Update config/build info for OpenSSL 3.0.15

This is a companion commit to the OpenSSL 3.0.15 update.

`opensslv.h` was regenerated via the following process:

```
cd crypto/openssl
./config
git rese

Update config/build info for OpenSSL 3.0.15

This is a companion commit to the OpenSSL 3.0.15 update.

`opensslv.h` was regenerated via the following process:

```
cd crypto/openssl
./config
git reset --hard
gmake include/openssl/opensslv.h
```

`Makefile.inc` has been updated to match.

MFC after: 1 week
MFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09
Differential Revision: https://reviews.freebsd.org/D46603

show more ...

Remove residual blank line at start of Makefile

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

Update config/build info for OpenSSL

This is a companion commit to the OpenSSL 3.0.14 update.

MFC after: 3 days
MFC with: 44096ebd22ddd0081a357011714eff8963614b65

OpenSSL: Update version strings

Reported by: "Herbert J. Skuhra" <herbert@gojira.at>
Fixes: 9eb4e0b42d7c
MFC after: 3 days

OpenSSL: update to 3.0.12

OpenSSL 3.0.12 addresses:

* Fix incorrect key and IV resizing issues when calling
EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2()
with OSSL_PAR

OpenSSL: update to 3.0.12

OpenSSL 3.0.12 addresses:

* Fix incorrect key and IV resizing issues when calling
EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2()
with OSSL_PARAM parameters that alter the key or IV length
([CVE-2023-5363]).

Relnotes: Yes
Sponsored by: The FreeBSD Foundation

show more ...

OpenSSL: update to 3.0.11

OpenSSL 3.0.11 addresses:

POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)

Relnotes: Yes
Pull request: https://github.com/freebsd/freebsd

OpenSSL: update to 3.0.11

OpenSSL 3.0.11 addresses:

POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)

Relnotes: Yes
Pull request: https://github.com/freebsd/freebsd-src/pull/852
Sponsored by: The FreeBSD Foundation

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

OpenSSL: update to 3.0.10

OpenSSL 3.0.10 addresses:
- CVE-2023-3817
- CVE-2023-3446
- CVE-2023-2975

(Note that the vendor branch commit incorrectly referenced 3.0.9.)

Relnotes: Yes
Pull request: h

OpenSSL: update to 3.0.10

OpenSSL 3.0.10 addresses:
- CVE-2023-3817
- CVE-2023-3446
- CVE-2023-2975

(Note that the vendor branch commit incorrectly referenced 3.0.9.)

Relnotes: Yes
Pull request: https://github.com/freebsd/freebsd-src/pull/808
Sponsored by: The FreeBSD Foundation

show more ...

libcrypto: group definitions for libcrypto and fips

OpenSSL 3 supports a modular architecture, allowing different providers
to bring specific implementations of cryptographical algorithms. This
chan

libcrypto: group definitions for libcrypto and fips

OpenSSL 3 supports a modular architecture, allowing different providers
to bring specific implementations of cryptographical algorithms. This
change makes sure the FIPS module matches build instructions used for
libcrypto.

Sponsored by: The FreeBSD Foundation
Pull Request: https://github.com/freebsd/freebsd-src/pull/787

show more ...

libcrypto: Revert recent changes to fix legacy and fips providers

They break the !amd64 builds due to an underspecified include path and
will be re-applied once that's fixed.

Reported by: Ronald Kl

libcrypto: Revert recent changes to fix legacy and fips providers

They break the !amd64 builds due to an underspecified include path and
will be re-applied once that's fixed.

Reported by: Ronald Klop <ronald-lists@klop.ws>

show more ...

libcrypto: group definitions for libcrypto and fips

OpenSSL 3 supports a modular architecture, allowing different providers
to bring specific implementations of cryptographical algorithms. This
chan

libcrypto: group definitions for libcrypto and fips

OpenSSL 3 supports a modular architecture, allowing different providers
to bring specific implementations of cryptographical algorithms. This
change makes sure the FIPS module matches build instructions used for
libcrypto.

Sponsored by: The FreeBSD Foundation
Pull Request: https://github.com/freebsd/freebsd-src/pull/787

show more ...

Merge OpenSSL 3.0.9

Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the
version we were previously using) will be EOL as of 2023-09-11.

Most of the base system has already been u

Merge OpenSSL 3.0.9

Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the
version we were previously using) will be EOL as of 2023-09-11.

Most of the base system has already been updated for a seamless switch
to OpenSSL 3.0. For many components we've added
`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,
which avoids deprecation warnings from OpenSSL 3.0. Changes have also
been made to avoid OpenSSL APIs that were already deprecated in OpenSSL
1.1.1. The process of updating to contemporary APIs can continue after
this merge.

Additional changes are still required for libarchive and Kerberos-
related libraries or tools; workarounds will immediately follow this
commit. Fixes are in progress in the upstream projects and will be
incorporated when those are next updated.

There are some performance regressions in benchmarks (certain tests in
`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).
Investigation will continue for these.

Netflix's testing showed no functional regression and a rather small,
albeit statistically significant, increase in CPU consumption with
OpenSSL 3.0.

Thanks to ngie@ and des@ for updating base system components, to
antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to
Netflix and everyone who tested prior to commit or contributed to this
update in other ways.

PR: 271615
PR: 271656 [exp-run]
Relnotes: Yes
Sponsored by: The FreeBSD Foundation

show more ...

OpenSSL: Regen manual pages for OpenSSL 1.1.1u

OpenSSL: Merge OpenSSL 1.1.1t

OpenSSL: Regen manual pages for OpenSSL 1.1.1s

openssl: install pc files

most programs in ports are looking for .pc files in order to get the
necessary information on how to compile and link against openssl.

The ports now also has a way to hide

openssl: install pc files

most programs in ports are looking for .pc files in order to get the
necessary information on how to compile and link against openssl.

The ports now also has a way to hide or force a path for pkgconf.

Providing .pc files along with openssl in base will allow (once all
the supported version of FreeBSD has it) so improve the framework to
deal with openssl in base vs openssl in ports (and libressl)

This will also greatly reduce the number of patches necessary to
workaround the build systems which only knows how to detect where
openssl is installed via pkgconf.

PR: 266051
MFC After: 3 weeks
Reviewed by: jkim, delphij
Exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D36360

show more ...

OpenSSL: Regen manual pages for OpenSSL 1.1.1q

OpenSSL: Regen manual pages for OpenSSL 1.1.1p

OpenSSL: Merge OpenSSL 1.1.1o

OpenSSL: Merge OpenSSL 1.1.1n

OpenSSL: Merge OpenSSL 1.1.1m

Add assembly optimized code for OpenSSL on powerpc, powerpc64 and powerpc64le

Summary:
1. https://github.com/openssl/openssl/commit/34ab13b7d8e3e723adb60be8142e38b7c9cd382a
needs to be merged for EL

Add assembly optimized code for OpenSSL on powerpc, powerpc64 and powerpc64le

Summary:
1. https://github.com/openssl/openssl/commit/34ab13b7d8e3e723adb60be8142e38b7c9cd382a
needs to be merged for ELFv2 support on big-endian.
2. crypto/openssl/crypto/ppccap.c needs to be patched.
Same reason as in https://github.com/openssl/openssl/pull/17082.

Approved by: jkim, jhibbits
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D33076

show more ...

OpenSSL: Regen manual pages for 1.1.1l

OpenSSL: Regen manual pages for 1.1.1k

OpenSSL: Remove obsolete include directory

This directory was deprecated since OpenSSL 1.1.1e.

https://github.com/openssl/openssl/pull/9681