openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer o
openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535])Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlCo-authored-by: gordonMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D46602Merge commit '108164cf95d9594884c2dcccba2691335e6f221b'
show more ...
openssl: Add <sys/random.h> include for getrandom()GCC 14 (but not earlier versions) warns about a missing prototypefor getrandom(). Include <sys/random.h> explicitly to bring in theprototype ra
openssl: Add <sys/random.h> include for getrandom()GCC 14 (but not earlier versions) warns about a missing prototypefor getrandom(). Include <sys/random.h> explicitly to bring in theprototype rather than depending on a nested include. While here,stop defining sysctl_random() since it is no longer used.Reviewed by: brooksFixes: 838b6caababb openssl: use getrandom(2) instead of probing for getentropy(2)Differential Revision: https://reviews.freebsd.org/D45995
openssl: use getrandom(2) instead of probing for getentropy(2)The probing for getentropy(2) relies on re-declaring getentropy(2)as weak and checking the address, but this is incompatible withthe
openssl: use getrandom(2) instead of probing for getentropy(2)The probing for getentropy(2) relies on re-declaring getentropy(2)as weak and checking the address, but this is incompatible withthe _FORTIFY_SOURCE symbol renaming scheme. It's always present onall supported FreeBSD versions now so we could cut it down tounconditional use, but there's another segment for getrandom(2)already that's cleaner to just add us to.We should upstream this.Reviewed by: kib (earlier version), markjSponsored by: Klara, Inc.Sponsored by: StormshieldDifferential Revision: https://reviews.freebsd.org/D45976
Update to OpenSSL 3.0.14This release resolves 3 upstream found CVEs:- Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741)- Fixed an issue where checking excessively
Update to OpenSSL 3.0.14This release resolves 3 upstream found CVEs:- Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741)- Fixed an issue where checking excessively long DSA keys or parameters may be very slow (CVE-2024-4603)- Fixed unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)MFC after: 3 daysMerge commit '1070e7dca8223387baf5155524b28f62bfe7da3c'
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been u
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been updated for a seamless switchto OpenSSL 3.0. For many components we've added`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,which avoids deprecation warnings from OpenSSL 3.0. Changes have alsobeen made to avoid OpenSSL APIs that were already deprecated in OpenSSL1.1.1. The process of updating to contemporary APIs can continue afterthis merge.Additional changes are still required for libarchive and Kerberos-related libraries or tools; workarounds will immediately follow thiscommit. Fixes are in progress in the upstream projects and will beincorporated when those are next updated.There are some performance regressions in benchmarks (certain tests in`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).Investigation will continue for these.Netflix's testing showed no functional regression and a rather small,albeit statistically significant, increase in CPU consumption withOpenSSL 3.0.Thanks to ngie@ and des@ for updating base system components, toantoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and toNetflix and everyone who tested prior to commit or contributed to thisupdate in other ways.PR: 271615PR: 271656 [exp-run]Relnotes: YesSponsored by: The FreeBSD Foundation