From nobody Sun Oct 11 07:22:26 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j2X9t6dfLz6k3cD for ; Sun, 11 Oct 2026 07:22:42 +0000 (UTC) (envelope-from yaneurabeya@gmail.com) Received: from mail-pf1-x436.google.com (mail-pf1-x436.google.com [IPv6:2607:f8b0:4864:20::436]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j2X9s70drz3FLw for ; Sun, 11 Oct 2026 07:22:41 +0000 (UTC) (envelope-from yaneurabeya@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20251104 header.b="pek9+bW/"; spf=pass (mx1.freebsd.org: domain of yaneurabeya@gmail.com designates 2607:f8b0:4864:20::436 as permitted sender) smtp.mailfrom=yaneurabeya@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-pf1-x436.google.com with SMTP id d2e1a72fcca58-8819033dbadso589925b3a.0 for ; Sun, 11 Oct 2026 00:22:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791703359; x=1792308159; darn=freebsd.org; h=references:to:cc:in-reply-to:date:subject:mime-version:content-type :message-id:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Sk9ZuroyU1GkXDYy7Lp+Q431VZR7oihHv7z1Xgd2Id0=; b=pek9+bW/VwKRO8YwUwjr7IzWnaR6MD0Xn2ikz9+t9/Ee+2wvhHeteOf678SMRDSBiX ViPO96pRJo4Cv94NIhp4h28gj8EXI5acW5BE1v8Gi8PSlesKqluQFc3KaJu69ZmxnOD3 KpIH1JPtA/WJhCs3OsXAxG/bYFqm/HH5nl96e1epB3We3BPiU0PplC5dAPA240OY+fIZ 0iTAgD+5Xbw9RlR4jaAqf68nXXeaoRKXaDrCDvUK2BL82TKWblklLxhYvWyEPr4XtTcX b+epkS4q2UF6UW87Erhik/9gRFOV/5vJ1EJGn93xKzeu1s0+mb0m2LdiXG5r1sWimSSA ZAlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791703359; x=1792308159; h=references:to:cc:in-reply-to:date:subject:mime-version:content-type :message-id:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Sk9ZuroyU1GkXDYy7Lp+Q431VZR7oihHv7z1Xgd2Id0=; b=fH19GLmN67OPePx4K7gTQlFSDeXb+nWe+b2t6xEiYWUJ9/LjejPErXDxcDsNuGZRDj RJfUpTEiYfb+Cd3lhwG4e4Zjbs4gTu8xwg6+XxPr7IX8JWVPoaabfm0eveI4BX0z9ZVc rJ8mapjan+4SqVcQfIgRjx3+imJ1l5Uts75bk/Ps7Rw2/02lqCDN/0R7gp1SzgBOswjH Z6dBf91bJHh5B+pEE3+yuDfpGj9WyTxLLL3TuUc3RBAUgmfyXJ1Pm7ehbByg22O2AE/6 sdK9hvVbaUphrR6d8ppaXqzo2pSjA56Xp9u5bKPS4zbtrEmDHZ/vj0yfmhW80kDpSGk4 4OIQ== X-Forwarded-Encrypted: i=1; AKwUvBxu+YN2oF4MFhTi8pvVp8Lq9Z7KyBhUpw/9tx4XWaad+zOzrl+PR1/S34lnAdGbYQWrJRJnmQgmU6dG5EXsMPu9QHje@freebsd.org X-Gm-Message-State: AFq9FYJ7C3ohomWTGcdxansRUHSlcwgQmljqFrScr/2Airjs0F37X483 p0TCc8/Tw4I8HB8giz3+iE9KIt6AZEo2w83BpjuPJIToiyMQjdgIaWL3 X-Gm-Gg: AYBFou1k44T0WxiG55n5/H8uW+GIcGq/ex7xEJlhtvYP3EzEO9HpLPKLxq49LCcj7Nu K/GYiUAdymeHPd+soR7TFNBmYujup+boVgZILri3nbipQcSI0ry1GLRZEyNBKqPlgMl8WsDp1t/ Lq5R9LUHhqBfD8VfjIBJWzK0vo3hHj3ZxmQhuWuAp+eINol8nyFV6UBOSsnQE9j1F9nFkYJ6pyI tMChQSZ7kRuyyOewjrldg0ycCGd/eh33yebjCPlr/KyAqfaYJJCEdn91ZLFKMg/zs+MjvW2OkFz tepb8uq3kuuCAtkEaGu6Ddg6CHpVlottfUxOI1wDqlBOXUB6cWHW/aLSYYY5+fqXVv7cQmkbmXa lrGC9fLKmfNAJ5iBGRROb6itXEwEe2Ct7eli4tWM6mvFuscmjuAgLofzgPDr2Pq54vDRb7ucpmT NLnALNEb+7llt+CMaYiJOwMRdGoMk9Q/q3r15/2P26VuZe228A8K5eiQPtBN2xYx6kdViiuVVp7 ZslOyyDpTwhA2l5UrLg X-Received: by 2002:a05:6a00:2e05:b0:878:34d7:697c with SMTP id d2e1a72fcca58-897c79e2162mr5272104b3a.42.1791703359168; Sun, 11 Oct 2026 00:22:39 -0700 (PDT) Received: from smtpclient.apple ([187.15.153.33]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-897ffffd763sm2508502b3a.1.2026.10.11.00.22.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 11 Oct 2026 00:22:38 -0700 (PDT) From: "Enji Cooper (yaneurabeya)" Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_91B67453-E075-414A-8E33-9684703315EB" List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.700.51.1.3\)) Subject: Re: git: c01c0a27cb82 - main - openssl: make libcrypto export the same symbols as upstream Date: Sun, 11 Oct 2026 00:22:26 -0700 In-Reply-To: <6A686A43-F8C3-4E70-AD36-1F0AF9BA0B8B@freebsd.org> Cc: Robert Clausecker , Konstantin Belousov , src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org To: Gordon Tetlow References: <6ac806da.36b2d.5a40f66f@gitrepo.freebsd.org> <6A686A43-F8C3-4E70-AD36-1F0AF9BA0B8B@freebsd.org> X-Mailer: Apple Mail (2.3864.700.51.1.3) X-Spamd-Bar: / X-Spamd-Result: default: False [-0.50 / 15.00]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; MV_CASE(0.50)[]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20251104]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4864::/56:c]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; ARC_NA(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; MIME_TRACE(0.00)[0:+,1:+,2:~]; TO_DN_SOME(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; RCVD_VIA_SMTP_AUTH(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; FREEMAIL_FROM(0.00)[gmail.com]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::436:from]; MLMMJ_DEST(0.00)[dev-commits-src-all@freebsd.org]; RCPT_COUNT_FIVE(0.00)[6]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; PREVIOUSLY_DELIVERED(0.00)[dev-commits-src-all@freebsd.org]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_TLS_LAST(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+] X-Rspamd-Queue-Id: 4j2X9s70drz3FLw --Apple-Mail=_91B67453-E075-414A-8E33-9684703315EB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Oct 10, 2026, at 7:53=E2=80=AFPM, Gordon Tetlow = wrote: >=20 > On 9 Oct 2026, at 16:24, Robert Clausecker wrote: >=20 >> Hi, >>=20 >> On Fri, Oct 09, 2026 at 11:15:56PM +0300, Konstantin Belousov wrote: >>> On Thu, Oct 08, 2026 at 09:10:50PM +0000, Gordon Tetlow wrote: >>>> The branch main has been updated by gordon: >>>>=20 >>>> URL: = https://cgit.FreeBSD.org/src/commit/?id=3Dc01c0a27cb82ca40ed507889c8f78fb2= dcf76568 >>>>=20 >>>> commit c01c0a27cb82ca40ed507889c8f78fb2dcf76568 >>>> Author: Gordon Tetlow >>>> AuthorDate: 2026-10-08 21:10:10 +0000 >>>> Commit: Gordon Tetlow >>>> CommitDate: 2026-10-08 21:10:34 +0000 >>>>=20 >>>> openssl: make libcrypto export the same symbols as upstream >>>>=20 >>>> Make the libcrypto Version.map export the same symbol names as = upstream >>>> 3.5.8 (and 3.5.9, no new symbols were added). >>>>=20 >>>> Remove 52 names that upstream does not export: >>>> - the internal threading and record layer functions = (ossl_crypto_*, >>>> ssl3_cbc_*, tls1_cbc_*), which only libssl used; >>>> - the internal WPACKET_quic_* functions; >>>> - OPENSSL_cpuid_setup; >>>> - ASN.1 item functions that are not in util/libcrypto.num. >>>=20 >>> Removing versioned symbol warrants dso name change, generally. I = did not >>> claim that it is required, but if we are serious about ABI for = openssl >>> libs in base, then it is. >>=20 >> Can we keep the symbols with a legacy ABI version as compat symbols? >=20 > The removed exports were leaked symbols that were internal to = libcrypto. Nothing in the base system used them, and anything in ports = using the ports version of OpenSSL wouldn=E2=80=99t have been able to = use them either. Given that, is there a reason we should carry these = exports forward? (OpenSSL maintainer hat on) I personally don=E2=80=99t think so. If there are libraries using the = internal APIs they should break because they were using undocumented = interfaces. The fact that they were added in the first place was a = mistake. This happens [largely] because we ship our own Version.map = files instead of relying on the ones provided by OpenSSL and juggling = all of the symbols across versions with internal and public APIs gets a = bit unwieldy. I=E2=80=99ve been seriously considering moving to the OpenSSL provided = Version.map files for later versions of OpenSSL so we don=E2=80=99t run = into future problems. We unfortunately can=E2=80=99t do that now for = older interfaces (AFAIK) because we released the libraries with those = older versioned symbols; breaking that now could make in-place upgrades = difficult (to say the least) going to newer major/minor versions of = OpenSSL. This is one of the annoying deviations between the base and = ports versions of OpenSSL that I honestly think should be reduced and/or = eliminated. There *might* be a way to =E2=80=9Cfix=E2=80=9D it using subminor = versioned libraries (we might support that =E2=80=94 need to check), but = I will not be backporting that change to stable branches *ever*. Cheers, -Enji= --Apple-Mail=_91B67453-E075-414A-8E33-9684703315EB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On= Oct 10, 2026, at 7:53=E2=80=AFPM, Gordon Tetlow = <gordon@FreeBSD.org> wrote:

On 9 Oct 2026, at 16:24, Robert Clausecker = wrote:

Hi,

On Fri, Oct 09, 2026 at 11:15:56PM +0300, Konstantin = Belousov wrote:
On Thu, Oct 08, 2026 at = 09:10:50PM +0000, Gordon Tetlow wrote:
The = branch main has been updated by gordon:

URL: = https://cgit.FreeBSD.org/src/commit/?id=3Dc01c0a27cb82ca40ed507889c8f78fb2= dcf76568

commit = c01c0a27cb82ca40ed507889c8f78fb2dcf76568
Author: =     Gordon Tetlow = <gordon@FreeBSD.org>
AuthorDate: 2026-10-08 21:10:10 = +0000
Commit:     Gordon Tetlow = <gordon@FreeBSD.org>
CommitDate: 2026-10-08 21:10:34 = +0000

   openssl: make libcrypto export the same = symbols as upstream

   Make the libcrypto = Version.map export the same symbol names as = upstream
   3.5.8 (and 3.5.9, no new symbols were = added).

   Remove 52 names that upstream does not = export:
   - the internal threading and record layer = functions (ossl_crypto_*,
     ssl3_cbc_*, = tls1_cbc_*), which only libssl used;
   - the internal = WPACKET_quic_* functions;
   - = OPENSSL_cpuid_setup;
   - ASN.1 item functions that = are not in util/libcrypto.num.

Removing versioned = symbol warrants dso name change, generally.  I did not
claim = that it is required, but if we are serious about ABI for openssl
libs = in base, then it is.

Can we keep the symbols with a = legacy ABI version as compat symbols?

The removed exports were leaked symbols = that were internal to libcrypto. Nothing in the base system used them, = and anything in ports using the ports version of OpenSSL wouldn=E2=80=99t = have been able to use them either. Given that, is there a reason we = should carry these exports forward?

(OpenSSL maintainer hat = on)

I personally don=E2=80=99t think so. If there = are libraries using the internal APIs they should break because they = were using undocumented interfaces. The fact that they were added in the = first place was a mistake. This happens [largely] because we ship our = own Version.map files instead of relying on the ones provided by OpenSSL = and juggling all of the symbols across versions with internal and public = APIs gets a bit unwieldy.

I=E2=80=99ve been = seriously considering moving to the OpenSSL provided Version.map files = for later versions of OpenSSL so we don=E2=80=99t run into future = problems. We unfortunately can=E2=80=99t do that now for older = interfaces (AFAIK) because we released the libraries with those older = versioned symbols; breaking that now could make in-place upgrades = difficult (to say the least) going to newer major/minor versions of = OpenSSL. This is one of the annoying deviations between the base and = ports versions of OpenSSL that I honestly think should be reduced and/or = eliminated.

There *might* be a way to =E2=80=9Cfi= x=E2=80=9D it using subminor versioned libraries (we might support that = =E2=80=94 need to check), but I will not be backporting that change to = stable branches = *ever*.

Cheers,
-Enji
= --Apple-Mail=_91B67453-E075-414A-8E33-9684703315EB--