pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Diffe

pkgbase: Put openssl in its own package

This is useful for upgrade and also to make tiny jail so they won't
depend on FreeBSD-utilities (where openssl was packaged before).

MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D30081

show more ...

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile

OpenSSL: Support for kernel TLS offload (KTLS)

This merges upstream patches from OpenSSL's master branch to add
KTLS infrastructure for TLS 1.0-1.3 including both RX and TX
offload and SSL_sendfile support on both Linux and FreeBSD.

Note that TLS 1.3 only supports TX offload.

A new WITH/WITHOUT_OPENSSL_KTLS determines if OpenSSL is built with
KTLS support. It defaults to enabled on amd64 and disabled on all
other architectures.

Sponsored by: Netflix

(cherry picked from commit aa906e2a4957db700d9e6cc60857e1afe1aecc85)

show more ...

Fix a typo in the cpp macro defined for PIC.

In practice this isn't used in OpenSSL outside of some sparc-specific
code.

Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D260

Fix a typo in the cpp macro defined for PIC.

In practice this isn't used in OpenSSL outside of some sparc-specific
code.

Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D26058

show more ...

Replace OPENSSL_NO_SSL3_METHODs with dummies

SSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); it
should not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should use

Replace OPENSSL_NO_SSL3_METHODs with dummies

SSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); it
should not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should use
it, and if they must, they can use some implementation outside of base.

There are three symbols removed with OPENSSL_NO_SSL3_METHOD:

SSLv3_client_method
SSLv3_method
SSLv3_server_method

These symbols exist to request an explicit SSLv3 connection to a server.
There is no good reason for an application to link or invoke these symbols
instead of TLS_method(), et al (née SSLv23_method, et al). Applications
that do so have broken cryptography.

Define these symbols for some pedantic definition of ABI stability, but
remove the functionality again (r361392) after r362620.

Reviewed by: gordon, jhb (earlier-but-equivalent version both)
Discussed with: bjk, kib
Differential Revision: https://reviews.freebsd.org/D25493

show more ...

Bump base OpenSSL libraries versions to avoid conflict with port's libraries.

Reported by: many
Reviewed by: gjb
Sponsored by: The FreeBSD Foundation
MFC after: 3 hours

Build libssl for amd64.

Add OpenSSL symbol version maps.

Note the files are not automatically generated for now.

Catch up with manual page removal from secure/lib/libssl.

Update shlib version to 9.

Clean up OpenSSL makefiles.

Disable insecure SSLv2 support from the base OpenSSL.

Differential Revision: https://reviews.freebsd.org/D1304

Convert to LIBADD
Reduce overlinking

Merge OpenSSL 0.9.8n from head into stable/8.

Approved by: re (kib)

Bump the version of all non-symbol-versioned shared libraries in
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.

Reviewed b

Bump the version of all non-symbol-versioned shared libraries in
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.

Reviewed by: kib
Approved by: re (rwatson)

show more ...

Upgrade to OpenSSL 0.9.8b.

Revert last revision by phk@, it's redundant since bsd.incs.mk
already handles this, FWIW.

Don't install includes if NO_TOOLCHAIN

Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)

NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE

For variables that are only checked with defined(), don't provide
any fake value.

Record the libssl.so dependency on libcrypto.so. This should
help some ports that depend on libradius that recently gained
the dependency on libssl. This is also how the stock OpenSSL
build would l

Record the libssl.so dependency on libcrypto.so. This should
help some ports that depend on libradius that recently gained
the dependency on libssl. This is also how the stock OpenSSL
build would link libssl.so on FreeBSD.

Prompted by: kris
OK'ed by: markm, nectar

show more ...

Install the OpenSSL man pages in /usr/share/openssl/man
and remove the WANT_OPENSSL_MANPAGES knob.

Re-add WANT_OPENSSL_MANPAGES knob.

Noticed by: ru

Update for OpenSSL 0.9.7. No assembler code at the moment. This
will follow.

Remove myself as maintainer of openssl; I no longer have enough time to
devote to it.