTES
+
+This attribute is mandatory to make a CMS compliant with CAdES-BES
+(European Standard ETSI EN 319 122-1 V1.1.1).
+For a fuller description see L<cms(1)>).
+
+=head1 RETURN VALUES
+
+CMS_add1_signing_cert() and CMS_add1_signing_cert_v2() return 1 if attribute is added or 0 if an error occurred.
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

doc/man3/CMS_get0_type.pod

@@ -20,7 +20,8 @@ an ASN1_OBJECT pointer. An application can then decide how to process the
 CMS_ContentInfo structure based on this value.
 
 CMS_set1_eContentType() sets the embedded content type of a CMS_ContentInfo
-structure. It should be called with CMS functions with the B<CMS_PARTIAL>
+structure. It should be called with CMS functions (such as L<CMS_sign>, L<CMS_encrypt>)
+with the B<CMS_PARTIAL>
 flag and B<before> the structure is finalised, otherwise the results are
 undefined.
 

doc/man3/EVP_DigestInit.pod

@@ -2,17 +2,17 @@
 
 =head1 NAME
 
-EVP_MD_CTX_new, EVP_MD_CTX_reset, EVP_MD_CTX_free, EVP_MD_CTX_copy_ex,
+EVP_MD_CTX_new, EVP_MD_CTX_reset, EVP_MD_CTX_free, EVP_MD_CTX_copy,
-EVP_MD_CTX_ctrl, EVP_MD_CTX_set_flags, EVP_MD_CTX_clear_flags,
+EVP_MD_CTX_copy_ex, EVP_MD_CTX_ctrl, EVP_MD_CTX_set_flags,
-EVP_MD_CTX_test_flags, EVP_DigestInit_ex, EVP_DigestInit, EVP_DigestUpdate,
+EVP_MD_CTX_clear_flags, EVP_MD_CTX_test_flags,
+EVP_Digest, EVP_DigestInit_ex, EVP_DigestInit, EVP_DigestUpdate,
 EVP_DigestFinal_ex, EVP_DigestFinalXOF, EVP_DigestFinal,
-EVP_MD_CTX_copy, EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size,
+EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size, EVP_MD_block_size, EVP_MD_flags,
-EVP_MD_block_size, EVP_MD_CTX_md, EVP_MD_CTX_size,
+EVP_MD_CTX_md, EVP_MD_CTX_type, EVP_MD_CTX_size, EVP_MD_CTX_block_size,
-EVP_MD_CTX_block_size, EVP_MD_CTX_type, EVP_MD_CTX_md_data,
+EVP_MD_CTX_md_data, EVP_MD_CTX_update_fn, EVP_MD_CTX_set_update_fn,
 EVP_md_null,
-EVP_get_digestbyname, EVP_get_digestbynid,
+EVP_get_digestbyname, EVP_get_digestbynid, EVP_get_digestbyobj,
-EVP_get_digestbyobj,
+EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx - EVP digest routines
-EVP_MD_CTX_set_pkey_ctx - EVP digest routines
 
 =head1 SYNOPSIS
 
@@ -26,6 +26,8 @@ EVP_MD_CTX_set_pkey_ctx - EVP digest routines
  void EVP_MD_CTX_clear_flags(EVP_MD_CTX *ctx, int flags);
  int EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx, int flags);
 
+ int EVP_Digest(const void *data, size_t count, unsigned char *md,
+                unsigned int *size, const EVP_MD *type, ENGINE *impl);
  int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl);
  int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt);
  int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s);
@@ -42,12 +44,18 @@ EVP_MD_CTX_set_pkey_ctx - EVP digest routines
  int EVP_MD_pkey_type(const EVP_MD *md);
  int EVP_MD_size(const EVP_MD *md);
  int EVP_MD_block_size(const EVP_MD *md);
+ unsigned long EVP_MD_flags(const EVP_MD *md);
 
  const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
  int EVP_MD_CTX_size(const EVP_MD *ctx);
  int EVP_MD_CTX_block_size(const EVP_MD *ctx);
  int EVP_MD_CTX_type(const EVP_MD *ctx);
  void *EVP_MD_CTX_md_data(const EVP_MD_CTX *ctx);
+ int (*EVP_MD_CTX_update_fn(EVP_MD_CTX *ctx))(EVP_MD_CTX *ctx,
+                                              const void *data, size_t count);
+ void EVP_MD_CTX_set_update_fn(EVP_MD_CTX *ctx,
+                               int (*update)(EVP_MD_CTX *ctx,
+                                             const void *data, size_t count));
 
  const EVP_MD *EVP_md_null(void);
 
@@ -55,6 +63,7 @@ EVP_MD_CTX_set_pkey_ctx - EVP digest routines
  const EVP_MD *EVP_get_digestbynid(int type);
  const EVP_MD *EVP_get_digestbyobj(const ASN1_OBJECT *o);
 
+ EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx);
  void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx);
 
 =head1 DESCRIPTION
@@ -79,12 +88,24 @@ Cleans up digest context B<ctx> and frees up the space allocated to it.
 
 =item EVP_MD_CTX_ctrl()
 
-Performs digest-specific control actions on context B<ctx>.
+Performs digest-specific control actions on context B<ctx>. The control command
+is indicated in B<cmd> and any additional arguments in B<p1> and B<p2>.
+EVP_MD_CTX_ctrl() must be called after EVP_DigestInit_ex(). Other restrictions
+may apply depending on the control type and digest implementation.
+See L</CONTROLS> below for more information.
 
 =item EVP_MD_CTX_set_flags(), EVP_MD_CTX_clear_flags(), EVP_MD_CTX_test_flags()
 
 Sets, clears and tests B<ctx> flags.  See L</FLAGS> below for more information.
 
+=item EVP_Digest()
+
+A wrapper around the Digest Init_ex, Update and Final_ex functions.
+Hashes B<count> bytes of data at B<data> using a digest B<type> from ENGINE
+B<impl>. The digest value is placed in B<md> and its length is written at B<size>
+if the pointer is not NULL. At most B<EVP_MAX_MD_SIZE> bytes will be written.
+If B<impl> is NULL the default implementation of digest B<type> is used.
+
 =item EVP_DigestInit_ex()
 
 Sets up digest context B<ctx> to use a digest B<type> from ENGINE B<impl>.
@@ -163,6 +184,21 @@ EVP_MD_meth_set_app_datasize().
 
 Returns the B<EVP_MD> structure corresponding to the passed B<EVP_MD_CTX>.
 
+=item EVP_MD_CTX_set_update_fn()
+
+Sets the update function for B<ctx> to B<update>.
+This is the function that is called by EVP_DigestUpdate. If not set, the
+update function from the B<EVP_MD> type specified at initialization is used.
+
+=item EVP_MD_CTX_update_fn()
+
+Returns the update function for B<ctx>.
+
+=item EVP_MD_flags()
+
+Returns the B<md> flags. Note that these are different from the B<EVP_MD_CTX>
+ones. See L<EVP_MD_meth_set_flags(3)> for more information.
+
 =item EVP_MD_pkey_type()
 
 Returns the NID of the public key signing algorithm associated with this
@@ -182,10 +218,15 @@ EVP_get_digestbyobj()
 Returns an B<EVP_MD> structure when passed a digest name, a digest B<NID> or an
 B<ASN1_OBJECT> structure respectively.
 
+=item EVP_MD_CTX_pkey_ctx()
+
+Returns the B<EVP_PKEY_CTX> assigned to B<ctx>. The returned pointer should not
+be freed by the caller.
+
 =item EVP_MD_CTX_set_pkey_ctx()
 
 Assigns an B<EVP_PKEY_CTX> to B<EVP_MD_CTX>. This is usually used to provide
-a customzied B<EVP_PKEY_CTX> to L<EVP_DigestSignInit(3)> or
+a customized B<EVP_PKEY_CTX> to L<EVP_DigestSignInit(3)> or
 L<EVP_DigestVerifyInit(3)>. The B<pctx> passed to this function should be freed
 by the caller. A NULL B<pctx> pointer is also allowed to clear the B<EVP_PKEY_CTX>
 assigned to B<ctx>. In such case, freeing the cleared B<EVP_PKEY_CTX> or not
@@ -193,6 +234,27 @@ depends on how the B<EVP_PKEY_CTX> is created.
 
 =back
 
+=head1 CONTROLS
+
+EVP_MD_CTX_ctrl() can be used to send the following standard controls:
+
+=over 4
+
+=item EVP_MD_CTRL_MICALG
+
+Gets the digest Message Integrity Check algorithm string. This is used when
+creating S/MIME multipart/signed messages, as specified in RFC 3851.
+The string value is written to B<p2>.
+
+=item EVP_MD_CTRL_XOF_LEN
+
+This control sets the digest length for extendable output functions to B<p1>.
+Sending this control directly should not be necessary, the use of
+C<EVP_DigestFinalXOF()> is preferred.
+Currently used by SHAKE.
+
+=back
+
 =head1 FLAGS
 
 EVP_MD_CTX_set_flags(), EVP_MD_CTX_clear_flags() and EVP_MD_CTX_test_flags()
@@ -245,8 +307,7 @@ Returns 1 if successful or 0 for failure.
 Returns 1 if successful or 0 for failure.
 
 =item EVP_MD_type(),
-EVP_MD_pkey_type(),
+EVP_MD_pkey_type()
-EVP_MD_type()
 
 Returns the NID of the corresponding OBJECT IDENTIFIER or NID_undef if none
 exists.
@@ -350,6 +411,7 @@ digest name passed on the command line.
 
 =head1 SEE ALSO
 
+L<EVP_MD_meth_new(3)>,
 L<dgst(1)>,
 L<evp(7)>
 

doc/man3/EVP_MD_meth_new.pod

@@ -84,7 +84,12 @@ together.  The available flags are:
 
 =item EVP_MD_FLAG_ONESHOT
 
-This digest method can only handles one block of input.
+This digest method can only handle one block of input.
+
+=item EVP_MD_FLAG_XOF
+
+This digest method is an extensible-output function (XOF) and supports
+the B<EVP_MD_CTRL_XOF_LEN> control.
 
 =item EVP_MD_FLAG_DIGALGID_NULL
 
@@ -105,19 +110,24 @@ B<EVP_MD_FLAG_DIGALGID_ABSENT> as default.  I<Note: if combined with
 EVP_MD_FLAG_DIGALGID_NULL, the latter will be overridden.>
 Currently unused.
 
+=item EVP_MD_FLAG_FIPS
+
+This digest method is suitable for use in FIPS mode.
+Currently unused.
+
 =back
 
 EVP_MD_meth_set_init() sets the digest init function for B<md>.
-The digest init function is called by EVP_DigestInit(),
+The digest init function is called by EVP_Digest(), EVP_DigestInit(),
 EVP_DigestInit_ex(), EVP_SignInit, EVP_SignInit_ex(), EVP_VerifyInit()
 and EVP_VerifyInit_ex().
 
 EVP_MD_meth_set_update() sets the digest update function for B<md>.
-The digest update function is called by EVP_DigestUpdate(),
+The digest update function is called by EVP_Digest(), EVP_DigestUpdate() and
 EVP_SignUpdate().
 
 EVP_MD_meth_set_final() sets the digest final function for B<md>.
-The digest final function is called by EVP_DigestFinal(),
+The digest final function is called by EVP_Digest(), EVP_DigestFinal(),
 EVP_DigestFinal_ex(), EVP_SignFinal() and EVP_VerifyFinal().
 
 EVP_MD_meth_set_copy() sets the function for B<md> to do extra
@@ -138,6 +148,7 @@ This cleanup function is called by EVP_MD_CTX_reset() and
 EVP_MD_CTX_free().
 
 EVP_MD_meth_set_ctrl() sets the control function for B<md>.
+See L<EVP_MD_CTX_ctrl(3)> for the available controls.
 
 EVP_MD_meth_get_input_blocksize(), EVP_MD_meth_get_result_size(),
 EVP_MD_meth_get_app_datasize(), EVP_MD_meth_get_flags(),
@@ -169,7 +180,7 @@ The B<EVP_MD> structure was openly available in OpenSSL before version
 
 =head1 COPYRIGHT
 
-Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy

doc/man3/SSL_set_async_callback.pod

@@ -0,0 +1,96 @@
+=pod
+
+=head1 NAME
+
+SSL_CTX_set_async_callback,
+SSL_CTX_set_async_callback_arg,
+SSL_set_async_callback,
+SSL_set_async_callback_arg,
+SSL_get_async_status,
+SSL_async_callback_fn
+- manage asynchronous operations
+
+=head1 SYNOPSIS
+
+=for comment multiple includes
+
+ #include <openssl/ssl.h>
+
+ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
+ int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback);
+ int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg);
+ int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback);
+ int SSL_set_async_callback_arg(SSL *s, void *arg);
+ int SSL_get_async_status(SSL *s, int *status);
+
+=head1 DESCRIPTION
+
+SSL_CTX_set_async_callback() sets an asynchronous callback function. All SSL
+objects generated based on this SSL_CTX will get this callback. If an engine
+supports the callback mechanism, it will be automatically called if
+SSL_MODE_ASYNC has been set and an asynchronous capable engine completes a
+cryptography operation to notify the application to resume the paused work flow.
+
+SSL_CTX_set_async_callback_arg() sets the callback argument.
+
+SSL_set_async_callback() allows an application to set a callback in an
+asynchronous SSL object, so that when an engine completes a cryptography
+operation, the callback will be called to notify the application to resume the
+paused work flow.
+
+SSL_set_async_callback_arg() sets an argument for the SSL object when the above
+callback is called.
+
+SSL_get_async_status() returns the engine status. This function facilitates the
+communication from the engine to the application. During an SSL session,
+cryptographic operations are dispatched to an engine. The engine status is very
+useful for an application to know if the operation has been successfully
+dispatched. If the engine does not support this additional callback method,
+"ASYNC_STATUS_UNSUPPORTED" will be returned. See ASYNC_WAIT_CTX_set_status() for
+a description of all of the status values.
+
+An example of the above functions would be the following.
+1. Application sets the async callback and callback data on an SSL connection
+by calling SSL_set_async_callback().
+2. Application sets SSL_MODE_ASYNC and makes an asynchronous SSL call
+3. OpenSSL submits the asynchronous request to the engine. If a retry occurs at
+this point then the status within the ASYNC_WAIT_CTX would be set and the async
+callback function would be called (goto Step 7).
+4. The OpenSSL engine pauses the current job and returns, so that the
+application can continue processing other connections.
+5. At a future point in time (probably via a polling mechanism or via an
+interrupt) the engine will become aware that the asynchronous request has
+finished processing.
+6. The engine will call the application's callback passing the callback data as
+a parameter.
+7. The callback function should then run. Note: it is a requirement that the
+callback function is small and non-blocking as it will be run in the context of
+a polling mechanism or an interrupt.
+8. It is the application's responsibility via the callback function to schedule
+recalling the OpenSSL asynchronous function and to continue processing.
+9. The callback function has the option to check the status returned via
+SSL_get_async_status() to determine whether a retry happened instead of the
+request being submitted, allowing different processing if required.
+
+=head1 RETURN VALUES
+
+SSL_CTX_set_async_callback(), SSL_set_async_callback(),
+SSL_CTX_set_async_callback_arg(), SSL_CTX_set_async_callback_arg() and
+SSL_get_async_status() return 1 on success or 0 on error.
+
+=head1 HISTORY
+
+SSL_CTX_set_async_callback(), SSL_CTX_set_async_callback_arg(),
+SSL_set_async_callback(), SSL_set_async_callback_arg() and
+SSL_get_async_status() were first added to OpenSSL 3.0.0.
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the OpenSSL license (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

engines/build.info

@@ -40,7 +40,7 @@ IF[{- !$disabled{"engine"} -}]
       ENDIF
     ENDIF
 
-    ENGINES_NO_INST=ossltest dasync
+    ENGINES{noinst}=ossltest dasync
     SOURCE[dasync]=e_dasync.c
     DEPEND[dasync]=../libcrypto
     INCLUDE[dasync]=../include

engines/e_dasync.c

@@ -403,6 +403,8 @@ static void wait_cleanup(ASYNC_WAIT_CTX *ctx, const void *key,
 static void dummy_pause_job(void) {
     ASYNC_JOB *job;
     ASYNC_WAIT_CTX *waitctx;
+    ASYNC_callback_fn callback;
+    void * callback_arg;
     OSSL_ASYNC_FD pipefds[2] = {0, 0};
     OSSL_ASYNC_FD *writefd;
 #if defined(ASYNC_WIN)
@@ -417,6 +419,18 @@ static void dummy_pause_job(void) {
 
     waitctx = ASYNC_get_wait_ctx(job);
 
+    if (ASYNC_WAIT_CTX_get_callback(waitctx, &callback, &callback_arg) && callback != NULL) {
+        /*
+         * In the Dummy async engine we are cheating. We call the callback that the job
+         * is complete before the call to ASYNC_pause_job(). A real
+         * async engine would only call the callback when the job was actually complete
+         */
+        (*callback)(callback_arg);
+        ASYNC_pause_job();
+        return;
+    }
+
+
     if (ASYNC_WAIT_CTX_get_fd(waitctx, engine_dasync_id, &pipefds[0],
                               (void **)&writefd)) {
         pipefds[1] = *writefd;

fuzz/build.info

@@ -9,14 +9,14 @@
 -}
 
 IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
-  PROGRAMS_NO_INST=asn1 asn1parse bignum bndiv client conf crl server x509
+  PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server x509
 
   IF[{- !$disabled{"cms"} -}]
-    PROGRAMS_NO_INST=cms
+    PROGRAMS{noinst}=cms
   ENDIF
 
   IF[{- !$disabled{"ct"} -}]
-    PROGRAMS_NO_INST=ct
+    PROGRAMS{noinst}=ct
   ENDIF
 
   SOURCE[asn1]=asn1.c driver.c
@@ -65,14 +65,14 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
 ENDIF
 
 IF[{- !$disabled{tests} -}]
-  PROGRAMS_NO_INST=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test x509-test
+  PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test x509-test
 
   IF[{- !$disabled{"cms"} -}]
-    PROGRAMS_NO_INST=cms-test
+    PROGRAMS{noinst}=cms-test
   ENDIF
 
   IF[{- !$disabled{"ct"} -}]
-    PROGRAMS_NO_INST=ct-test
+    PROGRAMS{noinst}=ct-test
   ENDIF
 
   SOURCE[asn1-test]=asn1.c test-corpus.c

include/internal/cryptlib.h

@@ -92,5 +92,7 @@ void *openssl_fopen(const char *filename, const char *mode);
 # endif
 
 uint32_t OPENSSL_rdtsc(void);
+size_t OPENSSL_instrument_bus(unsigned int *, size_t);
+size_t OPENSSL_instrument_bus2(unsigned int *, size_t, size_t);
 
 #endif

include/internal/sockets.h

@@ -72,11 +72,7 @@ struct servent *PASCAL getservbyname(const char *, const char *);
 #  else
 #   include <sys/socket.h>
 #   ifndef NO_SYS_UN_H
-#    ifdef OPENSSL_SYS_VXWORKS
+#    include <sys/un.h>
-#     include <streams/un.h>
-#    else
-#     include <sys/un.h>
-#    endif
 #    ifndef UNIX_PATH_MAX
 #     define UNIX_PATH_MAX sizeof(((struct sockaddr_un *)NULL)->sun_path)
 #    endif

include/openssl/async.h

@@ -31,12 +31,18 @@ extern "C" {
 
 typedef struct async_job_st ASYNC_JOB;
 typedef struct async_wait_ctx_st ASYNC_WAIT_CTX;
+typedef int (*ASYNC_callback_fn)(void *arg);
 
 #define ASYNC_ERR      0
 #define ASYNC_NO_JOBS  1
 #define ASYNC_PAUSE    2
 #define ASYNC_FINISH   3
 
+#define ASYNC_STATUS_UNSUPPORTED    0
+#define ASYNC_STATUS_ERR            1
+#define ASYNC_STATUS_OK             2
+#define ASYNC_STATUS_EAGAIN         3
+
 int ASYNC_init_thread(size_t max_size, size_t init_size);
 void ASYNC_cleanup_thread(void);
 
@@ -52,6 +58,14 @@ int ASYNC_WAIT_CTX_get_fd(ASYNC_WAIT_CTX *ctx, const void *key,
                         OSSL_ASYNC_FD *fd, void **custom_data);
 int ASYNC_WAIT_CTX_get_all_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *fd,
                                size_t *numfds);
+int ASYNC_WAIT_CTX_get_callback(ASYNC_WAIT_CTX *ctx,
+                                ASYNC_callback_fn *callback,
+                                void **callback_arg);
+int ASYNC_WAIT_CTX_set_callback(ASYNC_WAIT_CTX *ctx,
+                                ASYNC_callback_fn callback,
+                                void *callback_arg);
+int ASYNC_WAIT_CTX_set_status(ASYNC_WAIT_CTX *ctx, int status);
+int ASYNC_WAIT_CTX_get_status(ASYNC_WAIT_CTX *ctx);
 int ASYNC_WAIT_CTX_get_changed_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *addfd,
                                    size_t *numaddfds, OSSL_ASYNC_FD *delfd,
                                    size_t *numdelfds);

include/openssl/cms.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -16,6 +16,7 @@
 # include <openssl/x509.h>
 # include <openssl/x509v3.h>
 # include <openssl/cmserr.h>
+# include <openssl/ess.h>
 # ifdef __cplusplus
 extern "C" {
 # endif
@@ -73,6 +74,7 @@ DECLARE_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
 # define CMS_DEBUG_DECRYPT               0x20000
 # define CMS_KEY_PARAM                   0x40000
 # define CMS_ASCIICRLF                   0x80000
+# define CMS_CADES                       0x100000
 
 const ASN1_OBJECT *CMS_get0_type(const CMS_ContentInfo *cms);
 
@@ -283,6 +285,8 @@ int CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si,
                                   const void *bytes, int len);
 void *CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
                                     int lastpos, int type);
+int CMS_add1_signing_cert(CMS_SignerInfo *si, ESS_SIGNING_CERT *sc);
+int CMS_add1_signing_cert_v2(CMS_SignerInfo *si, ESS_SIGNING_CERT_V2 *sc);
 
 # ifdef HEADER_X509V3_H
 

include/openssl/cmserr.h

@@ -31,6 +31,8 @@ int ERR_load_CMS_strings(void);
 #  define CMS_F_CMS_ADD1_RECIPIENT_CERT                    101
 #  define CMS_F_CMS_ADD1_SIGNER                            102
 #  define CMS_F_CMS_ADD1_SIGNINGTIME                       103
+#  define CMS_F_CMS_ADD1_SIGNING_CERT                      181
+#  define CMS_F_CMS_ADD1_SIGNING_CERT_V2                   182
 #  define CMS_F_CMS_COMPRESS                               104
 #  define CMS_F_CMS_COMPRESSEDDATA_CREATE                  105
 #  define CMS_F_CMS_COMPRESSEDDATA_INIT_BIO                106

include/openssl/err.h

@@ -94,6 +94,7 @@ typedef struct err_state_st {
 # define ERR_LIB_ASYNC           51
 # define ERR_LIB_KDF             52
 # define ERR_LIB_SM2             53
+# define ERR_LIB_ESS             54
 
 # define ERR_LIB_USER            128
 
@@ -133,6 +134,7 @@ typedef struct err_state_st {
 # define ASYNCerr(f,r) ERR_PUT_error(ERR_LIB_ASYNC,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
 # define KDFerr(f,r) ERR_PUT_error(ERR_LIB_KDF,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
 # define SM2err(f,r) ERR_PUT_error(ERR_LIB_SM2,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ESSerr(f,r) ERR_PUT_error(ERR_LIB_ESS,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
 
 # define ERR_PACK(l,f,r) ( \
         (((unsigned int)(l) & 0x0FF) << 24L) | \

include/openssl/ess.h

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef HEADER_ESS_H
+# define HEADER_ESS_H
+
+# include <openssl/opensslconf.h>
+
+# ifdef  __cplusplus
+extern "C" {
+# endif
+# include <openssl/safestack.h>
+# include <openssl/x509.h>
+# include <openssl/esserr.h>
+
+typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL;
+typedef struct ESS_cert_id ESS_CERT_ID;
+typedef struct ESS_signing_cert ESS_SIGNING_CERT;
+
+DEFINE_STACK_OF(ESS_CERT_ID)
+
+typedef struct ESS_signing_cert_v2_st ESS_SIGNING_CERT_V2;
+typedef struct ESS_cert_id_v2_st ESS_CERT_ID_V2;
+
+DEFINE_STACK_OF(ESS_CERT_ID_V2)
+
+ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
+void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
+int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **pp);
+ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
+                                         const unsigned char **pp,
+                                         long length);
+ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
+
+ESS_CERT_ID *ESS_CERT_ID_new(void);
+void ESS_CERT_ID_free(ESS_CERT_ID *a);
+int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
+ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
+                             long length);
+ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
+
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
+void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
+int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **pp);
+ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
+                                       const unsigned char **pp, long length);
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+                                            STACK_OF(X509) *certs,
+                                            int issuer_needed);
+
+ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new(void);
+void ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a);
+int i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **pp);
+ESS_CERT_ID_V2 *d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a,
+                                   const unsigned char **pp, long length);
+ESS_CERT_ID_V2 *ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *a);
+
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new(void);
+void ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a);
+int i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, unsigned char **pp);
+ESS_SIGNING_CERT_V2 *d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a,
+                                             const unsigned char **pp,
+                                             long length);
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *a);
+ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new_init(const EVP_MD *hash_alg,
+                                                  X509 *signcert,
+                                                  STACK_OF(X509) *certs,
+                                                  int issuer_needed);
+
+# ifdef  __cplusplus
+}
+# endif
+#endif

include/openssl/esserr.h

@@ -0,0 +1,38 @@
+/*
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef HEADER_ESSERR_H
+# define HEADER_ESSERR_H
+
+# include <openssl/opensslconf.h>
+
+# ifdef  __cplusplus
+extern "C"
+# endif
+int ERR_load_ESS_strings(void);
+
+/*
+ * ESS function codes.
+ */
+# define ESS_F_ESS_CERT_ID_NEW_INIT                       100
+# define ESS_F_ESS_CERT_ID_V2_NEW_INIT                    101
+# define ESS_F_ESS_SIGNING_CERT_ADD                       104
+# define ESS_F_ESS_SIGNING_CERT_NEW_INIT                  102
+# define ESS_F_ESS_SIGNING_CERT_V2_ADD                    105
+# define ESS_F_ESS_SIGNING_CERT_V2_NEW_INIT               103
+
+/*
+ * ESS reason codes.
+ */
+# define ESS_R_ESS_SIGNING_CERTIFICATE_ERROR              102
+# define ESS_R_ESS_SIGNING_CERT_ADD_ERROR                 100
+# define ESS_R_ESS_SIGNING_CERT_V2_ADD_ERROR              101
+
+#endif

include/openssl/lhash.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -210,6 +210,31 @@ DEFINE_LHASH_OF(OPENSSL_CSTRING);
 #  pragma warning (pop)
 # endif
 
+/*
+ * If called without higher optimization (min. -xO3) the Oracle Developer
+ * Studio compiler generates code for the defined (static inline) functions
+ * above.
+ * This would later lead to the linker complaining about missing symbols when
+ * this header file is included but the resulting object is not linked against
+ * the Crypto library (openssl#6912).
+ */
+# ifdef __SUNPRO_C
+#  pragma weak OPENSSL_LH_new
+#  pragma weak OPENSSL_LH_free
+#  pragma weak OPENSSL_LH_insert
+#  pragma weak OPENSSL_LH_delete
+#  pragma weak OPENSSL_LH_retrieve
+#  pragma weak OPENSSL_LH_error
+#  pragma weak OPENSSL_LH_num_items
+#  pragma weak OPENSSL_LH_node_stats_bio
+#  pragma weak OPENSSL_LH_node_usage_stats_bio
+#  pragma weak OPENSSL_LH_stats_bio
+#  pragma weak OPENSSL_LH_get_down_load
+#  pragma weak OPENSSL_LH_set_down_load
+#  pragma weak OPENSSL_LH_doall
+#  pragma weak OPENSSL_LH_doall_arg
+# endif /* __SUNPRO_C */
+
 #ifdef  __cplusplus
 }
 #endif

include/openssl/opensslv.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -126,9 +126,9 @@ const char *OPENSSL_version_build_metadata(void);
 # if !OPENSSL_API_4
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 #  ifdef OPENSSL_VERSION_PRE_RELEASE
-#   define _OPENSSL_VERSION_PRE_RELEASE 0x0
+#   define _OPENSSL_VERSION_PRE_RELEASE 0x0L
 #  else
-#   define _OPENSSL_VERSION_PRE_RELEASE 0xf
+#   define _OPENSSL_VERSION_PRE_RELEASE 0xfL
 #  endif
 #  define OPENSSL_VERSION_NUMBER        \
           ( (OPENSSL_VERSION_MAJOR<<28)  \

include/openssl/safestack.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -166,6 +166,41 @@ DEFINE_SPECIAL_STACK_OF_CONST(OPENSSL_CSTRING, char)
 typedef void *OPENSSL_BLOCK;
 DEFINE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
 
+/*
+ * If called without higher optimization (min. -xO3) the Oracle Developer
+ * Studio compiler generates code for the defined (static inline) functions
+ * above.
+ * This would later lead to the linker complaining about missing symbols when
+ * this header file is included but the resulting object is not linked against
+ * the Crypto library (openssl#6912).
+ */
+# ifdef __SUNPRO_C
+#  pragma weak OPENSSL_sk_num
+#  pragma weak OPENSSL_sk_value
+#  pragma weak OPENSSL_sk_new
+#  pragma weak OPENSSL_sk_new_null
+#  pragma weak OPENSSL_sk_new_reserve
+#  pragma weak OPENSSL_sk_reserve
+#  pragma weak OPENSSL_sk_free
+#  pragma weak OPENSSL_sk_zero
+#  pragma weak OPENSSL_sk_delete
+#  pragma weak OPENSSL_sk_delete_ptr
+#  pragma weak OPENSSL_sk_push
+#  pragma weak OPENSSL_sk_unshift
+#  pragma weak OPENSSL_sk_pop
+#  pragma weak OPENSSL_sk_shift
+#  pragma weak OPENSSL_sk_pop_free
+#  pragma weak OPENSSL_sk_insert
+#  pragma weak OPENSSL_sk_set
+#  pragma weak OPENSSL_sk_find
+#  pragma weak OPENSSL_sk_find_ex
+#  pragma weak OPENSSL_sk_sort
+#  pragma weak OPENSSL_sk_is_sorted
+#  pragma weak OPENSSL_sk_dup
+#  pragma weak OPENSSL_sk_deep_copy
+#  pragma weak OPENSSL_sk_set_cmp_func
+# endif /* __SUNPRO_C */
+
 # ifdef  __cplusplus
 }
 # endif

include/openssl/ssl.h

@@ -294,6 +294,9 @@ typedef int (*SSL_custom_ext_parse_cb_ex)(SSL *s, unsigned int ext_type,
 /* Typedef for verification callback */
 typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx);
 
+/* Typedef for SSL async callback */
+typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
+
 /*
  * Some values are reserved until OpenSSL 1.2.0 because they were previously
  * included in SSL_OP_ALL in a 1.1.x release.
@@ -1816,6 +1819,12 @@ __owur int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds);
 __owur int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd,
                                      size_t *numaddfds, OSSL_ASYNC_FD *delfd,
                                      size_t *numdelfds);
+__owur int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback);
+__owur int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg);
+__owur int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback);
+__owur int SSL_set_async_callback_arg(SSL *s, void *arg);
+__owur int SSL_get_async_status(SSL *s, int *status);
+
 # endif
 __owur int SSL_accept(SSL *ssl);
 __owur int SSL_stateless(SSL *s);

include/openssl/ts.h

@@ -23,6 +23,7 @@
 # include <openssl/dsa.h>
 # include <openssl/dh.h>
 # include <openssl/tserr.h>
+# include <openssl/ess.h>
 # ifdef  __cplusplus
 extern "C" {
 # endif
@@ -55,16 +56,6 @@ typedef struct TS_tst_info_st TS_TST_INFO;
 
 
 typedef struct TS_status_info_st TS_STATUS_INFO;
-typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL;
-typedef struct ESS_cert_id ESS_CERT_ID;
-typedef struct ESS_signing_cert ESS_SIGNING_CERT;
-
-DEFINE_STACK_OF(ESS_CERT_ID)
-
-typedef struct ESS_cert_id_v2_st ESS_CERT_ID_V2;
-typedef struct ESS_signing_cert_v2_st ESS_SIGNING_CERT_V2;
-
-DEFINE_STACK_OF(ESS_CERT_ID_V2)
 
 typedef struct TS_resp_st TS_RESP;
 
@@ -139,43 +130,6 @@ TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
                              long length);
 TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
 
-ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
-void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
-int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **pp);
-ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
-                                         const unsigned char **pp,
-                                         long length);
-ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
-
-ESS_CERT_ID *ESS_CERT_ID_new(void);
-void ESS_CERT_ID_free(ESS_CERT_ID *a);
-int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
-ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
-                             long length);
-ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
-
-ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
-void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
-int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **pp);
-ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
-                                       const unsigned char **pp, long length);
-ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
-
-ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new(void);
-void ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a);
-int i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **pp);
-ESS_CERT_ID_V2 *d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a,
-                                   const unsigned char **pp, long length);
-ESS_CERT_ID_V2 *ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *a);
-
-ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new(void);
-void ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a);
-int i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, unsigned char **pp);
-ESS_SIGNING_CERT_V2 *d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a,
-                                             const unsigned char **pp,
-                                             long length);
-ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *a);
-
 int TS_REQ_set_version(TS_REQ *a, long version);
 long TS_REQ_get_version(const TS_REQ *a);
 

include/openssl/tserr.h

@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -25,12 +25,6 @@ int ERR_load_TS_strings(void);
  */
 #  define TS_F_DEF_SERIAL_CB                               110
 #  define TS_F_DEF_TIME_CB                                 111
-#  define TS_F_ESS_ADD_SIGNING_CERT                        112
-#  define TS_F_ESS_ADD_SIGNING_CERT_V2                     147
-#  define TS_F_ESS_CERT_ID_NEW_INIT                        113
-#  define TS_F_ESS_CERT_ID_V2_NEW_INIT                     156
-#  define TS_F_ESS_SIGNING_CERT_NEW_INIT                   114
-#  define TS_F_ESS_SIGNING_CERT_V2_NEW_INIT                157
 #  define TS_F_INT_TS_RESP_VERIFY_TOKEN                    149
 #  define TS_F_PKCS7_TO_TS_TST_INFO                        148
 #  define TS_F_TS_ACCURACY_SET_MICROS                      115

include/openssl/x509_vfy.h

@@ -366,7 +366,11 @@ X509_STORE_CTX_cleanup_fn X509_STORE_CTX_get_cleanup(X509_STORE_CTX *ctx);
 # define X509_STORE_CTX_set_chain X509_STORE_CTX_set0_untrusted
 # define X509_STORE_CTX_trusted_stack X509_STORE_CTX_set0_trusted_stack
 # define X509_STORE_get_by_subject X509_STORE_CTX_get_by_subject
+# define X509_STORE_get1_certs X509_STORE_CTX_get1_certs
+# define X509_STORE_get1_crls X509_STORE_CTX_get1_crls
+/* the following macro is misspelled; use X509_STORE_get1_certs instead */
 # define X509_STORE_get1_cert X509_STORE_CTX_get1_certs
+/* the following macro is misspelled; use X509_STORE_get1_crls instead */
 # define X509_STORE_get1_crl X509_STORE_CTX_get1_crls
 #endif
 

ssl/record/rec_layer_d1.c

@@ -440,19 +440,6 @@ int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
             && SSL3_RECORD_get_length(rr) != 0)
         s->rlayer.alert_count = 0;
 
-    if (SSL3_RECORD_get_type(rr) != SSL3_RT_HANDSHAKE
-            && SSL3_RECORD_get_type(rr) != SSL3_RT_CHANGE_CIPHER_SPEC
-            && !SSL_in_init(s)
-            && (s->d1->next_timeout.tv_sec != 0
-                || s->d1->next_timeout.tv_usec != 0)) {
-        /*
-         * The timer is still running but we've received something that isn't
-         * handshake data - so the peer must have finished processing our
-         * last handshake flight. Stop the timer.
-         */
-        dtls1_stop_timer(s);
-    }
-
     /* we now have a packet which can be read and processed */
 
     if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,

ssl/ssl_lib.c

@@ -831,6 +831,9 @@ SSL *SSL_new(SSL_CTX *ctx)
     s->psk_find_session_cb = ctx->psk_find_session_cb;
     s->psk_use_session_cb = ctx->psk_use_session_cb;
 
+    s->async_cb = ctx->async_cb;
+    s->async_cb_arg = ctx->async_cb_arg;
+
     s->job = NULL;
 
 #ifndef OPENSSL_NO_CT
@@ -1718,6 +1721,40 @@ int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds,
                                           numdelfds);
 }
 
+int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback)
+{
+    ctx->async_cb = callback;
+    return 1;
+}
+
+int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg)
+{
+    ctx->async_cb_arg = arg;
+    return 1;
+}
+
+int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback)
+{
+    s->async_cb = callback;
+    return 1;
+}
+
+int SSL_set_async_callback_arg(SSL *s, void *arg)
+{
+    s->async_cb_arg = arg;
+    return 1;
+}
+
+int SSL_get_async_status(SSL *s, int *status)
+{
+    ASYNC_WAIT_CTX *ctx = s->waitctx;
+
+    if (ctx == NULL)
+        return 0;
+    *status = ASYNC_WAIT_CTX_get_status(ctx);
+    return 1;
+}
+
 int SSL_accept(SSL *s)
 {
     if (s->handshake_func == NULL) {
@@ -1743,6 +1780,13 @@ long SSL_get_default_timeout(const SSL *s)
     return s->method->get_timeout();
 }
 
+static int ssl_async_wait_ctx_cb(void *arg)
+{
+    SSL *s = (SSL *)arg;
+
+    return s->async_cb(s, s->async_cb_arg);
+}
+
 static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
                                int (*func) (void *))
 {
@@ -1751,6 +1795,10 @@ static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
         s->waitctx = ASYNC_WAIT_CTX_new();
         if (s->waitctx == NULL)
             return -1;
+        if (s->async_cb != NULL
+            && !ASYNC_WAIT_CTX_set_callback
+                 (s->waitctx, ssl_async_wait_ctx_cb, s))
+            return -1;
     }
     switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
                             sizeof(struct ssl_async_args))) {

ssl/ssl_locl.h

@@ -1114,6 +1114,10 @@ struct ssl_ctx_st {
 
     /* Do we advertise Post-handshake auth support? */
     int pha_enabled;
+
+    /* Callback for SSL async handling */
+    SSL_async_callback_fn async_cb;
+    void *async_cb_arg;
 };
 
 struct ssl_st {
@@ -1511,6 +1515,10 @@ struct ssl_st {
     /* Callback to determine if early_data is acceptable or not */
     SSL_allow_early_data_cb_fn allow_early_data_cb;
     void *allow_early_data_cb_data;
+
+    /* Callback for SSL async handling */
+    SSL_async_callback_fn async_cb;
+    void *async_cb_arg;
 };
 
 /*

ssl/statem/statem_lib.c

@@ -1076,15 +1076,6 @@ WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst, int clearbufs, int stop)
             /* N.B. s->ctx may not equal s->session_ctx */
             tsan_counter(&s->ctx->stats.sess_accept_good);
             s->handshake_func = ossl_statem_accept;
-
-            if (SSL_IS_DTLS(s) && !s->hit) {
-                /*
-                 * We are finishing after the client. We start the timer going
-                 * in case there are any retransmits of our final flight
-                 * required.
-                 */
-                dtls1_start_timer(s);
-            }
         } else {
             if (SSL_IS_TLS13(s)) {
                 /*
@@ -1106,15 +1097,6 @@ WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst, int clearbufs, int stop)
 
             s->handshake_func = ossl_statem_connect;
             tsan_counter(&s->session_ctx->stats.sess_connect_good);
-
-            if (SSL_IS_DTLS(s) && s->hit) {
-                /*
-                 * We are finishing after the server. We start the timer going
-                 * in case there are any retransmits of our final flight
-                 * required.
-                 */
-                dtls1_start_timer(s);
-            }
         }
 
         if (SSL_IS_DTLS(s)) {

test/asynctest.c

@@ -123,6 +123,43 @@ static int test_ASYNC_init_thread(void)
     return 1;
 }
 
+static int test_callback(void *arg)
+{
+    printf("callback test pass\n");
+    return 1;
+}
+
+static int test_ASYNC_callback_status(void)
+{
+    ASYNC_WAIT_CTX *waitctx = NULL;
+    int set_arg = 100;
+    ASYNC_callback_fn get_callback;
+    void *get_arg;
+    int set_status = 1;
+
+    if (       !ASYNC_init_thread(1, 0)
+            || (waitctx = ASYNC_WAIT_CTX_new()) == NULL
+            || ASYNC_WAIT_CTX_set_callback(waitctx, test_callback, (void*)&set_arg)
+               != 1
+            || ASYNC_WAIT_CTX_get_callback(waitctx, &get_callback, &get_arg)
+               != 1
+            || test_callback != get_callback
+            || get_arg != (void*)&set_arg
+            || (*get_callback)(get_arg) != 1
+            || ASYNC_WAIT_CTX_set_status(waitctx, set_status) != 1
+            || set_status != ASYNC_WAIT_CTX_get_status(waitctx)) {
+        fprintf(stderr, "test_ASYNC_callback_status() failed\n");
+        ASYNC_WAIT_CTX_free(waitctx);
+        ASYNC_cleanup_thread();
+        return 0;
+    }
+
+    ASYNC_WAIT_CTX_free(waitctx);
+    ASYNC_cleanup_thread();
+    return 1;
+
+}
+
 static int test_ASYNC_start_job(void)
 {
     ASYNC_JOB *job = NULL;
@@ -279,6 +316,7 @@ int main(int argc, char **argv)
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 
         if (       !test_ASYNC_init_thread()
+                || !test_ASYNC_callback_status()
                 || !test_ASYNC_start_job()
                 || !test_ASYNC_get_current_job()
                 || !test_ASYNC_WAIT_CTX_get_all_fds()

test/bio_memleak_test.c

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+#include <stdio.h>
+#include <string.h>
+#include <openssl/buffer.h>
+#include <openssl/bio.h>
+
+#include "testutil.h"
+
+static int test_bio_memleak(void)
+{
+    int ok = 0;
+    BIO *bio;
+    BUF_MEM bufmem;
+    const char *str = "BIO test\n";
+    char buf[100];
+
+    bio = BIO_new(BIO_s_mem());
+    if (bio == NULL)
+        goto finish;
+    bufmem.length = strlen(str) + 1;
+    bufmem.data = (char *) str;
+    bufmem.max = bufmem.length;
+    BIO_set_mem_buf(bio, &bufmem, BIO_NOCLOSE);
+    BIO_set_flags(bio, BIO_FLAGS_MEM_RDONLY);
+
+    if (BIO_read(bio, buf, sizeof(buf)) <= 0)
+	goto finish;
+
+    ok = strcmp(buf, str) == 0;
+
+finish:
+    BIO_free(bio);
+    return ok;
+}
+
+int global_init(void)
+{
+    CRYPTO_set_mem_debug(1);
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+    return 1;
+}
+
+int setup_tests(void)
+{
+    ADD_TEST(test_bio_memleak);
+    return 1;
+}

test/build.info

@@ -9,7 +9,7 @@ SUBDIRS=ossl_shim
      ""
 -}
 IF[{- !$disabled{tests} -}]
-  LIBS_NO_INST=libtestutil.a
+  LIBS{noinst}=libtestutil.a
   SOURCE[libtestutil.a]=testutil/basic_output.c testutil/output_helpers.c \
           testutil/driver.c testutil/tests.c testutil/cb.c testutil/stanza.c \
           testutil/format_output.c testutil/tap_bio.c \
@@ -24,7 +24,7 @@ IF[{- !$disabled{tests} -}]
 INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   ENDRAW[descrip.mms]
 
-  PROGRAMS_NO_INST=\
+  PROGRAMS{noinst}=\
           versions \
           aborttest test_test \
           sanitytest rsa_complex exdatatest bntest \
@@ -42,7 +42,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
           packettest asynctest secmemtest srptest memleaktest stack_test \
           dtlsv1listentest ct_test threadstest afalgtest d2i_test \
           ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
-          bio_callback_test \
+          bio_callback_test bio_memleak_test \
           bioprinttest sslapitest dtlstest sslcorrupttest bio_enc_test \
           pkey_meth_test pkey_meth_kdf_test uitest cipherbytes_test \
           asn1_encode_test asn1_decode_test asn1_string_table_test \
@@ -300,6 +300,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   INCLUDE[bio_callback_test]=../include
   DEPEND[bio_callback_test]=../libcrypto libtestutil.a
 
+  SOURCE[bio_memleak_test]=bio_memleak_test.c
+  INCLUDE[bio_memleak_test]=../include
+  DEPEND[bio_memleak_test]=../libcrypto libtestutil.a
+
   SOURCE[bioprinttest]=bioprinttest.c
   INCLUDE[bioprinttest]=../include
   DEPEND[bioprinttest]=../libcrypto libtestutil.a
@@ -375,27 +379,27 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   DEPEND[servername_test]=../libcrypto ../libssl libtestutil.a
 
   IF[{- !$disabled{cms} -}]
-    PROGRAMS_NO_INST=cmsapitest
+    PROGRAMS{noinst}=cmsapitest
     SOURCE[cmsapitest]=cmsapitest.c
     INCLUDE[cmsapitest]=../include
     DEPEND[cmsapitest]=../libcrypto libtestutil.a
   ENDIF
 
   IF[{- !$disabled{psk} -}]
-    PROGRAMS_NO_INST=dtls_mtu_test
+    PROGRAMS{noinst}=dtls_mtu_test
     SOURCE[dtls_mtu_test]=dtls_mtu_test.c ssltestlib.c
     INCLUDE[dtls_mtu_test]=.. ../include
     DEPEND[dtls_mtu_test]=../libcrypto ../libssl libtestutil.a
   ENDIF
 
   IF[{- !$disabled{shared} -}]
-    PROGRAMS_NO_INST=shlibloadtest
+    PROGRAMS{noinst}=shlibloadtest
     SOURCE[shlibloadtest]=shlibloadtest.c
     INCLUDE[shlibloadtest]=../include ../crypto/include
   ENDIF
 
   IF[{- $disabled{shared} -}]
-    PROGRAMS_NO_INST=cipher_overhead_test
+    PROGRAMS{noinst}=cipher_overhead_test
     SOURCE[cipher_overhead_test]=cipher_overhead_test.c
     INCLUDE[cipher_overhead_test]=.. ../include
     DEPEND[cipher_overhead_test]=../libcrypto ../libssl libtestutil.a
@@ -438,26 +442,26 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   # programs are forcibly linked with the static libraries, where all symbols
   # are always available.
   IF[1]
-    PROGRAMS_NO_INST=asn1_internal_test modes_internal_test x509_internal_test \
+    PROGRAMS{noinst}=asn1_internal_test modes_internal_test x509_internal_test \
                      tls13encryptiontest wpackettest ctype_internal_test \
                      rdrand_sanitytest
     IF[{- !$disabled{poly1305} -}]
-      PROGRAMS_NO_INST=poly1305_internal_test
+      PROGRAMS{noinst}=poly1305_internal_test
     ENDIF
     IF[{- !$disabled{chacha} -}]
-      PROGRAMS_NO_INST=chacha_internal_test
+      PROGRAMS{noinst}=chacha_internal_test
     ENDIF
     IF[{- !$disabled{siphash} -}]
-      PROGRAMS_NO_INST=siphash_internal_test
+      PROGRAMS{noinst}=siphash_internal_test
     ENDIF
     IF[{- !$disabled{sm2} -}]
-      PROGRAMS_NO_INST=sm2_internal_test
+      PROGRAMS{noinst}=sm2_internal_test
     ENDIF
     IF[{- !$disabled{sm4} -}]
-      PROGRAMS_NO_INST=sm4_internal_test
+      PROGRAMS{noinst}=sm4_internal_test
     ENDIF
     IF[{- !$disabled{ec} -}]
-      PROGRAMS_NO_INST=curve448_internal_test
+      PROGRAMS{noinst}=curve448_internal_test
     ENDIF
 
     SOURCE[poly1305_internal_test]=poly1305_internal_test.c
@@ -514,14 +518,14 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   ENDIF
 
   IF[{- !$disabled{mdc2} -}]
-    PROGRAMS_NO_INST=mdc2_internal_test
+    PROGRAMS{noinst}=mdc2_internal_test
   ENDIF
 
   SOURCE[mdc2_internal_test]=mdc2_internal_test.c
   INCLUDE[mdc2_internal_test]=.. ../include
   DEPEND[mdc2_internal_test]=../libcrypto libtestutil.a
 
-  PROGRAMS_NO_INST=asn1_time_test
+  PROGRAMS{noinst}=asn1_time_test
   SOURCE[asn1_time_test]=asn1_time_test.c
   INCLUDE[asn1_time_test]=../include
   DEPEND[asn1_time_test]=../libcrypto libtestutil.a
@@ -530,7 +534,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
   # redefines some internal libssl symbols. This doesn't work in a non-shared
   # build
   IF[{- !$disabled{shared} -}]
-    PROGRAMS_NO_INST=tls13secretstest
+    PROGRAMS{noinst}=tls13secretstest
     SOURCE[tls13secretstest]=tls13secretstest.c
     SOURCE[tls13secretstest]= ../ssl/tls13_enc.c ../ssl/packet.c
     INCLUDE[tls13secretstest]=.. ../include
@@ -574,7 +578,7 @@ ENDIF
        next if grep { lc("$name.h") =~ m/$_/i } @nogo_headers_re;
        $OUT .= <<"_____";
 
-  PROGRAMS_NO_INST=buildtest_$name
+  PROGRAMS{noinst}=buildtest_$name
   GENERATE[buildtest_$name.c]=generate_buildtest.pl $name
   SOURCE[buildtest_$name]=buildtest_$name.c
   INCLUDE[buildtest_$name]=../include

test/dtlstest.c

@@ -87,17 +87,21 @@ static int test_dtls_unprocessed(int testidx)
     /*
      * Inject a dummy record from the next epoch. In test 0, this should never
      * get used because the message sequence number is too big. In test 1 we set
-     * the record sequence number to be way off in the future. This should not
+     * the record sequence number to be way off in the future.
-     * have an impact on the record replay protection because the record should
-     * be dropped before it is marked as arrived
      */
     c_to_s_mempacket = SSL_get_wbio(clientssl1);
     c_to_s_mempacket = BIO_next(c_to_s_mempacket);
     mempacket_test_inject(c_to_s_mempacket, (char *)certstatus,
                           sizeof(certstatus), 1, INJECT_PACKET_IGNORE_REC_SEQ);
 
-    if (!TEST_true(create_ssl_connection(serverssl1, clientssl1,
+    /*
-                                         SSL_ERROR_NONE)))
+     * Create the connection. We use "create_bare_ssl_connection" here so that
+     * we can force the connection to not do "SSL_read" once partly conencted.
+     * We don't want to accidentally read the dummy records we injected because
+     * they will fail to decrypt.
+     */
+    if (!TEST_true(create_bare_ssl_connection(serverssl1, clientssl1,
+                                              SSL_ERROR_NONE, 0)))
         goto end;
 
     if (timer_cb_count == 0) {

test/ossl_shim/build.info

@@ -1,5 +1,5 @@
 IF[{- defined $target{CXX} && !$disabled{"external-tests"} -}]
-  PROGRAMS_NO_INST=ossl_shim
+  PROGRAMS{noinst}=ossl_shim
   SOURCE[ossl_shim]=ossl_shim.cc async_bio.cc packeted_bio.cc test_config.cc
   INCLUDE[ossl_shim]=. include ../../include
   DEPEND[ossl_shim]=../../libssl ../../libcrypto

test/recipes/80-test_cms.t

@@ -219,6 +219,22 @@ my @smime_cms_tests = (
 	"-CAfile", catfile($smdir, "smroot.pem") ]
     ],
 
+    [ "signed content DER format, RSA key, CAdES-BES compatible",
+      [ "-sign", "-cades", "-in", $smcont, "-outform", "DER", "-nodetach",
+        "-certfile", catfile($smdir, "smroot.pem"),
+        "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test.cms" ],
+      [ "-verify", "-in", "test.cms", "-inform", "DER",
+        "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
+    ],
+
+    [ "signed content DER format, RSA key, SHA256 md, CAdES-BES compatible",
+      [ "-sign", "-cades", "-md", "sha256", "-in", $smcont, "-outform",
+        "DER", "-nodetach", "-certfile", catfile($smdir, "smroot.pem"),
+        "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test.cms" ],
+      [ "-verify", "-in", "test.cms", "-inform", "DER",
+        "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
+    ],
+
     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, keyid",
       [ "-encrypt", "-in", $smcont,
 	"-stream", "-out", "test.cms", "-keyid",

test/recipes/90-test_bio_memleak.t

@@ -0,0 +1,12 @@
+#! /usr/bin/env perl
+# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the OpenSSL license (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+
+use OpenSSL::Test::Simple;
+
+simple_test("test_bio_memleak", "bio_memleak_test");

test/recipes/90-test_shlibload.t

@@ -6,7 +6,7 @@
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
 
-use OpenSSL::Test qw/:DEFAULT bldtop_dir bldtop_file/;
+use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir/;
 use OpenSSL::Test::Utils;
 use File::Temp qw(tempfile);
 
@@ -15,21 +15,17 @@ use File::Temp qw(tempfile);
 BEGIN {
     setup("test_shlibload");
 }
+use lib srctop_dir('Configurations');
 use lib bldtop_dir('.');
-use configdata;
+use platform;
 
 plan skip_all => "Test only supported in a shared build" if disabled("shared");
 plan skip_all => "Test is disabled on AIX" if config('target') =~ m|^aix|;
 
 plan tests => 10;
 
-# When libssl and libcrypto are compiled on Linux with "-rpath", but not
+my $libcrypto = platform->sharedlib('libcrypto');
-# "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH,
+my $libssl = platform->sharedlib('libssl');
-# and we end up running with the wrong libraries.  This is resolved by
-# using paths to the shared objects, not just the names.
-
-my $libcrypto = bldtop_file(shlib('libcrypto'));
-my $libssl = bldtop_file(shlib('libssl'));
 
 (my $fh, my $filename) = tempfile();
 ok(run(test(["shlibloadtest", "-crypto_first", $libcrypto, $libssl, $filename])),
@@ -57,17 +53,6 @@ ok(run(test(["shlibloadtest", "-no_atexit", $libcrypto, $libssl, $filename])),
 ok(!check_atexit($fh));
 unlink $filename;
 
-sub shlib {
-    my $lib = shift;
-    $lib = $unified_info{rename}->{$lib}
-        if defined $unified_info{rename}->{$lib};
-    $lib = $unified_info{sharednames}->{$lib}
-        . ($target{shlib_variant} || "")
-        . ($target{shared_extension} || ".so");
-    $lib =~ s|\.\$\(SHLIB_VERSION_NUMBER\)|.$config{shlib_version}|;
-    return $lib;
-}
-
 sub check_atexit {
     my $fh = shift;
     my $data = <$fh>;

test/sslapitest.c

@@ -5593,7 +5593,7 @@ static int test_shutdown(int tst)
 
     if (tst == 3) {
         if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl,
-                                                  SSL_ERROR_NONE))
+                                                  SSL_ERROR_NONE, 1))
                 || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
                 || !TEST_false(SSL_SESSION_is_resumable(sess)))
             goto end;

test/ssltestlib.c

@@ -25,18 +25,28 @@
 # include <fcntl.h>
 #endif
 
-static ossl_inline void ossl_sleep(unsigned int millis) {
+static ossl_inline void ossl_sleep(unsigned int millis)
+{
+# ifdef OPENSSL_SYS_VXWORKS
+    struct timespec ts;
+    ts.tv_sec = (long int) (millis / 1000);
+    ts.tv_nsec = (long int) (millis % 1000) * 1000000ul;
+    nanosleep(&ts, NULL);
+# else
     usleep(millis * 1000);
+# endif
 }
 #elif defined(_WIN32)
 # include <windows.h>
 
-static ossl_inline void ossl_sleep(unsigned int millis) {
+static ossl_inline void ossl_sleep(unsigned int millis)
+{
     Sleep(millis);
 }
 #else
 /* Fallback to a busy wait */
-static ossl_inline void ossl_sleep(unsigned int millis) {
+static ossl_inline void ossl_sleep(unsigned int millis)
+{
     struct timeval start, now;
     unsigned int elapsedms;
 
@@ -835,8 +845,12 @@ int create_ssl_objects(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
 /*
  * Create an SSL connection, but does not ready any post-handshake
  * NewSessionTicket messages.
+ * If |read| is set and we're using DTLS then we will attempt to SSL_read on
+ * the connection once we've completed one half of it, to ensure any retransmits
+ * get triggered.
  */
-int create_bare_ssl_connection(SSL *serverssl, SSL *clientssl, int want)
+int create_bare_ssl_connection(SSL *serverssl, SSL *clientssl, int want,
+                               int read)
 {
     int retc = -1, rets = -1, err, abortctr = 0;
     int clienterr = 0, servererr = 0;
@@ -874,11 +888,24 @@ int create_bare_ssl_connection(SSL *serverssl, SSL *clientssl, int want)
             return 0;
         if (clienterr && servererr)
             return 0;
-        if (isdtls) {
+        if (isdtls && read) {
-            if (rets > 0 && retc <= 0)
+            unsigned char buf[20];
-                DTLSv1_handle_timeout(serverssl);
+
-            if (retc > 0 && rets <= 0)
+            /* Trigger any retransmits that may be appropriate */
-                DTLSv1_handle_timeout(clientssl);
+            if (rets > 0 && retc <= 0) {
+                if (SSL_read(serverssl, buf, sizeof(buf)) > 0) {
+                    /* We don't expect this to succeed! */
+                    TEST_info("Unexpected SSL_read() success!");
+                    return 0;
+                }
+            }
+            if (retc > 0 && rets <= 0) {
+                if (SSL_read(clientssl, buf, sizeof(buf)) > 0) {
+                    /* We don't expect this to succeed! */
+                    TEST_info("Unexpected SSL_read() success!");
+                    return 0;
+                }
+            }
         }
         if (++abortctr == MAXLOOPS) {
             TEST_info("No progress made");
@@ -907,7 +934,7 @@ int create_ssl_connection(SSL *serverssl, SSL *clientssl, int want)
     unsigned char buf;
     size_t readbytes;
 
-    if (!create_bare_ssl_connection(serverssl, clientssl, want))
+    if (!create_bare_ssl_connection(serverssl, clientssl, want, 1))
         return 0;
 
     /*