xref: /onnv-gate/usr/src/common/openssl/README.SUNW (revision 8545:a1b3fd5884fd)
1#
2# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3# Use is subject to license terms.
4#
5
6The version of OpenSSL found in this directory was created by taking the
7stock version of OpenSSL 0.9.8a from www.openssl.org and modifying some of
8the files to conform to Sun standards.
9
10This work is based on previous work done on stock version of OpenSSL 0.9.7d
11shipped with Solaris 10.
12
13===================
14Configure options
15===================
16
17Below are the options and the targets given to the Configure script.
18
19To build shared objects,
20
21    ./Configure \
22	no-ec \
23	no-ecdh \
24	no-ecdsa \
25	no-rc3 \
26	no-rc5 \
27	no-mdc2 \
28	no-idea \
29	no-hw_cswift \
30	no-hw_ncipher \
31	no-hw_atalla \
32	no-hw_nuron \
33	no-hw_ubsec \
34	no-hw_aep \
35	no-hw_sureware \
36	no-hw_4758-cca \
37	no-hw_chil \
38	no-hw_gmp \
39	threads \
40	shared \
41	$TARGET
42
43, where TARGET is one of the three, depending on the target architecture:
44
45    solaris-sparcv8-cc (sparc)
46    solaris64-sparcv9-cc (sparcv9)
47    solaris-x86-cc (i386)
48
49
50For libcrypto.a and libssl.a used by wanboot,
51
52    ./Configure \
53	no-aes \
54	no-cast \
55	no-dso \
56	no-ec \
57	no-ecdh \
58	no-ecdsa \
59	no-mdc2 \
60	no-rc3 \
61	no-rc4 \
62	no-rc5 \
63	no-ripemd \
64	no-idea \
65	no-hw \
66	no-threads \
67	solaris64-sparcv9-cc
68
69
70===============================================
71The files differ from the original distribution
72===============================================
73
74The following files are different from the OpenSSL 0.9.8a release.
75
761. This header file is generated by Configure.  We combined four versions of
77   this file generated by four runs of Configure.
78
79	crypto/opensslconf.h
80
812. Solaris OpenSSL supports PKCS#11 engine.
82   This code may go back to the open-source community in the future.
83
84   The following files were created.
85
86	crypto/engine/hw_pk11_err.h
87	crypto/engine/hw_pk11.c
88	crypto/engine/hw_pk11_err.c
89	crypto/engine/hw_pk11_pub.c
90
91   The following files were modified.
92
93	crypto/engine/engine.h
94
953. These files were modified to load the PKCS#11 engine.
96   Added code is surrounded by "#ifdef SOLARIS_OPENSSL".
97
98	crypto/engine/eng_cnf.c
99	crypto/engine/hw_pk11.c
100
101
1024. We have a special case where OpenSSL is used by the "wanboot" binary
103   program, that is run to boot the wanboot client.
104   The following files are modified for this purpose.  Added code is
105   surrounded by "#ifdef _BOOT".
106
107	crypto/opensslconf.h
108	crypto/err/err_all.c
109	crypto/evp/evp_key.c
110	crypto/rand/rand_unix.c
111	crypto/rand/randfile.c
112	crypto/x509v3/v3_utl.c
113	e_os.h
114
115
1165. The configuration file was modified to ship with Solaris defaults.
117
118	$SRC/cmd/openssl/openssl.cnf
119	(Note: apps/openssl.cnf is unused.)
120
121
1226. Two files were added for a clean ON build even though the majority
123   if OpenSSL code itself is not subject to lint checks (with the exception
124   of crypto/engine/hw_pk11*.[ch] files).
125
126	crypto/llib-lcrypto
127	ssl/llib-lssl
128
1297. OpenSSL version string was modified. Due to the fact that we don't upgrade
130   OpenSSL frequently we are forced to patch the currently shipped version. The
131   problem with this aproach is that normally, every security vulnerability fix
132   triggers a new release of OpenSSL so people can easily check whether their
133   currently installed version is vulnerable or not. That is not possible with a
134   patched older version. So, we decided to put the security bug tags into the
135   version string, like this:
136
137   OpenSSL 0.9.8a 11 Oct 2005 (+ security fixes for: CAN-2005-2969 CVE-2006-3738
138   CVE-2006-4343 CVE-2007-3108 CVE-2007-5135 CVE-2008-5077)
139
140   Note that actually it's all on the same line because we want to avoid
141   problems with Configure scripts that might rely on the fact that the original
142   OpenSSL version string consists of one line only.
143
144   Be aware that the version string is not considered a stable interface and
145   that all security vulnerability reports are available via SunAlert
146   notifications.
147
1488. And, finally, this file was added.
149
150	README.SUNW
151