git: df58a8d3cd9e - main - security/zeek: Unbreak build with libressl
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 30 Jun 2026 17:48:40 UTC
The branch main has been updated by leres:
URL: https://cgit.FreeBSD.org/ports/commit/?id=df58a8d3cd9e69f985f7b63eae7172a40721ea9a
commit df58a8d3cd9e69f985f7b63eae7172a40721ea9a
Author: Craig Leres <leres@FreeBSD.org>
AuthorDate: 2026-06-30 17:48:10 +0000
Commit: Craig Leres <leres@FreeBSD.org>
CommitDate: 2026-06-30 17:48:10 +0000
security/zeek: Unbreak build with libressl
Apply upstream fixes for building with libressl:
https://github.com/zeek/zeek/pull/5578
Which includes:
https://github.com/zeek/zeek/commit/8e05b01
https://github.com/zeek/zeek/commit/f38fa4d
Obtained from: Kevin Harrington
Reported by: Kevin Harrington
---
security/zeek/Makefile | 1 +
security/zeek/files/patch-src_OpaqueVal.cc | 12 ++++
security/zeek/files/patch-src_digest.cc | 12 ++++
.../patch-src_file__analysis_analyzer_x509_OCSP.cc | 84 ++++++++++++++++++++++
.../patch-src_file__analysis_analyzer_x509_X509.cc | 12 ++++
.../patch-src_file__analysis_analyzer_x509_X509.h | 20 ++++++
...-src_file__analysis_analyzer_x509_functions.bif | 38 ++++++++++
7 files changed, 179 insertions(+)
diff --git a/security/zeek/Makefile b/security/zeek/Makefile
index a2b964d76e20..9c8b4784a852 100644
--- a/security/zeek/Makefile
+++ b/security/zeek/Makefile
@@ -1,5 +1,6 @@
PORTNAME= zeek
DISTVERSION= 8.0.8
+PORTREVISION= 1
CATEGORIES= security
MASTER_SITES= https://download.zeek.org/
diff --git a/security/zeek/files/patch-src_OpaqueVal.cc b/security/zeek/files/patch-src_OpaqueVal.cc
new file mode 100644
index 000000000000..7ca84c8c482c
--- /dev/null
+++ b/security/zeek/files/patch-src_OpaqueVal.cc
@@ -0,0 +1,12 @@
+--- src/OpaqueVal.cc.orig 2026-05-12 18:14:44 UTC
++++ src/OpaqueVal.cc
+@@ -27,7 +27,8 @@
+ #include "zeek/probabilistic/BloomFilter.h"
+ #include "zeek/probabilistic/CardinalityCounter.h"
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ inline void* EVP_MD_CTX_md_data(const EVP_MD_CTX* ctx) { return ctx->md_data; }
+ #endif
+
diff --git a/security/zeek/files/patch-src_digest.cc b/security/zeek/files/patch-src_digest.cc
new file mode 100644
index 000000000000..f0d7aabeb29d
--- /dev/null
+++ b/security/zeek/files/patch-src_digest.cc
@@ -0,0 +1,12 @@
+--- src/digest.cc.orig 2026-05-12 18:14:44 UTC
++++ src/digest.cc
+@@ -12,7 +12,8 @@
+
+ #include "zeek/Reporter.h"
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ #define EVP_MD_CTX_new EVP_MD_CTX_create
+ #define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc b/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc
new file mode 100644
index 000000000000..1614a4676cf6
--- /dev/null
+++ b/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc
@@ -0,0 +1,84 @@
+--- src/file_analysis/analyzer/x509/OCSP.cc.orig 2026-05-12 18:14:44 UTC
++++ src/file_analysis/analyzer/x509/OCSP.cc
+@@ -26,7 +26,8 @@ static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp
+ static constexpr size_t OCSP_STRING_BUF_SIZE = 2048;
+
+ static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp, BIO* bio) {
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ ASN1_OCTET_STRING* key = nullptr;
+ X509_NAME* name = nullptr;
+
+@@ -353,7 +354,8 @@ void OCSP::ParseRequest(OCSP_REQUEST* req) {
+
+ uint64_t version = 0;
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ if ( req->tbsRequest->version )
+ version = (uint64_t)ASN1_INTEGER_get(req->tbsRequest->version);
+ #else
+@@ -425,7 +427,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ if ( ! basic_resp )
+ goto clean_up;
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ resp_data = basic_resp->tbsResponseData;
+ if ( ! resp_data )
+ goto clean_up;
+@@ -434,7 +437,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ vl.emplace_back(GetFile()->ToVal());
+ vl.emplace_back(std::move(status_val));
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ vl.emplace_back(val_mgr->Count((uint64_t)ASN1_INTEGER_get(resp_data->version)));
+ #else
+ vl.emplace_back(parse_basic_resp_data_version(basic_resp));
+@@ -451,8 +455,9 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ vl.emplace_back(val_mgr->EmptyString());
+ }
+
+- // producedAt
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++// producedAt
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ produced_at = resp_data->producedAt;
+ #else
+ produced_at = OCSP_resp_get0_produced_at(basic_resp);
+@@ -477,7 +482,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ // cert id
+ const OCSP_CERTID* cert_id = nullptr;
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ cert_id = single_resp->certId;
+ #else
+ cert_id = OCSP_SINGLERESP_get0_id(single_resp);
+@@ -550,7 +556,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ }
+ }
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm);
+ len = BIO_read(bio, buf, sizeof(buf));
+ vl.emplace_back(make_intrusive<StringVal>(len, buf));
+@@ -567,7 +574,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
+ certs_vector = new VectorVal(id::find_type<VectorType>("x509_opaque_vector"));
+ vl.emplace_back(AdoptRef{}, certs_vector);
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ certs = basic_resp->certs;
+ #else
+ certs = OCSP_resp_get0_certs(basic_resp);
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc
new file mode 100644
index 000000000000..60a12b4a5441
--- /dev/null
+++ b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc
@@ -0,0 +1,12 @@
+--- src/file_analysis/analyzer/x509/X509.cc.orig 2026-05-12 18:14:44 UTC
++++ src/file_analysis/analyzer/x509/X509.cc
+@@ -349,7 +349,8 @@ void X509::ParseSAN(X509_EXTENSION* ext) {
+ }
+
+ auto len = ASN1_STRING_length(gen->d.ia5);
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+ const char* name = (const char*)ASN1_STRING_data(gen->d.ia5);
+ #else
+ const char* name = (const char*)ASN1_STRING_get0_data(gen->d.ia5);
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h
new file mode 100644
index 000000000000..31fd9a917cdf
--- /dev/null
+++ b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h
@@ -0,0 +1,20 @@
+--- src/file_analysis/analyzer/x509/X509.h.orig 2026-05-12 18:14:44 UTC
++++ src/file_analysis/analyzer/x509/X509.h
+@@ -9,13 +9,15 @@
+ #include "zeek/OpaqueVal.h"
+ #include "zeek/file_analysis/analyzer/x509/X509Common.h"
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+
+ #define X509_get_signature_nid(x) OBJ_obj2nid((x)->sig_alg->algorithm)
+
+ #endif
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x1010000fL ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x1010000fL ) || \
++ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
+
+ #define X509_OBJECT_new() (X509_OBJECT*)malloc(sizeof(X509_OBJECT))
+ #define X509_OBJECT_free(a) free(a)
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif b/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif
new file mode 100644
index 000000000000..aa673887b14b
--- /dev/null
+++ b/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif
@@ -0,0 +1,38 @@
+--- src/file_analysis/analyzer/x509/functions.bif.orig 2026-05-12 18:14:44 UTC
++++ src/file_analysis/analyzer/x509/functions.bif
+@@ -65,7 +65,7 @@ X509* x509_get_ocsp_signer(const STACK_OF(X509)* certs
+ const ASN1_OCTET_STRING* key = nullptr;
+ const X509_NAME* name = nullptr;
+
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
+ OCSP_RESPID* resp_id = basic_resp->tbsResponseData->responderId;
+
+ if ( resp_id->type == V_OCSP_RESPID_NAME )
+@@ -359,7 +359,7 @@ function x509_ocsp_verify%(certs: x509_opaque_vector,
+
+ // Because we actually want to be able to give nice error messages that show why we were
+ // not able to verify the OCSP response - do our own verification logic first.
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
+ signer = x509_get_ocsp_signer(basic->certs, basic);
+ #else
+ signer = x509_get_ocsp_signer(OCSP_resp_get0_certs(basic), basic);
+@@ -730,7 +730,7 @@ function sct_verify%(cert: opaque of x509, logid: stri
+ uint32_t cert_length;
+ if ( precert )
+ {
+-#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
+ x->cert_info->enc.modified = 1;
+ cert_length = i2d_X509_CINF(x->cert_info, &cert_out);
+ #else
+@@ -1058,7 +1058,7 @@ function x509_check_cert_hostname%(cert_opaque: opaque
+ continue;
+
+ std::size_t len = ASN1_STRING_length(gen->d.ia5);
+-#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
++#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
+ auto* name = reinterpret_cast<const char*>(ASN1_STRING_data(gen->d.ia5));
+ #else
+ auto* name = reinterpret_cast<const char*>(ASN1_STRING_get0_data(gen->d.ia5));