From nobody Thu Oct 08 18:27:30 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j0z4M22GDz6w3P4 for ; Thu, 08 Oct 2026 18:27:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j0z4M0km4z4JMh for ; Thu, 08 Oct 2026 18:27:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791484051; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Pl3w8sITMw/StfGeYJPAtUxtO6X+0BQXLBFzkY5ELUk=; b=Yz68C/yhi84EyNZLIDTQdBhLf5CPnTApvXPMIH/k51cfs2HX6XDJ5YVWZFWfzIYJRsuJZZ PkV8rYZaW4fdrNUplbXdNOfTqQxnHm59WelXj92YYtHtwVEiodjX8DOWTHIrH4VI7rPwdO BLKcqulo/SsY5delxf7p8Qaav7A2QnP6NJOF29gLwX/7hYUcO+L7NqBFxaFBGgzntgwkcU HKMSsd8xfpubLdVNExODq45nvYbKrLuZj6o9FD/+cMuFrS0flIBg9WrzXP4Q+tglpPt1gY TxII/B4UdTyY6F/N+9v8BFPv6GNl+mHRl7dZIvSFpoEdJO4utN7TP22WmuXZkA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791484051; b=FQt6jx3TJpLLyZ8N9rsmqfTT6a4m0RTmp4yNG3RIilfyli5vDtJ61UQ3jeXFHVuYgU4n7G nZltuRzuRBfBqSGYFngrNUBLw6CKf3sYqlWq1oL1s3nV8ebxDSQy8TDNBM/iIJBA8bKTP7 gkn5Io+AvkDlgbNheC1aDW3PvHzD+zFrVXQiYCSGKN19mMxPpm0aeJ7HM86b2uy3Mzddkq 1Ip86UWT4v6NgPcIDOUiG0nmEUfRQr5FHsPs/IdGjleW+urjh4uNHNkBqQAjkaphoo1x4U uBJp7dMq9lMW4rthCvP0pUQQkQAjt+++CgtzerJBcBxFLWYHzxIPe9VtGuJR1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791484051; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Pl3w8sITMw/StfGeYJPAtUxtO6X+0BQXLBFzkY5ELUk=; b=B/Y2HM1Dua0gDDraAdLJBoamdAm3rRCBd6SVgcBBhapZVG5OheAgQ1+bUxcxdyR4mG9iI9 Gt0fW/4eYrgqLjaorcz6UgyGOTZfnjV8j/ydwTFXw+1QuOijPwhnYPi67FZx7FyMEF+qQG +yXDiGWPmGNtmm2HcpVVBLVQ7E6d7Th4K10awOm74iTIJtFbb+vsJwfvCRjQi0JHHap3s1 +X0nb8OJ5yZokj9Cv2Hw9hOzgj5HdyOa8CKTV4dbDuzs46vDBZl7mUWrxZ9+4zN2r2sagm pE6NZ/TIpkSZCT11rIX0IsU0D91Ly1I8RkZ/VlMLgg1ac7QrhYEKoljBvifqAw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j0z4L6ttJzr6q for ; Thu, 08 Oct 2026 18:27:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1c419 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 08 Oct 2026 18:27:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gordon Tetlow Subject: git: ba9a5169d165 - main - openssl: build libcrypto and libssl from upstream's source set List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ba9a5169d16556d682d03989e15574ed346db092 Auto-Submitted: auto-generated Date: Thu, 08 Oct 2026 18:27:30 +0000 Message-Id: <6ac7e092.1c419.32a759b1@gitrepo.freebsd.org> The branch main has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=ba9a5169d16556d682d03989e15574ed346db092 commit ba9a5169d16556d682d03989e15574ed346db092 Author: Gordon Tetlow AuthorDate: 2026-10-08 18:25:57 +0000 Commit: Gordon Tetlow CommitDate: 2026-10-08 18:25:57 +0000 openssl: build libcrypto and libssl from upstream's source set Compared the bmake source lists of libcrypto and libssl with upstream's own build of 3.5.8 (configured with the options in crypto/openssl/BSDmakefile), and fix the differences that are not intentional. libcrypto: - aarch64: build bsaes-armv8.S and md5-aarch64.S, and define BSAES_ASM and MD5_ASM, as upstream does. Both files have been generated into sys/crypto/openssl/aarch64 since the 3.5.1 import, but were never compiled. - Stop compiling der_digests_gen.c, der_dsa_key.c and der_ec_key.c. Upstream keeps them in libcommon.a, but the linker does not extract them into libcrypto (checked with --why-extract) as nothing in libcrypto references them. libssl: - Fix the "SRSC" typo that left out ssl3_cbc.c and tls_pad.c. - Build libssl's own copy of crypto/thread/arch*.c, as upstream does. Before this change, libssl got these functions from libcrypto, which exports them only for this purpose. A planned later change removes those exports. crypto/openssl: - crypto/bio/bio_sock2.c: remove the local ktls_enable() call in BIO_socket() it does nothing on FreeBSD. The file is now identical to upstream. - Remove the empty file "patch", committed by mistake in f775385affef. With this change, libssl no longer imports any libcrypto internals. Reviewed by: ngie, markj MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D60395 --- crypto/openssl/crypto/bio/bio_sock2.c | 11 ----------- crypto/openssl/patch | 0 secure/lib/libcrypto/Makefile | 13 ++++++++----- secure/lib/libcrypto/Makefile.common | 3 ++- secure/lib/libssl/Makefile | 9 +++++++-- 5 files changed, 17 insertions(+), 19 deletions(-) diff --git a/crypto/openssl/crypto/bio/bio_sock2.c b/crypto/openssl/crypto/bio/bio_sock2.c index 3fb7d26e0d22..a9face301a32 100644 --- a/crypto/openssl/crypto/bio/bio_sock2.c +++ b/crypto/openssl/crypto/bio/bio_sock2.c @@ -53,17 +53,6 @@ int BIO_socket(int domain, int socktype, int protocol, int options) ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET); return INVALID_SOCKET; } -# ifndef OPENSSL_NO_KTLS - { - /* - * The new socket is created successfully regardless of ktls_enable. - * ktls_enable doesn't change any functionality of the socket, except - * changing the setsockopt to enable the processing of ktls_start. - * Thus, it is not a problem to call it for non-TLS sockets. - */ - ktls_enable(sock); - } -# endif return sock; } diff --git a/crypto/openssl/patch b/crypto/openssl/patch deleted file mode 100644 index e69de29bb2d1..000000000000 diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile index 8ce657dd3f00..b4e183efec73 100644 --- a/secure/lib/libcrypto/Makefile +++ b/secure/lib/libcrypto/Makefile @@ -58,7 +58,7 @@ SRCS+= mem_clr.c # aes SRCS+= aes_cfb.c aes_ecb.c aes_ige.c aes_misc.c aes_ofb.c aes_wrap.c .if defined(ASM_aarch64) -SRCS+= aes_cbc.c aes_core.c aesv8-armx.S vpaes-armv8.S +SRCS+= aes_cbc.c aes_core.c aesv8-armx.S bsaes-armv8.S vpaes-armv8.S ACFLAGS.aesv8-armx.S= -march=armv8-a+crypto .elif defined(ASM_amd64) SRCS+= aes-x86_64.S aesni-mb-x86_64.S aesni-sha1-x86_64.S aesni-sha256-x86_64.S @@ -314,7 +314,9 @@ SRCS+= md4_dgst.c md4_one.c # md5 SRCS+= md5_dgst.c md5_one.c md5_sha1.c -.if defined(ASM_amd64) +.if defined(ASM_aarch64) +SRCS+= md5-aarch64.S +.elif defined(ASM_amd64) SRCS+= md5-x86_64.S .elif defined(ASM_i386) SRCS+= md5-586.S @@ -399,13 +401,14 @@ SRCS+= provider_seeding.c provider_util.c securitycheck.c SRCS+= securitycheck_default.c # providers/common/der +# der_digests_gen.c, der_dsa_key.c and der_ec_key.c are not listed: nothing in +# libcrypto references them, and upstream's linker drops them from libcommon.a. SRCS+= der_rsa_gen.c der_rsa_key.c der_rsa_sig.c -SRCS+= der_digests_gen.c SRCS+= der_ml_dsa_gen.c der_ml_dsa_key.c SRCS+= der_wrap_gen.c SRCS+= der_slh_dsa_gen.c der_slh_dsa_key.c -SRCS+= der_dsa_gen.c der_dsa_key.c der_dsa_sig.c -SRCS+= der_ec_gen.c der_ec_key.c der_ec_sig.c +SRCS+= der_dsa_gen.c der_dsa_sig.c +SRCS+= der_ec_gen.c der_ec_sig.c SRCS+= der_ecx_gen.c der_ecx_key.c # providers/implementations/asymciphers diff --git a/secure/lib/libcrypto/Makefile.common b/secure/lib/libcrypto/Makefile.common index ad48e2b434cf..bc5142685f8f 100644 --- a/secure/lib/libcrypto/Makefile.common +++ b/secure/lib/libcrypto/Makefile.common @@ -22,7 +22,8 @@ CFLAGS+= -DOPENSSL_CPUID_OBJ CFLAGS+= -DOPENSSL_BN_ASM_MONT CFLAGS+= -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM CFLAGS+= -DKECCAK1600_ASM -CFLAGS+= -DVPAES_ASM +CFLAGS+= -DMD5_ASM +CFLAGS+= -DBSAES_ASM -DVPAES_ASM CFLAGS+= -DECP_NISTZ256_ASM CFLAGS+= -DPOLY1305_ASM .elif defined(ASM_amd64) diff --git a/secure/lib/libssl/Makefile b/secure/lib/libssl/Makefile index 1a80e8964fdf..bb5eedc4f6ab 100644 --- a/secure/lib/libssl/Makefile +++ b/secure/lib/libssl/Makefile @@ -33,6 +33,9 @@ SRCS+= priority_queue.c SRCS+= hashfunc.c SRCS+= siphash.c +# crypto/thread: libssl has its own copy, as upstream does +SRCS+= arch.c thread_none.c thread_posix.c thread_win.c + # quic SRCS+= quic_method.c quic_impl.c quic_wire.c quic_ackm.c quic_statm.c SRCS+= cc_newreno.c quic_demux.c quic_record_rx.c @@ -67,8 +70,8 @@ SRCS+= rec_layer_d1.c rec_layer_s3.c # record/methods SRCS+= tls_common.c ssl3_meth.c tls1_meth.c tls13_meth.c tlsany_meth.c SRCS+= dtls_meth.c tls_multib.c -SRSC+= ssl3_cbc.c -SRSC+= tls_pad.c +SRCS+= ssl3_cbc.c +SRCS+= tls_pad.c # rio SRCS+= poll_immediate.c @@ -93,6 +96,8 @@ PICFLAG+= -DOPENSSL_PIC ${LCRYPTO_SRC}/crypto/hashtable \ ${LCRYPTO_SRC}/crypto/rbtree \ ${LCRYPTO_SRC}/crypto/siphash \ + ${LCRYPTO_SRC}/crypto/thread \ + ${LCRYPTO_SRC}/crypto/thread/arch \ ${LCRYPTO_SRC}/ssl \ ${LCRYPTO_SRC}/ssl/quic \ ${LCRYPTO_SRC}/ssl/record \