src/lib/libfetch/common.c, branch release/14.4.0

libfetch: Fail hard if interrupted while connecting

2026-02-26T18:00:38Z

This fixes an issue where the first address that DNS returns is blocked by a packet filter, so we hang for a while, then the user hits Ctrl-C, interrupting connect(2), whereupon we move on to the next address, get a connection, request the file, and return to fetch(1), which sees that SIGINT was caught and bails. Note that we make no attempt to enforce fetchTimeout in the connection phase, and never have. It's feasible, but non-trivial, so we'll leave it as an exercise for future us. PR: 293312 MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D55406 (cherry picked from commit afbdcd402bb439bd3d487baaad63b68e95929265) (cherry picked from commit cca6f5eadb796b03379eb21f38c74ca46a64e45b)

libfetch: Restore timeout functionality

2026-02-19T19:21:21Z

PR: 293124 MFC after: 1 week Fixes: 792ef1ae7b94 ("Refactor fetch_connect() and fetch_bind() to improve readability and avoid repeating the same DNS lookups.") Reverts: 8f8a7f6fffd7 ("libfetch: apply timeout to SSL_read()") Reviewed by: eugen, imp Differential Revision: https://reviews.freebsd.org/D55293 (cherry picked from commit 73b82d1b0a2f09224e6d0f7a13dd73c66d740207) (insta-mfc requested by re@) (cherry picked from commit d97c824f5b4c9e7e3a1400699022cba146e450fa)

libfetch: Check for failure to create SSL context

2026-02-12T21:24:34Z

* Drop the ssl_meth member, there is no reason to hang on to it. * Replace deprecated SSLv23_client_method() with TLS_client_method(). * Check the return value from SSL_CTX_new(). Approved by: re (cperciva) MFC after: 1 week PR: 292903 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D55098 (cherry picked from commit 4e160c6197f75fda3d5d5997ce893087058cf718) (cherry picked from commit 4781aeb5b9cb564a53fee8128f6827402deaf9df)

MFC: libfetch: allow disabling TLS v1.3 when negotiating the connection

2026-01-25T04:16:30Z

(cherry picked from commit 129aec72250266e60c07ff4643623188f7c27a9d)

MFC: libfetch: apply timeout to SSL_read()

2026-01-25T04:13:02Z

Currently, fetchTimeout works for non-SSL connections only, so does fetch -T. Fix it applying specified timeout to SSL_read(). (cherry picked from commit 8f8a7f6fffd7dca09013f7c4bfa075bc3825fb8e)

lib: Fix calls that naively set F_SETFD.

2025-08-25T13:57:56Z

With the recent inclusion of the FD_CLOFORK and FD_RESOLVE_BENEATH flags, we must avoid clearing them when setting only FD_CLOEXEC. Signed-off-by: Ricardo Branco Reviewed by: kib, markj MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/1766 (cherry picked from commit 8768b60de16a3d72a8783ec1241a711a782a36a9)

libfetch: don't rely on ca_root_nss for certificate validation

2023-10-05T00:03:16Z

Before certctl(8), there was no system trust store, and libfetch relied on the CA certificate bundle from the ca_root_nss port to verify peers. We now have a system trust store and a reliable mechanism for manipulating it (to explicitly add, remove, or revoke certificates), but if ca_root_nss is installed, libfetch will still prefer that to the system trust store. With this change, unless explicitly overridden, libfetch will rely on OpenSSL to pick up the default system trust store. PR: 256902 MFC after: 3 days Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D42059 (cherry picked from commit 09f5c1e118bb4eca77b83a0d08f559b20f60aa59)

Remove $FreeBSD$: one-line .c pattern

2023-08-16T17:54:42Z

Remove /^[\s*]*__FBSDID$"\$FreeBSD\$"$;?\s*\n/

libfetch: remove all old OpenSSL support

2023-06-24T08:45:02Z

This change removes pre-OpenSSL 1.1 supporting code and removes/adjusted preprocessor conditionals which were tautilogically true as FreeBSD main has shipped with OpenSSL 1.1+ for some time. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D40711

libfetch: do not call deprecated OpenSSL functions

2023-05-25T16:20:15Z

As of OpenSSL 1.1 SSL_library_init() and SSL_load_error_strings() are deprecated. There are replacement initialization functions but they do not need to be called: "As of version 1.1.0 OpenSSL will automatically allocate all resources that it needs so no explicit initialisation is required." Wrap both calls in an OPENSSL_VERSION_NUMBER block. PR: 271615 Reviewed by: Pierre Pronchery Event: Kitchener-Waterloo Hackathon 202305 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D40265