Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
pkgbase: reorganise caroot and openssl packagesThis splits out the certctl utility into a new certctl package and theopenssl libs into an openssl-lib package.PR: 272816Reviewed by: manuDiffer
pkgbase: reorganise caroot and openssl packagesThis splits out the certctl utility into a new certctl package and theopenssl libs into an openssl-lib package.PR: 272816Reviewed by: manuDifferential Revision: https://reviews.freebsd.org/D41321
show more ...
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been u
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been updated for a seamless switchto OpenSSL 3.0. For many components we've added`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,which avoids deprecation warnings from OpenSSL 3.0. Changes have alsobeen made to avoid OpenSSL APIs that were already deprecated in OpenSSL1.1.1. The process of updating to contemporary APIs can continue afterthis merge.Additional changes are still required for libarchive and Kerberos-related libraries or tools; workarounds will immediately follow thiscommit. Fixes are in progress in the upstream projects and will beincorporated when those are next updated.There are some performance regressions in benchmarks (certain tests in`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).Investigation will continue for these.Netflix's testing showed no functional regression and a rather small,albeit statistically significant, increase in CPU consumption withOpenSSL 3.0.Thanks to ngie@ and des@ for updating base system components, toantoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and toNetflix and everyone who tested prior to commit or contributed to thisupdate in other ways.PR: 271615PR: 271656 [exp-run]Relnotes: YesSponsored by: The FreeBSD Foundation
openssl: install pc filesmost programs in ports are looking for .pc files in order to get thenecessary information on how to compile and link against openssl.The ports now also has a way to hide
openssl: install pc filesmost programs in ports are looking for .pc files in order to get thenecessary information on how to compile and link against openssl.The ports now also has a way to hide or force a path for pkgconf.Providing .pc files along with openssl in base will allow (once allthe supported version of FreeBSD has it) so improve the framework todeal with openssl in base vs openssl in ports (and libressl)This will also greatly reduce the number of patches necessary toworkaround the build systems which only knows how to detect whereopenssl is installed via pkgconf.PR: 266051MFC After: 3 weeksReviewed by: jkim, delphijExp-run by: antoineDifferential Revision: https://reviews.freebsd.org/D36360
libcrypto: Add symbol versions for symbols added since 1.1.1d.While here, trim a spurious local: I missed when added SSL_sendfile.PR: 255277Reported by: yuriReviewed by: jkimMFC after: 1 week
libcrypto: Add symbol versions for symbols added since 1.1.1d.While here, trim a spurious local: I missed when added SSL_sendfile.PR: 255277Reported by: yuriReviewed by: jkimMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D30483
pkgbase: Put openssl in its own packageThis is useful for upgrade and also to make tiny jail so they won'tdepend on FreeBSD-utilities (where openssl was packaged before).MFC after: 1 monthDiffe
pkgbase: Put openssl in its own packageThis is useful for upgrade and also to make tiny jail so they won'tdepend on FreeBSD-utilities (where openssl was packaged before).MFC after: 1 monthDifferential Revision: https://reviews.freebsd.org/D30081
OpenSSL: Support for kernel TLS offload (KTLS)This merges upstream patches from OpenSSL's master branch to addKTLS infrastructure for TLS 1.0-1.3 including both RX and TXoffload and SSL_sendfile
OpenSSL: Support for kernel TLS offload (KTLS)This merges upstream patches from OpenSSL's master branch to addKTLS infrastructure for TLS 1.0-1.3 including both RX and TXoffload and SSL_sendfile support on both Linux and FreeBSD.Note that TLS 1.3 only supports TX offload.A new WITH/WITHOUT_OPENSSL_KTLS determines if OpenSSL is built withKTLS support. It defaults to enabled on amd64 and disabled on allother architectures.Reviewed by: jkim (earlier version)Approved by: secteamObtained from: OpenSSL (patches from master)MFC after: 1 weekRelnotes: yesSponsored by: NetflixDifferential Revision: https://reviews.freebsd.org/D28273
Fix a typo in the cpp macro defined for PIC.In practice this isn't used in OpenSSL outside of some sparc-specificcode.Reviewed by: delphijDifferential Revision: https://reviews.freebsd.org/D260
Fix a typo in the cpp macro defined for PIC.In practice this isn't used in OpenSSL outside of some sparc-specificcode.Reviewed by: delphijDifferential Revision: https://reviews.freebsd.org/D26058
Replace OPENSSL_NO_SSL3_METHODs with dummiesSSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); itshould not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should use
Replace OPENSSL_NO_SSL3_METHODs with dummiesSSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); itshould not have shipped in FreeBSD 11 (2016) or 12 (2018). No one should useit, and if they must, they can use some implementation outside of base.There are three symbols removed with OPENSSL_NO_SSL3_METHOD:SSLv3_client_methodSSLv3_methodSSLv3_server_methodThese symbols exist to request an explicit SSLv3 connection to a server.There is no good reason for an application to link or invoke these symbolsinstead of TLS_method(), et al (née SSLv23_method, et al). Applicationsthat do so have broken cryptography.Define these symbols for some pedantic definition of ABI stability, butremove the functionality again (r361392) after r362620.Reviewed by: gordon, jhb (earlier-but-equivalent version both)Discussed with: bjk, kibDifferential Revision: https://reviews.freebsd.org/D25493
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDi
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D22494
Merge OpenSSL 1.1.1a.
Bump base OpenSSL libraries versions to avoid conflict with port's libraries.Reported by: manyReviewed by: gjbSponsored by: The FreeBSD FoundationMFC after: 3 hours
Remove MD dirdeps from Makefile.depend.It can't be right. :-(
Regen Makefile.depend.
Build libssl for amd64.
Add OpenSSL symbol version maps.Note the files are not automatically generated for now.
Catch up with manual page removal from secure/lib/libssl.
Regen manual pages.Note the manual pages are not automatically generated for now.
Update shlib version to 9.
Merge OpenSSL 1.0.2p.
Merge OpenSSL 1.0.2o.
Merge OpenSSL 1.0.2n.
Merge OpenSSL 1.0.2m.
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
Merge OpenSSL 1.0.2l.
1234