src/secure/lib/libcrypto, branch release/14.3.0

openssl: update ASM and version info for 3.0.16 import

2025-03-25T21:07:59Z

MFC after: 1 week MFC with: 0d0c8621fd181e507f0fb50ffcca606faf66a8c2 Differential Revision: https://reviews.freebsd.org/D49297 (cherry picked from commit d2a55e6a9348bb55038dbc6b727ab041085f22db)

openssl: Import OpenSSL 3.0.15.

2024-09-28T03:50:47Z

This release incorporates the following bug fixes and mitigations: - Fixed possible denial of service in X.509 name checks ([CVE-2024-6119]) - Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535]) Release notes can be found at: https://openssl-library.org/news/openssl-3.0-notes/index.html Co-authored-by: gordon MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D46602 Merge commit '108164cf95d9594884c2dcccba2691335e6f221b' (cherry picked from commit a7148ab39c03abd4d1a84997c70bf96f15dd2a09) Update config/build info for OpenSSL 3.0.15 This is a companion commit to the OpenSSL 3.0.15 update. `opensslv.h` was regenerated via the following process: ``` cd crypto/openssl ./config git reset --hard gmake include/openssl/opensslv.h ``` `Makefile.inc` has been updated to match. MFC after: 1 week MFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09 Differential Revision: https://reviews.freebsd.org/D46603 (cherry picked from commit cc717b574d7faa2e0b2de1a985076286cef74187) sys/crypto/openssl: update powerpc* ASM This change updates the crypto powerpc* ASM via the prescribed process documented in `crypto/openssl/FREEBSD-upgrade`. This change syncs the ASM with 3.0.15's generated ASM. MFC after: 1 week MFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09 MFC with: cc717b574d7faa2e0b2de1a985076286cef74187 Differential Revision: https://reviews.freebsd.org/D46604 (cherry picked from commit 77864b545b0aaa91bc78b1156c477825007a6233)

openssl: Remove fips module from base system.

2024-09-07T04:17:19Z

To comply with FIPS 140 guidance, you must be using a specifically validated and approved version of the fips module. Currently, only OpenSSL 3.0.8 and 3.0.9 have been approved by NIST for FIPS 140 validation. As such, we need to stop shipping later versions of the module in the base system. Differential Revision: https://reviews.freebsd.org/D46223 (cherry picked from commit 86dd740dd73aa88477ff450b2359abda1ad68534)

Update config/build info for OpenSSL

2024-06-29T20:29:19Z

This is a companion commit to the OpenSSL 3.0.14 update. MFC after: 3 days MFC with: 44096ebd22ddd0081a357011714eff8963614b65 (cherry picked from commit 303596eac3f5a7fed63f1084028d811919d37eaf)

ossl: Move arm_arch.h to a common subdirectory

2024-03-29T13:53:05Z

OpenSSL itself keeps only a single copy of this header. Do the same in sys/crypto/openssl to avoid the extra maintenance burden. This requires adjusting the include paths for generated asm files. No functional change intended. Reported by: jrtc27 Reviewed by: jhb MFC after: 3 months Differential Revision: https://reviews.freebsd.org/D42866 (cherry picked from commit e655cc70dfcda5cfedb5a1d9bef1e87d55519f64)

OpenSSL: Update version strings

2024-02-05T16:06:08Z

Reported by: "Herbert J. Skuhra" Fixes: 9eb4e0b42d7c (cherry picked from commit 74fe298c8299fdb8c8f761728ddd245b0c3fe04a)

OpenSSL: update to 3.0.12

2023-10-25T20:20:31Z

OpenSSL 3.0.12 addresses: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]). Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit ad991e4c142ebabad7aef488ad97b189ecabb270) (cherry picked from commit 575878a533823aa3e5bab715928d9cdffbc4dcbc)

libcrypto: Copy the arm64 header when building asm

2023-10-25T18:32:49Z

It may be needed when it's updated so is best to keep in sync with the assembly files. Reviewed by: emaste Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D41938 (cherry picked from commit c97a82d4a4a0288ed2a456f4ce41d57483724f17)

OpenSSL: update to 3.0.11

2023-10-12T18:46:11Z

OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/852 Sponsored by: The FreeBSD Foundation (cherry picked from commit 6f1af0d7d2af54b339b5212434cd6d4fda628d80)

libcrypto: complete the support for the 0.9.8 API

2023-09-24T13:17:43Z

When importing OpenSSL 3 in base, some but not all source files implementing the deprecated 0.9.8 API were imported. With this change, it becomes possible again to compile software targeting this API. PR: 272220 Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Reviewed by: emaste Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/851 (cherry picked from commit b15b39521644ebffdcc091bd283ed410b0ae9274)