aboutsummaryrefslogtreecommitdiff
path: root/secure
Commit message (Collapse)AuthorAgeFilesLines
* openssl: don't export nonexistant symbolsBrooks Davis2024-04-222-137/+0
| | | | | | | | These are all OpenSSL 1.1.0 and 1.1.1 symbols that aren't present in our OpenSSL 3.0 builds. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D44249
* Revert "OpenSSL: use the upstream provided version.map files for the ↵Enji Cooper2024-04-212-4/+0
| | | | | | | | | | | | fips/legacy providers" This change is still under review and should not have been merged directly to main (yet). This is a case and point for using `push.default` to nothing instead of matching or simple. This reverts commit 42ce242e353065dfbaa248955f6657005a395a95.
* OpenSSL: use the upstream provided version.map files for the fips/legacy ↵Enji Cooper2024-04-212-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | providers This change introduces a static copy of the fips and legacy linker version maps generated by the OpenSSL 3.0.13 build process. This unbreaks the fips and legacy providers by not exposing unnecessary symbols from the fips/legacy provider shared objects shared with other providers (base, default) and libcrypto. More discussion: Prior to this change, loading the fips provider indirectly from a FreeBSD 14.0-CURRENT and 15.0-CURRENT host would result in a process-wide deadlock when invoking select OpenSSL APIs (CONF_modules_load* in this particular example). Speaking with the upstream maintainers [1], it became obvious that the FreeBSD base system was incorrectly building/linking the fips provider, resulting in a symbol collision at runtime, and thus a process-wide deadlock in specific circumstances. The fips provider would deadlock when trying to acquire a write lock on internal structures which should have only been available to the base and default providers, as certain preprocessor ifdefs only allow specific internal calls to be made with the base and default providers. 1. https://github.com/openssl/openssl/issues/24202 Differential Revision: https://reviews.freebsd.org/D44892
* caroot: routine updateKyle Evans2024-02-1110-59/+875
| | | | | | | | | Changes: - One (1) modified - Eight (8) added - One (1) expired, now untrusted MFC after: 3 days
* OpenSSL: Update version stringsCy Schubert2024-02-031-2/+2
| | | | | | Reported by: "Herbert J. Skuhra" <herbert@gojira.at> Fixes: 9eb4e0b42d7c MFC after: 3 days
* ssh: Update to OpenSSH 9.6p1Ed Maste2024-01-051-1/+1
| | | | | | | | | | | | | | | | From the release notes, > This release contains a number of security fixes, some small features > and bugfixes. The most significant change in 9.6p1 is a set of fixes for a newly- discovered weakness in the SSH transport protocol. The fix was already merged into FreeBSD and released as FreeBSD-SA-23:19.openssh. Full release notes at https://www.openssh.com/txt/release-9.6 Relnotes: Yes Sponsored by: The FreeBSD Foundation
* ossl: Move arm_arch.h to a common subdirectoryMark Johnston2023-12-041-1/+2
| | | | | | | | | | | | | OpenSSL itself keeps only a single copy of this header. Do the same in sys/crypto/openssl to avoid the extra maintenance burden. This requires adjusting the include paths for generated asm files. No functional change intended. Reported by: jrtc27 Reviewed by: jhb MFC after: 3 months Differential Revision: https://reviews.freebsd.org/D42866
* secure: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-1/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* secure: Remove ancient SCCS tags.Warner Losh2023-11-27792-1584/+0
| | | | | | | | Remove ancient SCCS tags from the tree, automated scripting, with two minor fixup to keep things compiling. All the common forms in the tree were removed with a perl script. Sponsored by: Netflix
* Track upstream project rename in contrib/blocklistdEd Maste2023-11-031-1/+1
| | | | | | | | Upstream is now https://github.com/zoulasc/blocklist/. Rename the contrib directory and update Makefiles to match, in advance of the next vendor branch update. Sponsored by: The FreeBSD Foundation
* OpenSSL: update to 3.0.12Ed Maste2023-10-241-2/+2
| | | | | | | | | | | | OpenSSL 3.0.12 addresses: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]). Relnotes: Yes Sponsored by: The FreeBSD Foundation
* OpenSSL: update to 3.0.11Pierre Pronchery2023-10-09793-2445/+2513
| | | | | | | | | | OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/852 Sponsored by: The FreeBSD Foundation
* libcrypto: Copy the arm64 header when building asmAndrew Turner2023-09-221-0/+1
| | | | | | | | | It may be needed when it's updated so is best to keep in sync with the assembly files. Reviewed by: emaste Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D41938
* libcrypto: fix the FIPS provider on amd64Pierre Pronchery2023-09-211-10/+10
| | | | | | | | | | | | | | | | | | | This corrects the list of source files required for the FIPS provider. To test: ``` INSTALL PASSED enter AES-128-CBC encryption password: Verifying - enter AES-128-CBC encryption password: U2FsdGVkX1+MGm7LbZou29UWU+KAyBX/PxF5T1pO9VM= ``` Reviewed by: emaste Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/837 Differential Revision: https://reviews.freebsd.org/D41720
* libcrypto: complete the support for the 0.9.8 APIPierre Pronchery2023-09-211-4/+4
| | | | | | | | | | | | | When importing OpenSSL 3 in base, some but not all source files implementing the deprecated 0.9.8 API were imported. With this change, it becomes possible again to compile software targeting this API. PR: 272220 Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Reviewed by: emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/851
* libcrypto: link engines and the legacy provider to libcryptoPierre Pronchery2023-09-163-0/+5
| | | | | | | | | | | | | | | | OpenSSL's legacy provider module and engines need to link to libcrypto.so, as it provides some of the actual implementations of legacy routines. This is a little tricky due to build order issues. Introduce a small hack (LIBCRYPTO_WITHOUT_SUBDIRS) that builds libcrypto.so in its usual early phase without any OpenSSL provider modules or engines. This is intended to restore the test suite; a future change should remove the hack and replace it with a better approach. PR: 254853, 273528 Discussed with: Folks at EuroBSDCon in Coimbra Sponsored by: The FreeBSD Foundation
* libcrypto: Switch back to the generated assembly in sys/crypto/opensslJohn Baldwin2023-08-29145-310557/+5
| | | | | Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D41569
* libcrypto: Add buildasm and cleanasm targetsJohn Baldwin2023-08-292-0/+9
| | | | | | | These targets generate all the assembly files in sys/crypto/openssl. Reviewed by: markj, emaste (earlier version) Differential Revision: https://reviews.freebsd.org/D41590
* libcrypto: Refactor Makefile.asm so it can be run outside of buildenvJohn Baldwin2023-08-291-13/+14
| | | | | | | | | | | | | | | | | | | | | Currently Makefile.asm relies on the current buildenv to set CFLAGS for i386. The current approach also leaves various temporary *.s files around in the current directory. To make this a bit better: - Instead of using CFLAGS from buildenv for i386, define the actual flags the perl scripts need: -DOPENSSL_IA32_SSE2 to enable SSE2. - Change i386 to have the perl scripts write to /dev/stdout to avoid creating temporaries. Previously i386 was generating the temporary files in the OpenSSL contrib src. - Cleanup temporary *.s files in the all target after generating the real *.S files for architectures which need them. - Remove a duplicate rule for aes-armv4.S. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D41589
* Makefile.asm: Simplify variable expansions in generated headersJohn Baldwin2023-08-291-15/+15
| | | | | | | | The :R:S expressions removed the .pl extension only to add it back again, so just trim them to using :T alone. Reviewed by: Pierre Pronchery <pierre@freebsdfoundation.org>, markj, emaste Differential Revision: https://reviews.freebsd.org/D41588
* caroot: regenerate the root bundle with OpenSSL 3Kyle Evans2023-08-26191-3791/+3872
| | | | No functional change intended.
* caroot: update the root bundleKyle Evans2023-08-2610-0/+605
| | | | | | | | | | | | | Summary: - Six (6) new roots - Four (4) distrusted roots Note that this was intentionally generated with OpenSSL 1.1.1 to avoid mixing updates and non-functional changes -- there will be some churn with OpenSSL 3. The next commit will update the current batch of trusted certs with the format OpenSSL 3 produces, which I've tested against OpenSSL 1.1.1 to be sure that that doesn't hurt us in older branches.
* caroot: drop the VERSION tag from already-processed certsKyle Evans2023-08-26166-166/+0
| | | | | An update is imminent; drop these now to make it easier to audit the results.
* caroot: drop VERSION tags from certsKyle Evans2023-08-261-3/+0
| | | | | | | | | | | | With this change, we'll drop the "with $FreeBSD$" lines from trusted/ certs in the next update. untrusted/ will need to be done manually, but I'll likely just do them all manually, commit, then run the script and commit any legitimate updates after confirming the output matches what I did manually. Reported by: imp Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D41597
* Makefile.asm: Drop mention of $FreeBSD$ from instructions.John Baldwin2023-08-221-1/+1
|
* libcrypto: Update assembly build glue for x86 for OpenSSL 3.0.John Baldwin2023-08-222-10/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Notably, define AES_ASM which is required for any AES acceleration (OpenSSL 1.0 gated all AES acceleration on OPENSSL_CPUID_OBJ instead). Enabling this exposed that new assembly files added in OpenSSL 3.0 needed to be included in the build (aes-x86-64.S and aes-586.S). Both of these files supplant both aes_core.c and aes_cbc.c. The last file had to be moved out of the MI SRCS line for aes and into each ASM_* for non-x86. As part of this I audited the generated configdata.pm for amd64, i386, and aarch64 and found the following additional discrepecancies that are fixed here as well: - Enabled BSAES_ASM on amd64 which requires bsase-x86_64.S - Enabled WHIRLPOOL_ASM on amd64 (asm sources already built) - Enabled CMLL_ASM on amd64 and i386 (asm sources already built) aarch64 had no discreprecancies in configdata.pm, and no *.pl asm generators were missing for aarch64 in Makefile.asm. I did not check powerpc or armv7, but for armv7 all of the asm generators seem to be present in Makefile.asm. Reported by: gallatin (AES-GCM using plain software on amd64) Reviewed by: gallatin, ngie, emaste Differential Revision: https://reviews.freebsd.org/D41539
* libcrypto: Generate new files added in OpenSSL 3.0.John Baldwin2023-08-223-0/+11943
| | | | | Reviewed by: gallatin, ngie, emaste Differential Revision: https://reviews.freebsd.org/D41538
* libcrypto: Add new assembly files added in OpenSSL 3.0.John Baldwin2023-08-221-4/+5
| | | | | | | | This only affects amd64 and i386, but in particular includes wrappers for AES encryption/decryption that gate all of the accelerated AES. Reviewed by: gallatin, ngie, emaste Differential Revision: https://reviews.freebsd.org/D41537
* libcrypto: Don't embed $FreeBSD$ in generated assembly filesJohn Baldwin2023-08-221-38/+19
| | | | | Reviewed by: gallatin, ngie, emaste Differential Revision: https://reviews.freebsd.org/D41536
* libcrypto: add rsa_depr.c to the buildEd Maste2023-08-181-1/+1
| | | | | | | | | It provides the RSA_generate_key function, which is deprecated as of 3.0 but is used by various ports. Reviewed by: kbowling Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D41506
* libcrypto: add err_all_legacy.c to the buildEd Maste2023-08-181-1/+1
| | | | | | | | | | It provides the ERR_load_*_strings routines, which are deprecated as of 3.0 but are used by various ports. PR: 272580 Reviewed by: kbowling Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D41505
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-1677-77/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-163-6/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* Remove $FreeBSD$: one-line .c comment patternWarner Losh2023-08-16139-139/+0
| | | | Remove /^/[*/]\s*\$FreeBSD\$.*\n/
* Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* OpenSSL: update to 3.0.10Pierre Pronchery2023-08-10794-966/+1041
| | | | | | | | | | | | | OpenSSL 3.0.10 addresses: - CVE-2023-3817 - CVE-2023-3446 - CVE-2023-2975 (Note that the vendor branch commit incorrectly referenced 3.0.9.) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/808 Sponsored by: The FreeBSD Foundation
* pkgbase: reorganise caroot and openssl packagesDoug Rabson2023-08-052-2/+2
| | | | | | | | | This splits out the certctl utility into a new certctl package and the openssl libs into an openssl-lib package. PR: 272816 Reviewed by: manu Differential Revision: https://reviews.freebsd.org/D41321
* libcrypto: add missing symbols to the FIPS providerPierre Pronchery2023-07-201-0/+73
| | | | | | | | | | The fips.so provider module exposing FIPS-validated algorithms was still missing a number of symbols. PR: 272454 Reviewed by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D41018
* openssl: include d2i_KeyParams() and d2i_KeyParams_bio()Kristof Provost2023-07-092-2/+4
| | | | | | | | | | | | These functions are new, and some ports (e.g.opensc) expect to have them available. Add the file they're defined in to the build, and add them to Version.map. PR: 270076 Reviewed by: markj, emaste, pierre Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D40914
* libcrypto: group definitions for libcrypto and fipsPierre Pronchery2023-07-054-224/+131
| | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change makes sure the FIPS module matches build instructions used for libcrypto. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: expand the common Makefile for providersPierre Pronchery2023-07-053-8/+5
| | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change adds mandatory source files to every provider. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-051-1/+355
| | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the legacy providerPierre Pronchery2023-07-052-2/+35
| | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "legacy", ships with OpenSSL 3 directly, and groups obsoleted algorithms that can still optionally be used anyway. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: Revert recent changes to fix legacy and fips providersMark Johnston2023-07-045-398/+107
| | | | | | | They break the !amd64 builds due to an underspecified include path and will be re-applied once that's fixed. Reported by: Ronald Klop <ronald-lists@klop.ws>
* libcrypto: group definitions for libcrypto and fipsPierre Pronchery2023-07-043-214/+121
| | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change makes sure the FIPS module matches build instructions used for libcrypto. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: expand the common Makefile for providersPierre Pronchery2023-07-043-8/+5
| | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. This change adds mandatory source files to every provider. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-041-1/+355
| | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* libcrypto: add missing symbols to the legacy providerPierre Pronchery2023-07-042-2/+35
| | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "legacy", ships with OpenSSL 3 directly, and groups obsoleted algorithms that can still optionally be used anyway. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* caroot: add new certsKyle Evans2023-06-2520-0/+2059
| | | | | | | Based on dates, these were likely just missed in the last update... add them now. - Twenty (20) new
* libcrypto: build nistp* on all little-endian 64-bit targetsEd Maste2023-06-251-2/+4
| | | | | | | | | | | | | libcrypto intends to provide these routines on little-endian 64-bit targets. This was previously done by including them in the ASM_aarch64 and ASM_amd64 blocks in the Makefile, but this excluded powerpc64le and riscv64. Reported by: ci.freebsd.org Reviewed by: jrtc27 Fixes: b077aed33b7b ("Merge OpenSSL 3.0.9") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D40749
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-13 09:23:13 +0000