git: ba9a5169d165 - main - openssl: build libcrypto and libssl from upstream's source set
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 08 Oct 2026 18:27:30 UTC
The branch main has been updated by gordon:
URL: https://cgit.FreeBSD.org/src/commit/?id=ba9a5169d16556d682d03989e15574ed346db092
commit ba9a5169d16556d682d03989e15574ed346db092
Author: Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2026-10-08 18:25:57 +0000
Commit: Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2026-10-08 18:25:57 +0000
openssl: build libcrypto and libssl from upstream's source set
Compared the bmake source lists of libcrypto and libssl with upstream's
own build of 3.5.8 (configured with the options in
crypto/openssl/BSDmakefile), and fix the differences that are not
intentional.
libcrypto:
- aarch64: build bsaes-armv8.S and md5-aarch64.S, and define BSAES_ASM
and MD5_ASM, as upstream does. Both files have been generated into
sys/crypto/openssl/aarch64 since the 3.5.1 import, but were never
compiled.
- Stop compiling der_digests_gen.c, der_dsa_key.c and der_ec_key.c.
Upstream keeps them in libcommon.a, but the linker does not extract
them into libcrypto (checked with --why-extract) as nothing in
libcrypto references them.
libssl:
- Fix the "SRSC" typo that left out ssl3_cbc.c and tls_pad.c.
- Build libssl's own copy of crypto/thread/arch*.c, as upstream does.
Before this change, libssl got these functions from libcrypto, which
exports them only for this purpose. A planned later change removes
those exports.
crypto/openssl:
- crypto/bio/bio_sock2.c: remove the local ktls_enable() call in
BIO_socket() it does nothing on FreeBSD. The file is now identical
to upstream.
- Remove the empty file "patch", committed by mistake in f775385affef.
With this change, libssl no longer imports any libcrypto internals.
Reviewed by: ngie, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60395
---
crypto/openssl/crypto/bio/bio_sock2.c | 11 -----------
crypto/openssl/patch | 0
secure/lib/libcrypto/Makefile | 13 ++++++++-----
secure/lib/libcrypto/Makefile.common | 3 ++-
secure/lib/libssl/Makefile | 9 +++++++--
5 files changed, 17 insertions(+), 19 deletions(-)
diff --git a/crypto/openssl/crypto/bio/bio_sock2.c b/crypto/openssl/crypto/bio/bio_sock2.c
index 3fb7d26e0d22..a9face301a32 100644
--- a/crypto/openssl/crypto/bio/bio_sock2.c
+++ b/crypto/openssl/crypto/bio/bio_sock2.c
@@ -53,17 +53,6 @@ int BIO_socket(int domain, int socktype, int protocol, int options)
ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
return INVALID_SOCKET;
}
-# ifndef OPENSSL_NO_KTLS
- {
- /*
- * The new socket is created successfully regardless of ktls_enable.
- * ktls_enable doesn't change any functionality of the socket, except
- * changing the setsockopt to enable the processing of ktls_start.
- * Thus, it is not a problem to call it for non-TLS sockets.
- */
- ktls_enable(sock);
- }
-# endif
return sock;
}
diff --git a/crypto/openssl/patch b/crypto/openssl/patch
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile
index 8ce657dd3f00..b4e183efec73 100644
--- a/secure/lib/libcrypto/Makefile
+++ b/secure/lib/libcrypto/Makefile
@@ -58,7 +58,7 @@ SRCS+= mem_clr.c
# aes
SRCS+= aes_cfb.c aes_ecb.c aes_ige.c aes_misc.c aes_ofb.c aes_wrap.c
.if defined(ASM_aarch64)
-SRCS+= aes_cbc.c aes_core.c aesv8-armx.S vpaes-armv8.S
+SRCS+= aes_cbc.c aes_core.c aesv8-armx.S bsaes-armv8.S vpaes-armv8.S
ACFLAGS.aesv8-armx.S= -march=armv8-a+crypto
.elif defined(ASM_amd64)
SRCS+= aes-x86_64.S aesni-mb-x86_64.S aesni-sha1-x86_64.S aesni-sha256-x86_64.S
@@ -314,7 +314,9 @@ SRCS+= md4_dgst.c md4_one.c
# md5
SRCS+= md5_dgst.c md5_one.c md5_sha1.c
-.if defined(ASM_amd64)
+.if defined(ASM_aarch64)
+SRCS+= md5-aarch64.S
+.elif defined(ASM_amd64)
SRCS+= md5-x86_64.S
.elif defined(ASM_i386)
SRCS+= md5-586.S
@@ -399,13 +401,14 @@ SRCS+= provider_seeding.c provider_util.c securitycheck.c
SRCS+= securitycheck_default.c
# providers/common/der
+# der_digests_gen.c, der_dsa_key.c and der_ec_key.c are not listed: nothing in
+# libcrypto references them, and upstream's linker drops them from libcommon.a.
SRCS+= der_rsa_gen.c der_rsa_key.c der_rsa_sig.c
-SRCS+= der_digests_gen.c
SRCS+= der_ml_dsa_gen.c der_ml_dsa_key.c
SRCS+= der_wrap_gen.c
SRCS+= der_slh_dsa_gen.c der_slh_dsa_key.c
-SRCS+= der_dsa_gen.c der_dsa_key.c der_dsa_sig.c
-SRCS+= der_ec_gen.c der_ec_key.c der_ec_sig.c
+SRCS+= der_dsa_gen.c der_dsa_sig.c
+SRCS+= der_ec_gen.c der_ec_sig.c
SRCS+= der_ecx_gen.c der_ecx_key.c
# providers/implementations/asymciphers
diff --git a/secure/lib/libcrypto/Makefile.common b/secure/lib/libcrypto/Makefile.common
index ad48e2b434cf..bc5142685f8f 100644
--- a/secure/lib/libcrypto/Makefile.common
+++ b/secure/lib/libcrypto/Makefile.common
@@ -22,7 +22,8 @@ CFLAGS+= -DOPENSSL_CPUID_OBJ
CFLAGS+= -DOPENSSL_BN_ASM_MONT
CFLAGS+= -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM
CFLAGS+= -DKECCAK1600_ASM
-CFLAGS+= -DVPAES_ASM
+CFLAGS+= -DMD5_ASM
+CFLAGS+= -DBSAES_ASM -DVPAES_ASM
CFLAGS+= -DECP_NISTZ256_ASM
CFLAGS+= -DPOLY1305_ASM
.elif defined(ASM_amd64)
diff --git a/secure/lib/libssl/Makefile b/secure/lib/libssl/Makefile
index 1a80e8964fdf..bb5eedc4f6ab 100644
--- a/secure/lib/libssl/Makefile
+++ b/secure/lib/libssl/Makefile
@@ -33,6 +33,9 @@ SRCS+= priority_queue.c
SRCS+= hashfunc.c
SRCS+= siphash.c
+# crypto/thread: libssl has its own copy, as upstream does
+SRCS+= arch.c thread_none.c thread_posix.c thread_win.c
+
# quic
SRCS+= quic_method.c quic_impl.c quic_wire.c quic_ackm.c quic_statm.c
SRCS+= cc_newreno.c quic_demux.c quic_record_rx.c
@@ -67,8 +70,8 @@ SRCS+= rec_layer_d1.c rec_layer_s3.c
# record/methods
SRCS+= tls_common.c ssl3_meth.c tls1_meth.c tls13_meth.c tlsany_meth.c
SRCS+= dtls_meth.c tls_multib.c
-SRSC+= ssl3_cbc.c
-SRSC+= tls_pad.c
+SRCS+= ssl3_cbc.c
+SRCS+= tls_pad.c
# rio
SRCS+= poll_immediate.c
@@ -93,6 +96,8 @@ PICFLAG+= -DOPENSSL_PIC
${LCRYPTO_SRC}/crypto/hashtable \
${LCRYPTO_SRC}/crypto/rbtree \
${LCRYPTO_SRC}/crypto/siphash \
+ ${LCRYPTO_SRC}/crypto/thread \
+ ${LCRYPTO_SRC}/crypto/thread/arch \
${LCRYPTO_SRC}/ssl \
${LCRYPTO_SRC}/ssl/quic \
${LCRYPTO_SRC}/ssl/record \