update changelog to get the right openbsd source tags

The build system incorrectly set include directives in AM_CFLAGS which
causes them to be placed after the configured CPPFLAGS.  Thus, if
a user or packaging system sets CPPFLAGS to a location that has
libressl or openssl headers installed, they will be used instead
of the bundled versions.  This corrects that issue by setting up
the variables correctly.

https://github.com/libressl-portable/portable/issues/150

Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

.gitignore

@@ -45,6 +45,7 @@ Makefile.in
 test-driver
 *.log
 *.trs
+!tests/optionstest.c
 tests/aes_wrap*
 tests/arc4random_fork*
 tests/cipher*
@@ -60,7 +61,6 @@ tests/pbkdf2*
 tests/*.pem
 tests/testssl
 tests/*.txt
-!tests/optionstest.c
 
 # ctags stuff
 TAGS
@@ -70,8 +70,8 @@ autom4te.cache
 # Libtool adds these, at least sometimes
 INSTALL
 /COPYING
-m4/l*
 !m4/check*.m4
+m4/l*
 
 aclocal.m4
 compile
@@ -106,17 +106,16 @@ tls/*.h
 include/pqueue.h
 include/tls.h
 include/openssl/*.h
-include/openssl/*.he
 
-/apps/*.h
-/apps/*.c
-/apps/openssl
-/apps/openssl.cnf
 !/apps/apps_win.c
 !/apps/poll_win.c
 !/apps/certhash_disabled.c
+/apps/*.h
+/apps/*.c
+/apps/*.cnf
+/apps/*.pem
+/apps/openssl
 
-/crypto
 !/crypto/Makefile.am.*
 !/crypto/compat/arc4random.h
 !/crypto/compat/b_win.c
@@ -126,14 +125,15 @@ include/openssl/*.he
 !/crypto/compat/inet_pton.c
 !/crypto/compat/ui_openssl_win.c
 !/crypto/CMakeLists.txt
+/crypto
 
+!/libtls-standalone/compat/Makefile.am
 /libtls-standalone/include/*.h
 /libtls-standalone/src/*.c
 /libtls-standalone/src/*.h
 /libtls-standalone/src
 /libtls-standalone/tests/test
 /libtls-standalone/compat
-!/libtls-standalone/compat/Makefile.am
 /libtls-standalone/VERSION
 /libtls-standalone/m4
 /libtls-standalone/man

CMakeLists.txt

@@ -1,11 +1,27 @@
 cmake_minimum_required (VERSION 2.8)
 include(CheckFunctionExists)
+include(CheckLibraryExists)
 include(CheckIncludeFiles)
 
 project (LibreSSL)
 
 enable_testing()
 
+file(READ ${CMAKE_SOURCE_DIR}/ssl/VERSION SSL_VERSION)
+string(STRIP ${SSL_VERSION} SSL_VERSION)
+string(REPLACE ":" "." SSL_VERSION ${SSL_VERSION})
+string(REGEX REPLACE "\\..*" "" SSL_MAJOR_VERSION ${SSL_VERSION})
+
+file(READ ${CMAKE_SOURCE_DIR}/crypto/VERSION CRYPTO_VERSION)
+string(STRIP ${CRYPTO_VERSION} CRYPTO_VERSION)
+string(REPLACE ":" "." CRYPTO_VERSION ${CRYPTO_VERSION})
+string(REGEX REPLACE "\\..*" "" CRYPTO_MAJOR_VERSION ${CRYPTO_VERSION})
+
+file(READ ${CMAKE_SOURCE_DIR}/tls/VERSION TLS_VERSION)
+string(STRIP ${TLS_VERSION} TLS_VERSION)
+string(REPLACE ":" "." TLS_VERSION ${TLS_VERSION})
+string(REGEX REPLACE "\\..*" "" TLS_MAJOR_VERSION ${TLS_VERSION})
+
 if(CMAKE_SYSTEM_NAME MATCHES "OpenBSD")
 	add_definitions(-DHAVE_ATTRIBUTE__BOUNDED__)
 endif()
@@ -21,6 +37,8 @@ add_definitions(-DLIBRESSL_INTERNAL)
 add_definitions(-DOPENSSL_NO_HW_PADLOCK)
 add_definitions(-DOPENSSL_NO_ASM)
 
+set(CMAKE_POSITION_INDEPENDENT_CODE true)
+
 if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
 	add_definitions(-Wno-pointer-sign)
 endif()
@@ -142,11 +160,23 @@ set(OPENSSL_LIBS ssl crypto)
 if(CMAKE_HOST_WIN32)
 	set(OPENSSL_LIBS ${OPENSSL_LIBS} ws2_32)
 endif()
+if(CMAKE_SYSTEM_NAME MATCHES "Linux")
+	check_library_exists(rt clock_gettime "time.h" HAVE_CLOCK_GETTIME)
+	if (HAVE_CLOCK_GETTIME)
+		set(OPENSSL_LIBS ${OPENSSL_LIBS} rt)
+	endif()
+endif()
+
+if(NOT (CMAKE_SYSTEM_NAME MATCHES "Darwin" OR MSVC))
+	set(BUILD_SHARED true)
+endif()
 
 add_subdirectory(crypto)
 add_subdirectory(ssl)
 add_subdirectory(apps)
 add_subdirectory(tls)
+add_subdirectory(include)
 if(NOT MSVC)
+	add_subdirectory(man)
 	add_subdirectory(tests)
 endif()

ChangeLog

@@ -28,6 +28,68 @@ history is also available from Git.
 
 LibreSSL Portable Release Notes:
 
+2.2.9 - Security fix
+
+	* Correct a problem that prevents the DSA signing algorithm from
+	  running in constant time even if the flag BN_FLG_CONSTTIME is set.
+	  This issue was reported by Cesar Pereida (Aalto University), Billy
+	  Brumley (Tampere University of Technology), and Yuval Yarom (The
+	  University of Adelaide and NICTA). The fix was developed by Cesar
+	  Pereida. See OpenBSD 5.8 errata 17, June 6, 2016
+
+2.2.8 - Reliability fix
+
+	* Fixed an error in libcrypto when parsing some ASN.1 elements > 16k.
+
+2.2.7 - Security Update
+
+	* Fix multiple vulnerabilities in libcrypto relating to ASN.1 and encoding.
+	From OpenSSL.
+
+2.2.6 - Security Update
+
+	* Deprecated the SSL_OP_SINGLE_DH_USE flag.
+
+2.2.5 - Reliability Update
+
+	* Fixes from OpenSSL 1.0.1q
+	 - CVE-2015-3194 - NULL pointer dereference in client side certificate
+	                   validation.
+	 - CVE-2015-3195 - Memory leak in PKCS7 - not reachable from TLS/SSL
+
+	* The following OpenSSL CVEs did not apply to LibreSSL
+	 - CVE-2015-3193 - Carry propagating bug in the x86_64 Montgomery
+	                   squaring procedure.
+	 - CVE-2015-3196 - Double free race condition of the identify hint
+	                   data.
+
+	 See https://marc.info/?l=openbsd-announce&m=144925068504102
+
+2.2.4 - Build and bug fixes
+
+	* Backported build fixes for CMake on Windows, OSX and Linux
+
+	* Fixes for a memory leak and out-of-bounds access in OBJ_obj2txt
+	  reported by Qualys Security.
+	 - CVE-2015-5333 - memory leak in OBJ_obj2txt
+	 - CVE-2015-5334 - 1-byte buffer overflow in OBJ_obj2txt
+
+	 See http://www.openwall.com/lists/oss-security/2015/10/16/1
+
+2.2.3 - Bug fixes, build enhancements
+
+	* LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not
+	  include TLS extensions, resulting in such handshakes being aborted.
+	  This release corrects the handling of such messages. Thanks to
+	  Ligushka from github for reporting the issue.
+
+	* Added install target for cmake builds. Thanks to TheNietsnie from
+	  github.
+
+	* Updated pkgconfig files to correctly report the release version
+	  number, not the individual library ABI version numbers. Thanks to
+	  Jan Engelhardt for reporting the issue.
+
 2.2.2 - More TLS parser rework, bug fixes, expanded portable build support
 
 	* Switched 'openssl dhparam' default from 512 to 2048 bits

Makefile.am.common

@@ -1,2 +1,2 @@
-AM_CFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat
+AM_CFLAGS =
-AM_CPPFLAGS = -DLIBRESSL_INTERNAL
+AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL

OPENBSD_BRANCH

@@ -1 +1 @@
-master
+OPENBSD_5_8

README.md

@@ -13,7 +13,7 @@ LibreSSL is API compatible with OpenSSL 1.0.1, but does not yet include all
 new APIs from OpenSSL 1.0.2 and later. LibreSSL also includes APIs not yet
 present in OpenSSL. The current common API subset is OpenSSL 1.0.1.
 
-LibreSSL it is not ABI compatible with any release of OpenSSL, or necessarily
+LibreSSL is not ABI compatible with any release of OpenSSL, or necessarily
 earlier releases of LibreSSL. You will need to relink your programs to
 LibreSSL in order to use it, just as in moving between major versions of OpenSSL.
 LibreSSL's installed library version numbers are incremented to account for
@@ -62,7 +62,7 @@ If you have checked this source using Git, follow these initial steps to
 prepare the source tree for building:
 
 1. Ensure you have the following packages installed:
-   automake, autoconf, bash, git, libtool, perl, pod2man
+   automake, autoconf, git, libtool, perl, pod2man
 2. Run './autogen.sh' to prepare the source tree for building or
    run './dist.sh' to prepare a tarball.
 

README.windows

@@ -6,9 +6,8 @@ GCC or Clang as the compiler. Contrary to its name, mingw-w64 supports both
 then LibreSSL should integrate very nicely. Old versions of the mingw-w64
 toolchain, such as the one packaged with Ubuntu 12.04, may have trouble
 building LibreSSL. Please try it with a recent toolchain if you encounter
-troubles. If you are building under Cygwin, only builds with the mingw-w64
+troubles. Cygwin provides an easy method of installing the latest mingw-w64
-compiler are supported, though you can easily use Cygwin to drive the build
+cross compilers on Windows.
-process.
 
 To configure and build LibreSSL for a 32-bit system, use the following
 build steps:

VERSION

@@ -1,2 +0,0 @@
-2.2.2
-

apps/CMakeLists.txt

@@ -77,3 +77,5 @@ endif()
 
 add_executable(openssl ${OPENSSL_SRC})
 target_link_libraries(openssl ${OPENSSL_LIBS})
+
+install(TARGETS openssl DESTINATION bin)

crypto/CMakeLists.txt

@@ -638,4 +638,16 @@ if(NOT HAVE_TIMINGSAFE_MEMCMP)
 	set(CRYPTO_SRC ${CRYPTO_SRC} compat/timingsafe_memcmp.c)
 endif()
 
-add_library(crypto ${CRYPTO_SRC})
+if (BUILD_SHARED)
+	add_library(crypto-objects OBJECT ${CRYPTO_SRC})
+	add_library(crypto STATIC $<TARGET_OBJECTS:crypto-objects>)
+	add_library(crypto-shared SHARED $<TARGET_OBJECTS:crypto-objects>)
+	set_target_properties(crypto-shared PROPERTIES OUTPUT_NAME crypto)
+	set_target_properties(crypto-shared PROPERTIES VERSION
+		${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION})
+	install(TARGETS crypto crypto-shared DESTINATION lib)
+else()
+	add_library(crypto STATIC ${CRYPTO_SRC})
+	install(TARGETS crypto DESTINATION lib)
+endif()
+

crypto/Makefile.am

@@ -1,17 +1,22 @@
 include $(top_srcdir)/Makefile.am.common
 
-AM_CFLAGS += -I$(top_srcdir)/crypto/asn1
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1
-AM_CFLAGS += -I$(top_srcdir)/crypto/evp
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp
-AM_CFLAGS += -I$(top_srcdir)/crypto/modes
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes
+AM_CPPFLAGS += -I$(top_srcdir)/crypto
 
 lib_LTLIBRARIES = libcrypto.la
 
 EXTRA_DIST = VERSION
 EXTRA_DIST += CMakeLists.txt
 
+# needed for a CMake target
+EXTRA_DIST += compat/strcasecmp.c
+
 libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined
 libcrypto_la_LIBADD = libcompat.la libcompatnoopt.la
-libcrypto_la_CPPFLAGS = -DLIBRESSL_INTERNAL
+libcrypto_la_CPPFLAGS = $(AM_CPPFLAGS)
+libcrypto_la_CPPFLAGS += -DLIBRESSL_INTERNAL
 libcrypto_la_CPPFLAGS += -DOPENSSL_NO_HW_PADLOCK
 if OPENSSL_NO_ASM
 libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM
@@ -115,6 +120,7 @@ libcrypto_la_SOURCES += mem_dbg.c
 libcrypto_la_SOURCES += o_init.c
 libcrypto_la_SOURCES += o_str.c
 libcrypto_la_SOURCES += o_time.c
+noinst_HEADERS += constant_time_locl.h
 noinst_HEADERS += cryptlib.h
 noinst_HEADERS += md32_common.h
 noinst_HEADERS += o_time.h

dist-win.sh

@@ -22,7 +22,7 @@ for ARCH in X86 X64; do
 
 	echo Building for $HOST
 
-	CC=$HOST-gcc ./configure --host=$HOST
+	CC=$HOST-gcc ./configure --host=$HOST --with-openssldir=c:/libressl/ssl
 	make clean
 	PATH=$PATH:/usr/$HOST/sys-root/mingw/bin \
 	   make -j 4 check

dist.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -e
 
-rm -f man/*.1 man/*.3
+rm -f man/*.1 man/*.3 include/openssl/*.h
 ./autogen.sh
 ./configure
 make distcheck

include/CMakeLists.txt

@@ -0,0 +1,5 @@
+install(DIRECTORY .
+        DESTINATION include
+        PATTERN "CMakeLists.txt" EXCLUDE
+        PATTERN "compat" EXCLUDE
+        PATTERN "Makefile.*" EXCLUDE)

include/Makefile.am

@@ -1,5 +1,7 @@
 include $(top_srcdir)/Makefile.am.common
 
+EXTRA_DIST = CMakeLists.txt
+
 SUBDIRS = openssl
 
 noinst_HEADERS = pqueue.h

include/compat/dirent_msvc.h

@@ -29,15 +29,24 @@
 
 #include <windows.h>
 
+#if _MSC_VER >= 1900
+#include <../ucrt/stdio.h>
+#include <../ucrt/wchar.h>
+#include <../ucrt/string.h>
+#include <../ucrt/stdlib.h>
+#include <../ucrt/sys/types.h>
+#include <../ucrt/errno.h>
+#else
 #include <../include/stdio.h>
-#include <../include/stdarg.h>
 #include <../include/wchar.h>
 #include <../include/string.h>
 #include <../include/stdlib.h>
-#include <../include/malloc.h>
 #include <../include/sys/types.h>
-#include <sys/stat.h>
 #include <../include/errno.h>
+#endif
+
+#include <stdarg.h>
+#include <sys/stat.h>
 
 /* Indicates that d_type field is available in dirent structure */
 #define _DIRENT_HAVE_D_TYPE
@@ -45,11 +54,6 @@
 /* Indicates that d_namlen field is available in dirent structure */
 #define _DIRENT_HAVE_D_NAMLEN
 
-/* Entries missing from MSVC 6.0 */
-#if !defined(FILE_ATTRIBUTE_DEVICE)
-#   define FILE_ATTRIBUTE_DEVICE 0x40
-#endif
-
 /* Maximum length of file name */
 #if !defined(PATH_MAX)
 #   define PATH_MAX MAX_PATH
@@ -62,16 +66,10 @@
 #endif
 
 /* Return the exact length of d_namlen without zero terminator */
-#define _D_EXACT_NAMLEN(p) ((p)->d_namlen)
+#define _D_EXACT_NAMLEN(p)((p)->d_namlen)
 
 /* Return number of bytes needed to store d_namlen */
-#define _D_ALLOC_NAMLEN(p) (PATH_MAX)
+#define _D_ALLOC_NAMLEN(p)(PATH_MAX)
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 
 /* Wide-character version */
 struct _wdirent {
@@ -92,20 +90,10 @@ struct _WDIR {
 };
 typedef struct _WDIR _WDIR;
 
-static _WDIR *_wopendir (const wchar_t *dirname);
+static _WDIR *_wopendir(const wchar_t *dirname);
-static struct _wdirent *_wreaddir (_WDIR *dirp);
+static struct _wdirent *_wreaddir(_WDIR *dirp);
-static int _wclosedir (_WDIR *dirp);
+static int _wclosedir(_WDIR *dirp);
-static void _wrewinddir (_WDIR* dirp);
+static void _wrewinddir(_WDIR* dirp);
-
-
-/* For compatibility with Symbian */
-#define wdirent _wdirent
-#define WDIR _WDIR
-#define wopendir _wopendir
-#define wreaddir _wreaddir
-#define wclosedir _wclosedir
-#define wrewinddir _wrewinddir
-
 
 /* Multi-byte character versions */
 struct dirent {
@@ -123,15 +111,14 @@ struct DIR {
 };
 typedef struct DIR DIR;
 
-static DIR *opendir (const char *dirname);
+static DIR *opendir(const char *dirname);
-static struct dirent *readdir (DIR *dirp);
+static struct dirent *readdir(DIR *dirp);
-static int closedir (DIR *dirp);
+static int closedir(DIR *dirp);
-static void rewinddir (DIR* dirp);
+static void rewinddir(DIR* dirp);
-
 
 /* Internal utility functions */
-static WIN32_FIND_DATAW *dirent_first (_WDIR *dirp);
+static WIN32_FIND_DATAW *dirent_first(_WDIR *dirp);
-static WIN32_FIND_DATAW *dirent_next (_WDIR *dirp);
+static WIN32_FIND_DATAW *dirent_next(_WDIR *dirp);
 
 static int dirent_mbstowcs_s(
 	size_t *pReturnValue,
@@ -147,28 +134,25 @@ static int dirent_wcstombs_s(
 	const wchar_t *wcstr,
 	size_t count);
 
-static void dirent_set_errno (int error);
-
 /*
  * Open directory stream DIRNAME for read and return a pointer to the
  * internal working area that is used to retrieve individual directory
  * entries.
  */
 static _WDIR*
-_wopendir(
+_wopendir(const wchar_t *dirname)
-    const wchar_t *dirname)
 {
 	_WDIR *dirp = NULL;
 	int error;
 
 	/* Must have directory name */
 	if (dirname == NULL  ||  dirname[0] == '\0') {
-        dirent_set_errno (ENOENT);
+		_set_errno(ENOENT);
 		return NULL;
 	}
 
 	/* Allocate new _WDIR structure */
-    dirp = (_WDIR*) malloc (sizeof (struct _WDIR));
+	dirp =(_WDIR*) malloc(sizeof(struct _WDIR));
 	if (dirp != NULL) {
 		DWORD n;
 
@@ -178,10 +162,10 @@ _wopendir(
 		dirp->cached = 0;
 
 		/* Compute the length of full path plus zero terminator */
-        n = GetFullPathNameW (dirname, 0, NULL, NULL);
+		n = GetFullPathNameW(dirname, 0, NULL, NULL);
 
 		/* Allocate room for absolute directory name and search pattern */
-        dirp->patt = (wchar_t*) malloc (sizeof (wchar_t) * n + 16);
+		dirp->patt =(wchar_t*) malloc(sizeof(wchar_t) * n + 16);
 		if (dirp->patt) {
 
 			/*
@@ -189,14 +173,14 @@ _wopendir(
 			 * allows rewinddir() to function correctly even when current
 			 * working directory is changed between opendir() and rewinddir().
 			 */
-            n = GetFullPathNameW (dirname, n, dirp->patt, NULL);
+			n = GetFullPathNameW(dirname, n, dirp->patt, NULL);
 			if (n > 0) {
 				wchar_t *p;
 
 				/* Append search pattern \* to the directory name */
 				p = dirp->patt + n;
 				if (dirp->patt < p) {
-                    switch (p[-1]) {
+					switch(p[-1]) {
 					case '\\':
 					case '/':
 					case ':':
@@ -213,18 +197,18 @@ _wopendir(
 				*p = '\0';
 
 				/* Open directory stream and retrieve the first entry */
-                if (dirent_first (dirp)) {
+				if (dirent_first(dirp)) {
 					/* Directory stream opened successfully */
 					error = 0;
 				} else {
 					/* Cannot retrieve first entry */
 					error = 1;
-                    dirent_set_errno (ENOENT);
+					_set_errno(ENOENT);
 				}
 
 			} else {
 				/* Cannot retrieve full path name */
-                dirent_set_errno (ENOENT);
+				_set_errno(ENOENT);
 				error = 1;
 			}
 
@@ -240,7 +224,7 @@ _wopendir(
 
 	/* Clean up in case of error */
 	if (error  &&  dirp) {
-        _wclosedir (dirp);
+		_wclosedir(dirp);
 		dirp = NULL;
 	}
 
@@ -254,14 +238,13 @@ _wopendir(
  * "." and ".." as well as volume labels, hidden files and system files.
  */
 static struct _wdirent*
-_wreaddir(
+_wreaddir(_WDIR *dirp)
-    _WDIR *dirp)
 {
 	WIN32_FIND_DATAW *datap;
 	struct _wdirent *entp;
 
 	/* Read next directory entry */
-    datap = dirent_next (dirp);
+	datap = dirent_next(dirp);
 	if (datap) {
 		size_t n;
 		DWORD attr;
@@ -275,7 +258,7 @@ _wreaddir(
 		 * to PATH_MAX characters and zero-terminate the buffer.
 		 */
 		n = 0;
-        while (n + 1 < PATH_MAX  &&  datap->cFileName[n] != 0) {
+		while(n + 1 < PATH_MAX  &&  datap->cFileName[n] != 0) {
 			entp->d_name[n] = datap->cFileName[n];
 			n++;
 		}
@@ -296,7 +279,7 @@ _wreaddir(
 
 		/* Reset dummy fields */
 		entp->d_ino = 0;
-        entp->d_reclen = sizeof (struct _wdirent);
+		entp->d_reclen = sizeof(struct _wdirent);
 
 	} else {
 
@@ -314,31 +297,30 @@ _wreaddir(
  * _wreaddir().
  */
 static int
-_wclosedir(
+_wclosedir(_WDIR *dirp)
-    _WDIR *dirp)
 {
 	int ok;
 	if (dirp) {
 
 		/* Release search handle */
 		if (dirp->handle != INVALID_HANDLE_VALUE) {
-            FindClose (dirp->handle);
+			FindClose(dirp->handle);
 			dirp->handle = INVALID_HANDLE_VALUE;
 		}
 
 		/* Release search pattern */
 		if (dirp->patt) {
-            free (dirp->patt);
+			free(dirp->patt);
 			dirp->patt = NULL;
 		}
 
 		/* Release directory structure */
-        free (dirp);
+		free(dirp);
 		ok = /*success*/0;
 
 	} else {
 		/* Invalid directory stream */
-        dirent_set_errno (EBADF);
+		_set_errno(EBADF);
 		ok = /*failure*/-1;
 	}
 	return ok;
@@ -349,29 +331,27 @@ _wclosedir(
  * file name again.
  */
 static void
-_wrewinddir(
+_wrewinddir(_WDIR* dirp)
-    _WDIR* dirp)
 {
 	if (dirp) {
 		/* Release existing search handle */
 		if (dirp->handle != INVALID_HANDLE_VALUE) {
-            FindClose (dirp->handle);
+			FindClose(dirp->handle);
 		}
 
 		/* Open new search handle */
-        dirent_first (dirp);
+		dirent_first(dirp);
 	}
 }
 
-/* Get first directory entry (internal) */
+/* Get first directory entry(internal) */
 static WIN32_FIND_DATAW*
-dirent_first(
+dirent_first(_WDIR *dirp)
-    _WDIR *dirp)
 {
 	WIN32_FIND_DATAW *datap;
 
 	/* Open directory and retrieve the first entry */
-    dirp->handle = FindFirstFileW (dirp->patt, &dirp->data);
+	dirp->handle = FindFirstFileW(dirp->patt, &dirp->data);
 	if (dirp->handle != INVALID_HANDLE_VALUE) {
 
 		/* a directory entry is now waiting in memory */
@@ -388,10 +368,9 @@ dirent_first(
 	return datap;
 }
 
-/* Get next directory entry (internal) */
+/* Get next directory entry(internal) */
 static WIN32_FIND_DATAW*
-dirent_next(
+dirent_next(_WDIR *dirp)
-    _WDIR *dirp)
 {
 	WIN32_FIND_DATAW *p;
 
@@ -405,12 +384,12 @@ dirent_next(
 	} else if (dirp->handle != INVALID_HANDLE_VALUE) {
 
 		/* Get the next directory entry from stream */
-        if (FindNextFileW (dirp->handle, &dirp->data) != FALSE) {
+		if (FindNextFileW(dirp->handle, &dirp->data) != FALSE) {
 			/* Got a file */
 			p = &dirp->data;
 		} else {
 			/* The very last entry has been processed or an error occured */
-            FindClose (dirp->handle);
+			FindClose(dirp->handle);
 			dirp->handle = INVALID_HANDLE_VALUE;
 			p = NULL;
 		}
@@ -429,30 +408,29 @@ dirent_next(
  * Open directory stream using plain old C-string.
  */
 static DIR*
-opendir(
+opendir(const char *dirname)
-    const char *dirname)
 {
 	struct DIR *dirp;
 	int error;
 
 	/* Must have directory name */
 	if (dirname == NULL  ||  dirname[0] == '\0') {
-        dirent_set_errno (ENOENT);
+		_set_errno(ENOENT);
 		return NULL;
 	}
 
 	/* Allocate memory for DIR structure */
-    dirp = (DIR*) malloc (sizeof (struct DIR));
+	dirp =(DIR*) malloc(sizeof(struct DIR));
 	if (dirp) {
 		wchar_t wname[PATH_MAX];
 		size_t n;
 
 		/* Convert directory name to wide-character string */
-        error = dirent_mbstowcs_s (&n, wname, PATH_MAX, dirname, PATH_MAX);
+		error = dirent_mbstowcs_s(&n, wname, PATH_MAX, dirname, PATH_MAX);
 		if (!error) {
 
 			/* Open directory stream using wide-character name */
-            dirp->wdirp = _wopendir (wname);
+			dirp->wdirp = _wopendir(wname);
 			if (dirp->wdirp) {
 				/* Directory stream opened */
 				error = 0;
@@ -478,7 +456,7 @@ opendir(
 
 	/* Clean up in case of error */
 	if (error  &&  dirp) {
-        free (dirp);
+		free(dirp);
 		dirp = NULL;
 	}
 
@@ -492,21 +470,20 @@ opendir(
  * readdir() are represented in the default ANSI code page while any output to
  * console is typically formatted on another code page.  Thus, non-ASCII
  * characters in file names will not usually display correctly on console.  The
- * problem can be fixed in two ways: (1) change the character set of console
+ * problem can be fixed in two ways:(1) change the character set of console
- * to 1252 using chcp utility and use Lucida Console font, or (2) use
+ * to 1252 using chcp utility and use Lucida Console font, or(2) use
  * _cprintf function when writing to console.  The _cprinf() will re-encode
  * ANSI strings to the console code page so many non-ASCII characters will
  * display correcly.
  */
 static struct dirent*
-readdir(
+readdir(DIR *dirp)
-    DIR *dirp)
 {
 	WIN32_FIND_DATAW *datap;
 	struct dirent *entp;
 
 	/* Read next directory entry */
-    datap = dirent_next (dirp->wdirp);
+	datap = dirent_next(dirp->wdirp);
 	if (datap) {
 		size_t n;
 		int error;
@@ -552,7 +529,7 @@ readdir(
 
 			/* Reset dummy fields */
 			entp->d_ino = 0;
-            entp->d_reclen = sizeof (struct dirent);
+			entp->d_reclen = sizeof(struct dirent);
 
 		} else {
 			/*
@@ -582,23 +559,22 @@ readdir(
  * Close directory stream.
  */
 static int
-closedir(
+closedir(DIR *dirp)
-    DIR *dirp)
 {
 	int ok;
 	if (dirp) {
 
 		/* Close wide-character directory stream */
-        ok = _wclosedir (dirp->wdirp);
+		ok = _wclosedir(dirp->wdirp);
 		dirp->wdirp = NULL;
 
 		/* Release multi-byte character version */
-        free (dirp);
+		free(dirp);
 
 	} else {
 
 		/* Invalid directory stream */
-        dirent_set_errno (EBADF);
+		_set_errno(EBADF);
 		ok = /*failure*/-1;
 
 	}
@@ -609,140 +585,27 @@ closedir(
  * Rewind directory stream to beginning.
  */
 static void
-rewinddir(
+rewinddir(DIR* dirp)
-    DIR* dirp)
 {
 	/* Rewind wide-character string directory stream */
-    _wrewinddir (dirp->wdirp);
+	_wrewinddir(dirp->wdirp);
 }
 
 /* Convert multi-byte string to wide character string */
 static int
-dirent_mbstowcs_s(
+dirent_mbstowcs_s(size_t *pReturnValue, wchar_t *wcstr,
-    size_t *pReturnValue,
+	size_t sizeInWords, const char *mbstr, size_t count)
-    wchar_t *wcstr,
-    size_t sizeInWords,
-    const char *mbstr,
-    size_t count)
 {
-    int error;
+	return mbstowcs_s(pReturnValue, wcstr, sizeInWords, mbstr, count);
-
-#if defined(_MSC_VER)  &&  _MSC_VER >= 1400
-
-    /* Microsoft Visual Studio 2005 or later */
-    error = mbstowcs_s (pReturnValue, wcstr, sizeInWords, mbstr, count);
-
-#else
-
-    /* Older Visual Studio or non-Microsoft compiler */
-    size_t n;
-
-    /* Convert to wide-character string (or count characters) */
-    n = mbstowcs (wcstr, mbstr, sizeInWords);
-    if (!wcstr  ||  n < count) {
-
-        /* Zero-terminate output buffer */
-        if (wcstr  &&  sizeInWords) {
-            if (n >= sizeInWords) {
-                n = sizeInWords - 1;
-            }
-            wcstr[n] = 0;
-        }
-
-        /* Length of resuting multi-byte string WITH zero terminator */
-        if (pReturnValue) {
-            *pReturnValue = n + 1;
-        }
-
-        /* Success */
-        error = 0;
-
-    } else {
-
-        /* Could not convert string */
-        error = 1;
-
-    }
-
-#endif
-
-    return error;
 }
 
 /* Convert wide-character string to multi-byte string */
 static int
-dirent_wcstombs_s(
+dirent_wcstombs_s(size_t *pReturnValue, char *mbstr,
-    size_t *pReturnValue,
-    char *mbstr,
 	size_t sizeInBytes, /* max size of mbstr */
-    const wchar_t *wcstr,
+	const wchar_t *wcstr, size_t count)
-    size_t count)
 {
-    int error;
+	return wcstombs_s(pReturnValue, mbstr, sizeInBytes, wcstr, count);
-
-#if defined(_MSC_VER)  &&  _MSC_VER >= 1400
-
-    /* Microsoft Visual Studio 2005 or later */
-    error = wcstombs_s (pReturnValue, mbstr, sizeInBytes, wcstr, count);
-
-#else
-
-    /* Older Visual Studio or non-Microsoft compiler */
-    size_t n;
-
-    /* Convert to multi-byte string (or count the number of bytes needed) */
-    n = wcstombs (mbstr, wcstr, sizeInBytes);
-    if (!mbstr  ||  n < count) {
-
-        /* Zero-terminate output buffer */
-        if (mbstr  &&  sizeInBytes) {
-            if (n >= sizeInBytes) {
-                n = sizeInBytes - 1;
-            }
-            mbstr[n] = '\0';
-        }
-
-        /* Lenght of resulting multi-bytes string WITH zero-terminator */
-        if (pReturnValue) {
-            *pReturnValue = n + 1;
-        }
-
-        /* Success */
-        error = 0;
-
-    } else {
-
-        /* Cannot convert string */
-        error = 1;
-
-    }
-
-#endif
-
-    return error;
 }
 
-/* Set errno variable */
-static void
-dirent_set_errno(
-    int error)
-{
-#if defined(_MSC_VER)  &&  _MSC_VER >= 1400
-
-    /* Microsoft Visual Studio 2005 and later */
-    _set_errno (error);
-
-#else
-
-    /* Non-Microsoft compiler or older Microsoft compiler */
-    errno = error;
-
-#endif
-}
-
-
-#ifdef __cplusplus
-}
-#endif
 #endif /*DIRENT_H*/
-

include/compat/stdio.h

@@ -7,7 +7,13 @@
 #define LIBCRYPTOCOMPAT_STDIO_H
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/stdlib.h>
+#include <../ucrt/corecrt_io.h>
+#include <../ucrt/stdio.h>
+#else
 #include <../include/stdio.h>
+#endif
 #else
 #include_next <stdio.h>
 #endif

include/compat/stdlib.h

@@ -4,7 +4,11 @@
  */
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/stdlib.h>
+#else
 #include <../include/stdlib.h>
+#endif
 #else
 #include_next <stdlib.h>
 #endif

include/compat/string.h

@@ -7,7 +7,11 @@
 #define LIBCRYPTOCOMPAT_STRING_H
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/string.h>
+#else
 #include <../include/string.h>
+#endif
 #else
 #include_next <string.h>
 #endif

include/compat/sys/stat.h

@@ -11,7 +11,11 @@
 #else
 
 #include <windows.h>
+#if _MSC_VER >= 1900
+#include <../ucrt/sys/stat.h>
+#else
 #include <../include/sys/stat.h>
+#endif
 
 /* File type and permission flags for stat() */
 #if !defined(S_IFMT)

include/compat/sys/types.h

@@ -4,7 +4,11 @@
  */
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/sys/types.h>
+#else
 #include <../include/sys/types.h>
+#endif
 #else
 #include_next <sys/types.h>
 #endif

include/compat/time.h

@@ -4,7 +4,11 @@
  */
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/time.h>
+#else
 #include <../include/time.h>
+#endif
 #define gmtime_r(tp, tm) ((gmtime_s((tm), (tp)) == 0) ? (tm) : NULL)
 #else
 #include_next <time.h>

libcrypto.pc.in

@@ -7,7 +7,7 @@ includedir=@includedir@
 
 Name: LibreSSL-libssl
 Description: Secure Sockets Layer and cryptography libraries
-Version: @LIBCRYPTO_VERSION@
+Version: @VERSION@
 Requires:
 Conflicts:
 Libs: -L${libdir} -lcrypto

libssl.pc.in

@@ -7,7 +7,7 @@ includedir=@includedir@
 
 Name: LibreSSL-libssl
 Description: Secure Sockets Layer and cryptography libraries
-Version: @LIBSSL_VERSION@
+Version: @VERSION@
 Requires:
 Requires.private: libcrypto
 Conflicts:

libtls-standalone/include/string.h

@@ -7,7 +7,11 @@
 #define LIBCRYPTOCOMPAT_STRING_H
 
 #ifdef _MSC_VER
+#if _MSC_VER >= 1900
+#include <../ucrt/string.h>
+#else
 #include <../include/string.h>
+#endif
 #else
 #include_next <string.h>
 #endif

libtls.pc.in

@@ -7,7 +7,7 @@ includedir=@includedir@
 
 Name: LibreSSL-libtls
 Description: Secure communications using the TLS socket protocol.
-Version: @LIBTLS_VERSION@
+Version: @VERSION@
 Requires:
 Requires.private: libcrypto libssl
 Conflicts:

man/CMakeLists.txt

@@ -0,0 +1,9 @@
+install(DIRECTORY .
+    DESTINATION share/man/man3
+    FILES_MATCHING PATTERN "*.3"
+    )
+
+install(DIRECTORY .
+    DESTINATION share/man/man1
+    FILES_MATCHING PATTERN "*.1"
+    )

scripts/travis

@@ -4,12 +4,29 @@ set -e
 ./autogen.sh
 
 if [ "x$ARCH" = "xnative" ]; then
+	# test autotools
 	./configure
+	make -j 4 check
+
+	# make distribution
+	make dist
+	tar zxvf libressl-*.tar.gz
+	cd libressl-*
+	mkdir build
+	cd build
+
+	# test cmake and ninja
 	if [ `uname` = "Darwin" ]; then
-		# OS X runs out of resources if we run 'make -j check'
+		cmake ..
-		make check
+		make
 	else
-		make -j distcheck
+		sudo apt-get update
+		sudo apt-get install -y python-software-properties
+		sudo apt-add-repository -y ppa:kalakris/cmake
+		sudo apt-get update
+		sudo apt-get install -y cmake ninja-build
+		cmake -GNinja ..
+		ninja
 	fi
 else
 	CPU=i686

ssl/CMakeLists.txt

@@ -4,9 +4,8 @@ include_directories(
 	../include/compat
 )
 
-add_library(
+set(
-	ssl
+	SSL_SRC
-
 	bio_ssl.c
 	bs_ber.c
 	bs_cbb.c
@@ -51,3 +50,16 @@ add_library(
 	t1_reneg.c
 	t1_srvr.c
 )
+
+if (BUILD_SHARED)
+	add_library(ssl-objects OBJECT ${SSL_SRC})
+	add_library(ssl STATIC $<TARGET_OBJECTS:ssl-objects>)
+	add_library(ssl-shared SHARED $<TARGET_OBJECTS:ssl-objects>)
+	set_target_properties(ssl-shared PROPERTIES OUTPUT_NAME ssl)
+	set_target_properties(ssl-shared PROPERTIES VERSION ${SSL_VERSION}
+		SOVERSION ${SSL_MAJOR_VERSION})
+	install(TARGETS ssl ssl-shared DESTINATION lib)
+else()
+	add_library(ssl STATIC ${SSL_SRC})
+	install(TARGETS ssl DESTINATION lib)
+endif()

tls/CMakeLists.txt

@@ -19,4 +19,16 @@ if(NOT HAVE_STRCASECMP)
 	set(TLS_SRC ${TLS_SRC} strsep.c)
 endif()
 
-add_library(tls ${TLS_SRC})
+if (BUILD_SHARED)
+	add_library(tls-objects OBJECT ${TLS_SRC})
+	add_library(tls STATIC $<TARGET_OBJECTS:tls-objects>)
+	add_library(tls-shared SHARED $<TARGET_OBJECTS:tls-objects>)
+	set_target_properties(tls-shared PROPERTIES OUTPUT_NAME tls)
+	set_target_properties(tls-shared PROPERTIES VERSION ${TLS_VERSION}
+		SOVERSION ${TLS_MAJOR_VERSION})
+	install(TARGETS tls tls-shared DESTINATION lib)
+else()
+	add_library(tls STATIC ${TLS_SRC})
+	install(TARGETS tls DESTINATION lib)
+endif()
+

update.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/sh
 set -e
 
 openbsd_branch=`cat OPENBSD_BRANCH`
@@ -28,17 +28,17 @@ libtls_src=$CWD/openbsd/src/lib/libtls
 openssl_app_src=$CWD/openbsd/src/usr.bin/openssl
 
 # load library versions
-source $libcrypto_src/crypto/shlib_version
+. $libcrypto_src/crypto/shlib_version
 libcrypto_version=$major:$minor:0
 echo "libcrypto version $libcrypto_version"
 echo $libcrypto_version > crypto/VERSION
 
-source $libssl_src/ssl/shlib_version
+. $libssl_src/ssl/shlib_version
 libssl_version=$major:$minor:0
 echo "libssl version $libssl_version"
 echo $libssl_version > ssl/VERSION
 
-source $libtls_src/shlib_version
+. $libtls_src/shlib_version
 libtls_version=$major:$minor:0
 echo "libtls version $libtls_version"
 echo $libtls_version > tls/VERSION
@@ -143,7 +143,7 @@ $CP crypto/compat/ui_openssl_win.c crypto/ui
 asm_src=$libssl_src/src/crypto
 gen_asm_stdout() {
 	perl $asm_src/$2 $1 > $3.tmp
-	[[ $1 == "elf" ]] && cat <<-EOF >> $3.tmp
+	[ $1 = "elf" ] && cat <<-EOF >> $3.tmp
 	#if defined(HAVE_GNU_STACK)
 	.section .note.GNU-stack,"",%progbits
 	#endif
@@ -152,7 +152,7 @@ gen_asm_stdout() {
 }
 gen_asm() {
 	perl $asm_src/$2 $1 $3.tmp
-	[[ $1 == "elf" ]] && cat <<-EOF >> $3.tmp
+	[ $1 = "elf" ] && cat <<-EOF >> $3.tmp
 	#if defined(HAVE_GNU_STACK)
 	.section .note.GNU-stack,"",%progbits
 	#endif
@@ -280,7 +280,8 @@ done
 
 # copy manpages
 echo "copying manpages"
-echo dist_man_MANS= > man/Makefile.am
+echo EXTRA_DIST = CMakeLists.txt > man/Makefile.am
+echo dist_man_MANS = >> man/Makefile.am
 
 $CP $openssl_app_src/openssl.1 man
 echo "dist_man_MANS += openssl.1" >> man/Makefile.am