Fix multiple OpenSSL vulnerabilities.

Approved by: so
Security: FreeBSD-SA-23:03.openssl
Security: CVE-2023-0286
Security: CVE-2023-0215
Security: CVE-2022-4450
Security: CVE-2022-4304

Add assembly optimized code for OpenSSL on powerpc, powerpc64 and powerpc64le

Summary:
1. https://github.com/openssl/openssl/commit/34ab13b7d8e3e723adb60be8142e38b7c9cd382a
needs to be merged for EL

Add assembly optimized code for OpenSSL on powerpc, powerpc64 and powerpc64le

Summary:
1. https://github.com/openssl/openssl/commit/34ab13b7d8e3e723adb60be8142e38b7c9cd382a
needs to be merged for ELFv2 support on big-endian.
2. crypto/openssl/crypto/ppccap.c needs to be patched.
Same reason as in https://github.com/openssl/openssl/pull/17082.

Approved by: jkim, jhibbits, alfredo (MFC to stable/13)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D33076

(cherry picked from commit 3a60869237b8b315fe66497cf5299ec08b688533)

show more ...

pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Diffe

pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D30081

show more ...

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile support on both Linux and FreeBSD.

Note that TLS 1.3 only supports TX offload.

A new WITH/WITHOUT_OPENSSL_KTLS determines if OpenSSL is built with
KTLS support. It defaults to enabled on amd64 and disabled on all
other architectures.

Sponsored by: Netflix

(cherry picked from commit aa906e2a4957db700d9e6cc60857e1afe1aecc85)

show more ...

Move generated OpenSSL assembly routines into the kernel sources.

Sponsored by: Netflix

Install man5 and man7 for OpenSSL.

Note config.5 and crypto.7 are not installed because we have conflicts.

Requested by: phk
MFC after: 1 month

pkgbase: Put a lot of binaries and lib in FreeBSD-runtime

All of them are needed to be able to boot to single user and be able
to repair a existing FreeBSD installation so put them directly into
Fre

pkgbase: Put a lot of binaries and lib in FreeBSD-runtime

All of them are needed to be able to boot to single user and be able
to repair a existing FreeBSD installation so put them directly into
FreeBSD-runtime.

Reviewed by: bapt, gjb
Differential Revision: https://reviews.freebsd.org/D21503

show more ...

Enable devcryptoeng for OpenSSL.

Since OpenSSL 1.1.1, the good old BSD-specific cryptodev engine has been
deprecated in favor of this new engine. However, this engine is not
throughly tested on Fre

Enable devcryptoeng for OpenSSL.

Since OpenSSL 1.1.1, the good old BSD-specific cryptodev engine has been
deprecated in favor of this new engine. However, this engine is not
throughly tested on FreeBSD because it was originally written for Linux.

http://cryptodev-linux.org/

Also, the author actually meant to enable it by default on BSD platforms but
he failed to do so because there was a bug in the Configure script.

https://github.com/openssl/openssl/pull/7882

Now they found that it was more generic issue.

https://github.com/openssl/openssl/pull/7885

Therefore, we need to enable this engine on head to give it more exposure.

show more ...

Bump base OpenSSL libraries versions to avoid conflict with port's libraries.

Reported by: many
Reviewed by: gjb
Sponsored by: The FreeBSD Foundation
MFC after: 3 hours

libcrypto: have buildinf.h depend on Makefile

So that it will be regenerated after Makefile changes affecting the
file's content - specifically, the OpenSSL 1.1.1 update adds a DATE
macro which did

libcrypto: have buildinf.h depend on Makefile

So that it will be regenerated after Makefile changes affecting the
file's content - specifically, the OpenSSL 1.1.1 update adds a DATE
macro which did not exist previously.

Sponsored by: The FreeBSD Foundation

show more ...

Make it more meta mode friendly.

Fix CLEANFILES.

Connect an assembly file for aarch64 to build.

Add missing ACFLAGS for aarch64.

Add a missing source file for SHA.

Add another include directory for aarch64 and arm.

Connect assembly files for arm to build.

Connect assembly files for aarch64 to build.

Unify opensslconf.h templates.

There is no MD macro in this file any more.

Sort assembly source files for i386.

Connect i386 assembly files to build.

Link libcrypto with pthread.

Remove an obsolete compiler option.

Build libcrypto for amd64.

Add OpenSSL symbol version maps.

Note the files are not automatically generated for now.