mirror of
https://github.com/QuasarApp/openssl.git
synced 2025-05-13 01:49:40 +00:00
d333ebaf9c
For all config targets (except VMS, because it has a completely different set of scripts), '/usr/local/ssl' is the default prefix for installation of programs and libraries, as well as the path for OpenSSL run-time configuration. For programs built to run in a Windows environment, this default is unsafe, and the user should set a different prefix. This has been hinted at in some documentation but not all, and the danger of leaving the default as is hasn't been documented at all. This change documents the issue as a caveat lector, and all configuration examples now include an example --prefix. CVE-2019-1552 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9456)
75 lines
2.6 KiB
Plaintext
75 lines
2.6 KiB
Plaintext
|
|
INSTALLATION ON THE WIN64 PLATFORM
|
|
----------------------------------
|
|
|
|
Caveat lector
|
|
-------------
|
|
|
|
As of moment of this writing Win64 support is classified "initial"
|
|
for the following reasons.
|
|
|
|
- No assembler modules are engaged upon initial 0.9.8 release.
|
|
- API might change within 0.9.8 life-span, *but* in a manner which
|
|
doesn't break backward binary compatibility. Or in other words,
|
|
application programs compiled with initial 0.9.8 headers will
|
|
be expected to work with future minor release .DLL without need
|
|
to re-compile, even if future minor release features modified API.
|
|
- Above mentioned API modifications have everything to do with
|
|
elimination of a number of limitations, which are normally
|
|
considered inherent to 32-bit platforms. Which in turn is why they
|
|
are treated as limitations on 64-bit platform such as Win64:-)
|
|
The current list comprises [but not necessarily limited to]:
|
|
|
|
- null-terminated strings may not be longer than 2G-1 bytes,
|
|
longer strings are treated as zero-length;
|
|
- dynamically and *internally* allocated chunks can't be larger
|
|
than 2G-1 bytes;
|
|
- inability to encrypt/decrypt chunks of data larger than 4GB
|
|
[it's possibly to *hash* chunks of arbitrary size through];
|
|
|
|
Neither of these is actually big deal and hardly encountered
|
|
in real-life applications.
|
|
|
|
### Default install and config paths
|
|
|
|
./Configure defaults to '/usr/local/ssl' as installation top. This is
|
|
suitable for Unix, but not for Windows, where this usually is a world
|
|
writable directory and therefore accessible for change by untrusted users.
|
|
It is therefore recommended to set your own --prefix or --openssldir to
|
|
some location that is not world writeable (see the example above)
|
|
|
|
Compiling procedure
|
|
-------------------
|
|
|
|
You will need Perl. You can run under Cygwin or you can download
|
|
ActiveState Perl from http://www.activestate.com/ActivePerl.
|
|
|
|
You will need Microsoft Platform SDK, available for download at
|
|
http://www.microsoft.com/msdownload/platformsdk/sdkupdate/. As per
|
|
April 2005 Platform SDK is equipped with Win64 compilers, as well
|
|
as assemblers, but it might change in the future.
|
|
|
|
To build for Win64/x64:
|
|
|
|
> perl Configure VC-WIN64A --prefix=c:\some\openssl\dir
|
|
> ms\do_win64a
|
|
> nmake -f ms\ntdll.mak
|
|
> cd out32dll
|
|
> ..\ms\test
|
|
|
|
To build for Win64/IA64:
|
|
|
|
> perl Configure VC-WIN64I --prefix=c:\some\openssl\dir
|
|
> ms\do_win64i
|
|
> nmake -f ms\ntdll.mak
|
|
> cd out32dll
|
|
> ..\ms\test
|
|
|
|
Naturally test-suite itself has to be executed on the target platform.
|
|
|
|
Installation
|
|
------------
|
|
|
|
TBD, for now see INSTALL.W32.
|
|
|