aboutsummaryrefslogtreecommitdiff
path: root/secure/lib/libcrypto/modules
Commit message (Collapse)AuthorAgeFilesLines
* Revert "libcrypto: compile all PIC objects with -DOPENSSL_PIC"Enji Cooper2026-03-201-2/+0
| | | | | | | | | | | | | | This commit broke the build with some build options. Some validation needs to be done to confirm that moving the preprocessor argument to `secure/lib/libcrypto/Makefile.inc` works without breaking the build, but revert for now until a `tinderbox` run can be done with the change. PR: 293934 Reported by: Jenkins, Trond Endrestøl This reverts commit 14b9955e57cc28b61e785165b9effcbe620edb46.
* libcrypto: compile all PIC objects with -DOPENSSL_PICEnji Cooper2026-03-201-0/+2
| | | | | | | | | | | This change modifies the libcrypto PIC objects to always compile with `-DOPENSSL_PIC` to restore parity with the upstream build process. This ensures that `-DOPENSSL_PIC` is used whenever building the auxiliary shared objects. In this case, just the legacy provider (we no longer distribute the fips provider). MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D44896
* OpenSSL: update Makefiles to reflect 3.5.1 releaseEnji Cooper2025-09-182-12/+36
| | | | | | | | | | | | | | This is a targeted effort to update the INCS and SRCS entries for libcrypto, the legacy provider, and libssl to match what upstream (OpenSSL) builds in their respective libraries. The number of stylistic changes were kept at a minimum. Another incoming change will reformat this file to make future maintenance easier. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52554
* openssl: link enough files for the legacy provider to actually loadGleb Smirnoff2025-09-011-3/+4
| | | | | Reviewed by: khorben, ngie Differential Revision: https://reviews.freebsd.org/D52113
* packages: Improve handling of -lib packagesLexi Winter2025-08-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some packages (OpenSSL, Kerberos) we want to ship runtime libraries in a separate package, e.g. openssl and openssl-lib. Currently this is done using PACKAGE=openssl-lib, but that creates packages with strange names like openssl-lib-lib32. Instead, add a new LIB_PACKAGE option to bsd.lib.mk that causes runtime libraries to be placed in a new -lib subpackage. This significantly improves the set of packages we create; for example, OpenSSL goes from: FreeBSD-openssl FreeBSD-openssl-dbg FreeBSD-openssl-lib FreeBSD-openssl-lib-dbg FreeBSD-openssl-lib-dbg-lib32 FreeBSD-openssl-lib-dev FreeBSD-openssl-lib-dev-lib32 FreeBSD-openssl-lib-lib32 FreeBSD-openssl-lib-man FreeBSD-openssl-man to: FreeBSD-openssl FreeBSD-openssl-dbg FreeBSD-openssl-dbg-lib32 FreeBSD-openssl-dev FreeBSD-openssl-dev-lib32 FreeBSD-openssl-lib FreeBSD-openssl-lib32 FreeBSD-openssl-man While here, move /usr/bin/krb5-config and /usr/bin/compile_et into the kerberos-dev package. Reviewed by: des Differential Revision: https://reviews.freebsd.org/D51925
* openssl: Import version 3.5.1Pierre Pronchery2025-08-072-3/+1
| | | | | | | | | | Migrate to OpenSSL 3.5 in advance of FreeBSD 15.0. OpenSSL 3.0 will be EOL after 2026-09-07. Approved by: philip (mentor) Sponsored by: Alpha-Omega Beach Cleaning Project Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D51613
* libcrypto: move engines and modules to openssl-libLexi Winter2025-05-051-0/+1
| | | | | | | | | | | | | | | | | currently, some OpenSSL-related files end up in the utilities package: /usr/lib/engines-3/capi.so /usr/lib/engines-3/devcrypto.so /usr/lib/engines-3/loader_attic.so /usr/lib/engines-3/padlock.so /usr/lib/ossl-modules/legacy.so since these are part of OpenSSL and are not useful without it, move them to the openssl-lib package. Reviewed by: manu, des, emaste Approved by: des (mentor) Differential Revision: https://reviews.freebsd.org/D50144
* openssl: Remove fips module from base system.Gordon Tetlow2024-08-312-341/+1
| | | | | | | | | | | To comply with FIPS 140 guidance, you must be using a specifically validated and approved version of the fips module. Currently, only OpenSSL 3.0.8 and 3.0.9 have been approved by NIST for FIPS 140 validation. As such, we need to stop shipping later versions of the module in the base system. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D46223
* Remove residual blank line at start of MakefileWarner Losh2024-07-154-4/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* Revert "OpenSSL: use the upstream provided version.map files for the ↵Enji Cooper2024-04-212-4/+0
| | | | | | | | | | | | fips/legacy providers" This change is still under review and should not have been merged directly to main (yet). This is a case and point for using `push.default` to nothing instead of matching or simple. This reverts commit 42ce242e353065dfbaa248955f6657005a395a95.
* OpenSSL: use the upstream provided version.map files for the fips/legacy ↵Enji Cooper2024-04-212-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | providers This change introduces a static copy of the fips and legacy linker version maps generated by the OpenSSL 3.0.13 build process. This unbreaks the fips and legacy providers by not exposing unnecessary symbols from the fips/legacy provider shared objects shared with other providers (base, default) and libcrypto. More discussion: Prior to this change, loading the fips provider indirectly from a FreeBSD 14.0-CURRENT and 15.0-CURRENT host would result in a process-wide deadlock when invoking select OpenSSL APIs (CONF_modules_load* in this particular example). Speaking with the upstream maintainers [1], it became obvious that the FreeBSD base system was incorrectly building/linking the fips provider, resulting in a symbol collision at runtime, and thus a process-wide deadlock in specific circumstances. The fips provider would deadlock when trying to acquire a write lock on internal structures which should have only been available to the base and default providers, as certain preprocessor ifdefs only allow specific internal calls to be made with the base and default providers. 1. https://github.com/openssl/openssl/issues/24202 Differential Revision: https://reviews.freebsd.org/D44892
* libcrypto: fix the FIPS provider on amd64Pierre Pronchery2023-09-211-10/+10
| | | | | | | | | | | | | | | | | | | This corrects the list of source files required for the FIPS provider. To test: ``` INSTALL PASSED enter AES-128-CBC encryption password: Verifying - enter AES-128-CBC encryption password: U2FsdGVkX1+MGm7LbZou29UWU+KAyBX/PxF5T1pO9VM= ``` Reviewed by: emaste Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/837 Differential Revision: https://reviews.freebsd.org/D41720
* libcrypto: link engines and the legacy provider to libcryptoPierre Pronchery2023-09-161-0/+1
| | | | | | | | | | | | | | | | OpenSSL's legacy provider module and engines need to link to libcrypto.so, as it provides some of the actual implementations of legacy routines. This is a little tricky due to build order issues. Introduce a small hack (LIBCRYPTO_WITHOUT_SUBDIRS) that builds libcrypto.so in its usual early phase without any OpenSSL provider modules or engines. This is intended to restore the test suite; a future change should remove the hack and replace it with a better approach. PR: 254853, 273528 Discussed with: Folks at EuroBSDCon in Coimbra Sponsored by: The FreeBSD Foundation
* libcrypto: Switch back to the generated assembly in sys/crypto/opensslJohn Baldwin2023-08-291-2/+2
| | | | | Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D41569
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-164-4/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* libcrypto: add missing symbols to the FIPS providerPierre Pronchery2023-07-201-0/+73
| | | | | | | | | | The fips.so provider module exposing FIPS-validated algorithms was still missing a number of symbols. PR: 272454 Reviewed by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D41018
* libcrypto: group definitions for libcrypto and fipsPierre Pronchery2023-07-051-112/+18
| | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change makes sure the FIPS module matches build instructions used for libcrypto. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: expand the common Makefile for providersPierre Pronchery2023-07-053-8/+5
| | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change adds mandatory source files to every provider. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-051-1/+355
| | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the legacy providerPierre Pronchery2023-07-052-2/+35
| | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "legacy", ships with OpenSSL 3 directly, and groups obsoleted algorithms that can still optionally be used anyway. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: Revert recent changes to fix legacy and fips providersMark Johnston2023-07-043-295/+5
| | | | | | | They break the !amd64 builds due to an underspecified include path and will be re-applied once that's fixed. Reported by: Ronald Klop <ronald-lists@klop.ws>
* libcrypto: group definitions for libcrypto and fipsPierre Pronchery2023-07-041-112/+18
| | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change makes sure the FIPS module matches build instructions used for libcrypto. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: expand the common Makefile for providersPierre Pronchery2023-07-043-8/+5
| | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change adds mandatory source files to every provider. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-041-1/+355
| | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the legacy providerPierre Pronchery2023-07-042-2/+35
| | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "legacy", ships with OpenSSL 3 directly, and groups obsoleted algorithms that can still optionally be used anyway. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* Merge OpenSSL 3.0.9Pierre Pronchery2023-06-234-0/+39
Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation
generated by cgit v1.3 (git 2.53.0) at 2026-05-22 08:43:23 +0000