From nobody Fri Oct 23 22:35:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jBHt75ccLz6wbS4 for ; Fri, 23 Oct 2026 22:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jBHt738m2z3GyK for ; Fri, 23 Oct 2026 22:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792794959; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tJ/dgx5zDnkik9OwmcO0aKXNdGRI23c68jERKHzgJpk=; b=SP758a4//YwxSh1ESUQVROHwjZdLka4Ku81SEVcAn2ZfyJWQq3nkFYODEIH9A7bpuWcpKE oJgbC6D9/dEUMJMPgZWjMZrBwdOYrpXYVyiqyHiecDDVpgOOGgR9RaJ1sio4ckrAbtkZCQ 5DJlZmht1pWGoZIRceFtdjGRtxsNlqZKpe/Xp/HfFYZLQwXGbqW0sn2paNpHkcvlOYolRD y89XaGjOaGNCHp6hPDEhiBGLMoqZZBY9AolbJf9fKAxZxKUoYZyYoQ6cYDc0QIfo/s0CyX enM81+Q++eNflc3SycT4ZBKh0ICVEJOuyoZQUdU+RC2HWLWDA2w/KbXbr/bM6g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792794959; b=sgKUd1YqJzs6/NN6g9klkbrLxumzhfXoT1DPVkOY9WN7Aulg5GQ46HLPm70UR+s4/xFac0 FQ8Waz626A6VjI0jmdOFQJ5syw62LFRr+Cb6DipllJvco6alaGOHt4VRF0Mp8D/1r94Zmb QcNVTzYNoMPTnj1J3zk3g3W0d+tbG5g+u6yP+vjtBgpVZM2vBQoIaDdBSu3MvZL/V2uVr1 gJMpfvduscyzFVtAr7MG1aefkeq1FuTss4c3T2TH2wKo0WtQhd0GdO/OG0AFSz5/Wjd0zj 70L5Ct4HZ2DH9+IxovzGzuvfvCGShHlNJYqnjfUufImf8AeTMbbo8UJPlSR/9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792794959; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tJ/dgx5zDnkik9OwmcO0aKXNdGRI23c68jERKHzgJpk=; b=k+Y4ME8rY9LJ532yv2Trvhw4MjTNGfBtQFryBnvqyC1B5Z6g2sNaEVcwf8SxPPWeCAxqir Lh/aLLoU1RQIllwF8QgtA49lsmrn6x0DuxMIefb3IvNQ9xqaqeUuiSnvgrgWgjJjrOBf7P 1YziPPGn+AnWOXLqHRf0YYc95QPmzyFbkW3mvOoc+jy3Y7P2cMY1M3iNs/34P29tMz977q PzhPojgfJW6rKvX+c/Z/As7ZH9oebwYGOrEzPM/pd/2B/rCaygsk/uLcp0PhtLxrWZs56x Ae2BJKWmeNjHtkTkBLlYvn87Fzs713ZSDPUoRGWoTqNq+TY4h49OvaUujac/eQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jBHt72ZjTzqml for ; Fri, 23 Oct 2026 22:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 423ea by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 23 Oct 2026 22:35:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: 020adbc68c69 - stable/15 - openssl: build libcrypto and libssl from upstream's source set List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 020adbc68c69a1934243665e14e2441d1ee71caa Auto-Submitted: auto-generated Date: Fri, 23 Oct 2026 22:35:59 +0000 Message-Id: <6adbe14f.423ea.3ed363a7@gitrepo.freebsd.org> The branch stable/15 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=020adbc68c69a1934243665e14e2441d1ee71caa commit 020adbc68c69a1934243665e14e2441d1ee71caa Author: Gordon Tetlow AuthorDate: 2026-10-08 18:25:57 +0000 Commit: Gordon Tetlow CommitDate: 2026-10-23 22:34:54 +0000 openssl: build libcrypto and libssl from upstream's source set Compared the bmake source lists of libcrypto and libssl with upstream's own build of 3.5.8 (configured with the options in crypto/openssl/BSDmakefile), and fix the differences that are not intentional. libcrypto: - aarch64: build bsaes-armv8.S and md5-aarch64.S, and define BSAES_ASM and MD5_ASM, as upstream does. Both files have been generated into sys/crypto/openssl/aarch64 since the 3.5.1 import, but were never compiled. - Stop compiling der_digests_gen.c, der_dsa_key.c and der_ec_key.c. Upstream keeps them in libcommon.a, but the linker does not extract them into libcrypto (checked with --why-extract) as nothing in libcrypto references them. libssl: - Fix the "SRSC" typo that left out ssl3_cbc.c and tls_pad.c. - Build libssl's own copy of crypto/thread/arch*.c, as upstream does. Before this change, libssl got these functions from libcrypto, which exports them only for this purpose. A planned later change removes those exports. crypto/openssl: - crypto/bio/bio_sock2.c: remove the local ktls_enable() call in BIO_socket() it does nothing on FreeBSD. The file is now identical to upstream. - Remove the empty file "patch", committed by mistake in f775385affef. With this change, libssl no longer imports any libcrypto internals. Reviewed by: ngie, markj Differential Revision: https://reviews.freebsd.org/D60395 (cherry picked from commit ba9a5169d16556d682d03989e15574ed346db092) --- crypto/openssl/crypto/bio/bio_sock2.c | 11 ----------- crypto/openssl/patch | 0 secure/lib/libcrypto/Makefile | 13 ++++++++----- secure/lib/libcrypto/Makefile.common | 3 ++- secure/lib/libssl/Makefile | 9 +++++++-- 5 files changed, 17 insertions(+), 19 deletions(-) diff --git a/crypto/openssl/crypto/bio/bio_sock2.c b/crypto/openssl/crypto/bio/bio_sock2.c index 3fb7d26e0d22..a9face301a32 100644 --- a/crypto/openssl/crypto/bio/bio_sock2.c +++ b/crypto/openssl/crypto/bio/bio_sock2.c @@ -53,17 +53,6 @@ int BIO_socket(int domain, int socktype, int protocol, int options) ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET); return INVALID_SOCKET; } -# ifndef OPENSSL_NO_KTLS - { - /* - * The new socket is created successfully regardless of ktls_enable. - * ktls_enable doesn't change any functionality of the socket, except - * changing the setsockopt to enable the processing of ktls_start. - * Thus, it is not a problem to call it for non-TLS sockets. - */ - ktls_enable(sock); - } -# endif return sock; } diff --git a/crypto/openssl/patch b/crypto/openssl/patch deleted file mode 100644 index e69de29bb2d1..000000000000 diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile index 8ce657dd3f00..b4e183efec73 100644 --- a/secure/lib/libcrypto/Makefile +++ b/secure/lib/libcrypto/Makefile @@ -58,7 +58,7 @@ SRCS+= mem_clr.c # aes SRCS+= aes_cfb.c aes_ecb.c aes_ige.c aes_misc.c aes_ofb.c aes_wrap.c .if defined(ASM_aarch64) -SRCS+= aes_cbc.c aes_core.c aesv8-armx.S vpaes-armv8.S +SRCS+= aes_cbc.c aes_core.c aesv8-armx.S bsaes-armv8.S vpaes-armv8.S ACFLAGS.aesv8-armx.S= -march=armv8-a+crypto .elif defined(ASM_amd64) SRCS+= aes-x86_64.S aesni-mb-x86_64.S aesni-sha1-x86_64.S aesni-sha256-x86_64.S @@ -314,7 +314,9 @@ SRCS+= md4_dgst.c md4_one.c # md5 SRCS+= md5_dgst.c md5_one.c md5_sha1.c -.if defined(ASM_amd64) +.if defined(ASM_aarch64) +SRCS+= md5-aarch64.S +.elif defined(ASM_amd64) SRCS+= md5-x86_64.S .elif defined(ASM_i386) SRCS+= md5-586.S @@ -399,13 +401,14 @@ SRCS+= provider_seeding.c provider_util.c securitycheck.c SRCS+= securitycheck_default.c # providers/common/der +# der_digests_gen.c, der_dsa_key.c and der_ec_key.c are not listed: nothing in +# libcrypto references them, and upstream's linker drops them from libcommon.a. SRCS+= der_rsa_gen.c der_rsa_key.c der_rsa_sig.c -SRCS+= der_digests_gen.c SRCS+= der_ml_dsa_gen.c der_ml_dsa_key.c SRCS+= der_wrap_gen.c SRCS+= der_slh_dsa_gen.c der_slh_dsa_key.c -SRCS+= der_dsa_gen.c der_dsa_key.c der_dsa_sig.c -SRCS+= der_ec_gen.c der_ec_key.c der_ec_sig.c +SRCS+= der_dsa_gen.c der_dsa_sig.c +SRCS+= der_ec_gen.c der_ec_sig.c SRCS+= der_ecx_gen.c der_ecx_key.c # providers/implementations/asymciphers diff --git a/secure/lib/libcrypto/Makefile.common b/secure/lib/libcrypto/Makefile.common index ad48e2b434cf..bc5142685f8f 100644 --- a/secure/lib/libcrypto/Makefile.common +++ b/secure/lib/libcrypto/Makefile.common @@ -22,7 +22,8 @@ CFLAGS+= -DOPENSSL_CPUID_OBJ CFLAGS+= -DOPENSSL_BN_ASM_MONT CFLAGS+= -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM CFLAGS+= -DKECCAK1600_ASM -CFLAGS+= -DVPAES_ASM +CFLAGS+= -DMD5_ASM +CFLAGS+= -DBSAES_ASM -DVPAES_ASM CFLAGS+= -DECP_NISTZ256_ASM CFLAGS+= -DPOLY1305_ASM .elif defined(ASM_amd64) diff --git a/secure/lib/libssl/Makefile b/secure/lib/libssl/Makefile index 1a80e8964fdf..bb5eedc4f6ab 100644 --- a/secure/lib/libssl/Makefile +++ b/secure/lib/libssl/Makefile @@ -33,6 +33,9 @@ SRCS+= priority_queue.c SRCS+= hashfunc.c SRCS+= siphash.c +# crypto/thread: libssl has its own copy, as upstream does +SRCS+= arch.c thread_none.c thread_posix.c thread_win.c + # quic SRCS+= quic_method.c quic_impl.c quic_wire.c quic_ackm.c quic_statm.c SRCS+= cc_newreno.c quic_demux.c quic_record_rx.c @@ -67,8 +70,8 @@ SRCS+= rec_layer_d1.c rec_layer_s3.c # record/methods SRCS+= tls_common.c ssl3_meth.c tls1_meth.c tls13_meth.c tlsany_meth.c SRCS+= dtls_meth.c tls_multib.c -SRSC+= ssl3_cbc.c -SRSC+= tls_pad.c +SRCS+= ssl3_cbc.c +SRCS+= tls_pad.c # rio SRCS+= poll_immediate.c @@ -93,6 +96,8 @@ PICFLAG+= -DOPENSSL_PIC ${LCRYPTO_SRC}/crypto/hashtable \ ${LCRYPTO_SRC}/crypto/rbtree \ ${LCRYPTO_SRC}/crypto/siphash \ + ${LCRYPTO_SRC}/crypto/thread \ + ${LCRYPTO_SRC}/crypto/thread/arch \ ${LCRYPTO_SRC}/ssl \ ${LCRYPTO_SRC}/ssl/quic \ ${LCRYPTO_SRC}/ssl/record \