openssl: build libcrypto and libssl from upstream's source set

Compared the bmake source lists of libcrypto and libssl with upstream's
own build of 3.5.8 (configured with the options in
crypto/opens

openssl: build libcrypto and libssl from upstream's source set

Compared the bmake source lists of libcrypto and libssl with upstream's
own build of 3.5.8 (configured with the options in
crypto/openssl/BSDmakefile), and fix the differences that are not
intentional.

libcrypto:
- aarch64: build bsaes-armv8.S and md5-aarch64.S, and define BSAES_ASM
and MD5_ASM, as upstream does. Both files have been generated into
sys/crypto/openssl/aarch64 since the 3.5.1 import, but were never
compiled.
- Stop compiling der_digests_gen.c, der_dsa_key.c and der_ec_key.c.
Upstream keeps them in libcommon.a, but the linker does not extract
them into libcrypto (checked with --why-extract) as nothing in
libcrypto references them.

libssl:
- Fix the "SRSC" typo that left out ssl3_cbc.c and tls_pad.c.
- Build libssl's own copy of crypto/thread/arch*.c, as upstream does.
Before this change, libssl got these functions from libcrypto, which
exports them only for this purpose. A planned later change removes
those exports.

crypto/openssl:
- crypto/bio/bio_sock2.c: remove the local ktls_enable() call in
BIO_socket() it does nothing on FreeBSD. The file is now identical
to upstream.
- Remove the empty file "patch", committed by mistake in f775385affef.

With this change, libssl no longer imports any libcrypto internals.

Reviewed by: ngie, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60395

show more ...

crypto/openssl: update generated files to match 3.5.9 release content

A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "vers

crypto/openssl: update generated files to match 3.5.9 release content

A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "version bump" update
(3.5.8 -> 3.5.9).

MFC after: 1 day
MFC with: b3a31d78

show more ...

OpenSSL: update Makefiles to reflect 3.5.1 release

This is a targeted effort to update the INCS and SRCS entries for
libcrypto, the legacy provider, and libssl to match what upstream
(OpenSSL) build

OpenSSL: update Makefiles to reflect 3.5.1 release

This is a targeted effort to update the INCS and SRCS entries for
libcrypto, the legacy provider, and libssl to match what upstream
(OpenSSL) builds in their respective libraries.

The number of stylistic changes were kept at a minimum.

Another incoming change will reformat this file to make future
maintenance easier.

MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D52554

show more ...

openssl: Disable KTLS in bootstrap libraries

We need to build OpenSSL when bootstrapping certctl. On MacOS
ktls_enable() isn't defined anywhere, so without this the build fails.
We don't need KTLS

openssl: Disable KTLS in bootstrap libraries

We need to build OpenSSL when bootstrapping certctl. On MacOS
ktls_enable() isn't defined anywhere, so without this the build fails.
We don't need KTLS in the bootstrap library, so just disable it.

Reviewed by: khorben, ngie
Differential Revision: https://reviews.freebsd.org/D52341

show more ...

packages: Improve handling of -lib packages

For some packages (OpenSSL, Kerberos) we want to ship runtime libraries
in a separate package, e.g. openssl and openssl-lib. Currently this is
done using

packages: Improve handling of -lib packages

For some packages (OpenSSL, Kerberos) we want to ship runtime libraries
in a separate package, e.g. openssl and openssl-lib. Currently this is
done using PACKAGE=openssl-lib, but that creates packages with strange
names like openssl-lib-lib32.

Instead, add a new LIB_PACKAGE option to bsd.lib.mk that causes runtime
libraries to be placed in a new -lib subpackage. This significantly
improves the set of packages we create; for example, OpenSSL goes from:

FreeBSD-openssl
FreeBSD-openssl-dbg
FreeBSD-openssl-lib
FreeBSD-openssl-lib-dbg
FreeBSD-openssl-lib-dbg-lib32
FreeBSD-openssl-lib-dev
FreeBSD-openssl-lib-dev-lib32
FreeBSD-openssl-lib-lib32
FreeBSD-openssl-lib-man
FreeBSD-openssl-man

to:

FreeBSD-openssl
FreeBSD-openssl-dbg
FreeBSD-openssl-dbg-lib32
FreeBSD-openssl-dev
FreeBSD-openssl-dev-lib32
FreeBSD-openssl-lib
FreeBSD-openssl-lib32
FreeBSD-openssl-man

While here, move /usr/bin/krb5-config and /usr/bin/compile_et into
the kerberos-dev package.

Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D51925

show more ...

libssl: unbreak building the library with KTLS

The 3.5.1 update dropped a `SRCS` entry for the MK_OPENSSL_KTLS != no
case (the source was renamed from `ktls.c` to `ktls_meth.c`). Add the
new file to

libssl: unbreak building the library with KTLS

The 3.5.1 update dropped a `SRCS` entry for the MK_OPENSSL_KTLS != no
case (the source was renamed from `ktls.c` to `ktls_meth.c`). Add the
new file to SRCS in order to unbreak linking the library when KTLS is
enabled.

This bug isn't apparent now because KTLS is always disabled in
`include/openssl/configuration.h` (this will be fixed soon).

Found when doing `make universe` with KTLS enabled in
`include/openssl/configuration.h`.

Fixes: 4757b351ea9d59d ("openssl: Import version 3.5.1")

show more ...

openssl: Import version 3.5.1

Migrate to OpenSSL 3.5 in advance of FreeBSD 15.0. OpenSSL 3.0 will be
EOL after 2026-09-07.

Approved by: philip (mentor)
Sponsored by: Alpha-Omega Beach Cleaning Proj

openssl: Import version 3.5.1

Migrate to OpenSSL 3.5 in advance of FreeBSD 15.0. OpenSSL 3.0 will be
EOL after 2026-09-07.

Approved by: philip (mentor)
Sponsored by: Alpha-Omega Beach Cleaning Project
Sponsored by: The FreeBSD Foundation
Differential revision: https://reviews.freebsd.org/D51613

show more ...

build: remove the last vestiges of lint support

Commit 1cbb58886a47 (shipped in 12.0.0) removed all lint infrastructure.
A bunch of NO_LINT definitions remained (perhaps as a bootstrapping
measture)

build: remove the last vestiges of lint support

Commit 1cbb58886a47 (shipped in 12.0.0) removed all lint infrastructure.
A bunch of NO_LINT definitions remained (perhaps as a bootstrapping
measture). Remove them.

Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D50704

show more ...

Remove residual blank line at start of Makefile

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

pkgbase: reorganise caroot and openssl packages

This splits out the certctl utility into a new certctl package and the
openssl libs into an openssl-lib package.

PR: 272816
Reviewed by: manu
Differ

pkgbase: reorganise caroot and openssl packages

This splits out the certctl utility into a new certctl package and the
openssl libs into an openssl-lib package.

PR: 272816
Reviewed by: manu
Differential Revision: https://reviews.freebsd.org/D41321

show more ...

Merge OpenSSL 3.0.9

Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the
version we were previously using) will be EOL as of 2023-09-11.

Most of the base system has already been u

Merge OpenSSL 3.0.9

Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the
version we were previously using) will be EOL as of 2023-09-11.

Most of the base system has already been updated for a seamless switch
to OpenSSL 3.0. For many components we've added
`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,
which avoids deprecation warnings from OpenSSL 3.0. Changes have also
been made to avoid OpenSSL APIs that were already deprecated in OpenSSL
1.1.1. The process of updating to contemporary APIs can continue after
this merge.

Additional changes are still required for libarchive and Kerberos-
related libraries or tools; workarounds will immediately follow this
commit. Fixes are in progress in the upstream projects and will be
incorporated when those are next updated.

There are some performance regressions in benchmarks (certain tests in
`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).
Investigation will continue for these.

Netflix's testing showed no functional regression and a rather small,
albeit statistically significant, increase in CPU consumption with
OpenSSL 3.0.

Thanks to ngie@ and des@ for updating base system components, to
antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to
Netflix and everyone who tested prior to commit or contributed to this
update in other ways.

PR: 271615
PR: 271656 [exp-run]
Relnotes: Yes
Sponsored by: The FreeBSD Foundation

show more ...

openssl: install pc files

most programs in ports are looking for .pc files in order to get the
necessary information on how to compile and link against openssl.

The ports now also has a way to hide

openssl: install pc files

most programs in ports are looking for .pc files in order to get the
necessary information on how to compile and link against openssl.

The ports now also has a way to hide or force a path for pkgconf.

Providing .pc files along with openssl in base will allow (once all
the supported version of FreeBSD has it) so improve the framework to
deal with openssl in base vs openssl in ports (and libressl)

This will also greatly reduce the number of patches necessary to
workaround the build systems which only knows how to detect where
openssl is installed via pkgconf.

PR: 266051
MFC After: 3 weeks
Reviewed by: jkim, delphij
Exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D36360

show more ...

pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Diffe

pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D30081

show more ...

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile support on both Linux and FreeBSD.

Note that TLS 1.3 only supports TX offload.

A new WITH/WITHOUT_OPENSSL_KTLS determines if OpenSSL is built with
KTLS support. It defaults to enabled on amd64 and disabled on all
other architectures.

Reviewed by: jkim (earlier version)
Approved by: secteam
Obtained from: OpenSSL (patches from master)
MFC after: 1 week
Relnotes: yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D28273

show more ...

Fix a typo in the cpp macro defined for PIC.

In practice this isn't used in OpenSSL outside of some sparc-specific
code.

Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D260

Fix a typo in the cpp macro defined for PIC.

In practice this isn't used in OpenSSL outside of some sparc-specific
code.

Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D26058

show more ...

Replace OPENSSL_NO_SSL3_METHODs with dummies

SSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); it
should not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should use

Replace OPENSSL_NO_SSL3_METHODs with dummies

SSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); it
should not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should use
it, and if they must, they can use some implementation outside of base.

There are three symbols removed with OPENSSL_NO_SSL3_METHOD:

SSLv3_client_method
SSLv3_method
SSLv3_server_method

These symbols exist to request an explicit SSLv3 connection to a server.
There is no good reason for an application to link or invoke these symbols
instead of TLS_method(), et al (née SSLv23_method, et al). Applications
that do so have broken cryptography.

Define these symbols for some pedantic definition of ABI stability, but
remove the functionality again (r361392) after r362620.

Reviewed by: gordon, jhb (earlier-but-equivalent version both)
Discussed with: bjk, kib
Differential Revision: https://reviews.freebsd.org/D25493

show more ...

Bump base OpenSSL libraries versions to avoid conflict with port's libraries.

Reported by: many
Reviewed by: gjb
Sponsored by: The FreeBSD Foundation
MFC after: 3 hours

Build libssl for amd64.

Add OpenSSL symbol version maps.

Note the files are not automatically generated for now.

Catch up with manual page removal from secure/lib/libssl.

Update shlib version to 9.

Clean up OpenSSL makefiles.

Merge OpenSSL 1.0.2d.

Disable insecure SSLv2 support from the base OpenSSL.

Differential Revision: https://reviews.freebsd.org/D1304