src/secure, branch releng/14.0

OpenSSL: update to 3.0.12

2023-10-26T17:02:36+00:00

OpenSSL 3.0.12 addresses:

 * Fix incorrect key and IV resizing issues when calling
   EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2()
   with OSSL_PARAM parameters that alter the key or IV length
   ([CVE-2023-5363]).

Relnotes:	Yes
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit ad991e4c142ebabad7aef488ad97b189ecabb270)
(cherry picked from commit 575878a533823aa3e5bab715928d9cdffbc4dcbc)
(cherry picked from commit e833378cf9589171562ccad4c6ff59c3713770bd)

Approved by:	so
Approved by:	re (gjb)

libcrypto: Copy the arm64 header when building asm

2023-10-25T19:56:40+00:00

It may be needed when it's updated so is best to keep in sync with the
assembly files.

Reviewed by:	emaste
Sponsored by:	Arm Ltd
Differential Revision:	https://reviews.freebsd.org/D41938

(cherry picked from commit c97a82d4a4a0288ed2a456f4ce41d57483724f17)
(cherry picked from commit 5b413daf3a3b67d2d499256907883a96d7c4d13c)

Approved by:	re (gjb)

libcrypto: Switch back to the generated assembly in sys/crypto/openssl

2023-10-25T19:56:33+00:00

Reviewed by:	markj
Differential Revision:	https://reviews.freebsd.org/D41569

(cherry picked from commit 47d997021fbc7b662e9507deec1897d514d1224c)
(cherry picked from commit bf5069fb6a3fc8fbf08ed23a4fd958af48cf902f)

Approved by:	re (gjb)

libcrypto: Add buildasm and cleanasm targets

2023-10-25T19:56:08+00:00

These targets generate all the assembly files in sys/crypto/openssl.

Reviewed by:	markj, emaste (earlier version)
Differential Revision:	https://reviews.freebsd.org/D41590

(cherry picked from commit 73653b72af65e294dcfedc43a8ea09b2137d72ed)
(cherry picked from commit ef81451d114ebae9f77e195534898b6c4061aa69)

Approved by:	re (gjb)

libcrypto: Refactor Makefile.asm so it can be run outside of buildenv

2023-10-25T19:55:55+00:00

Currently Makefile.asm relies on the current buildenv to set CFLAGS
for i386.  The current approach also leaves various temporary *.s
files around in the current directory.  To make this a bit better:

- Instead of using CFLAGS from buildenv for i386, define the actual
  flags the perl scripts need: -DOPENSSL_IA32_SSE2 to enable SSE2.

- Change i386 to have the perl scripts write to /dev/stdout to avoid
  creating temporaries.  Previously i386 was generating the temporary
  files in the OpenSSL contrib src.

- Cleanup temporary *.s files in the all target after generating the
  real *.S files for architectures which need them.

- Remove a duplicate rule for aes-armv4.S.

Reviewed by:	markj
Differential Revision:	https://reviews.freebsd.org/D41589

(cherry picked from commit c0fe6b9d7506d6ce6f9ec3688ee0cc5656a8707e)
(cherry picked from commit 14dc723496c1b2244a2b2ce29f9fd754494f4eea)

Approved by:	re (gjb)

Makefile.asm: Simplify variable expansions in generated headers

2023-10-25T19:55:00+00:00

The :R:S expressions removed the .pl extension only to add it back
again, so just trim them to using :T alone.

Reviewed by:	Pierre Pronchery , markj, emaste
Differential Revision:	https://reviews.freebsd.org/D41588

(cherry picked from commit 7406b6f9761c35eb53f91f54d1a687d96d638907)
(cherry picked from commit a3f973f2ea0909be26666d3dcac3c4c45562a678)

Approved by:	re (gjb)

OpenSSL: update to 3.0.11

2023-10-13T23:15:10+00:00

OpenSSL 3.0.11 addresses:

    POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)

Relnotes:	Yes
Pull request:	https://github.com/freebsd/freebsd-src/pull/852
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 6f1af0d7d2af54b339b5212434cd6d4fda628d80)
(cherry picked from commit bbecb0ff6c9e2fc05c096ce2ca5387df0d8e99fe)

Approved by:	re (gjb)

libcrypto: complete the support for the 0.9.8 API

2023-09-24T16:18:28+00:00

When importing OpenSSL 3 in base, some but not all source files
implementing the deprecated 0.9.8 API were imported. With this change,
it becomes possible again to compile software targeting this API.

PR:		272220
Fixes:		b077aed33b7b ("Merge OpenSSL 3.0.9")
Reviewed by:	emaste
Sponsored by:	The FreeBSD Foundation
Pull Request:	https://github.com/freebsd/freebsd-src/pull/851

(cherry picked from commit b15b39521644ebffdcc091bd283ed410b0ae9274)
(cherry picked from commit ab64f100ca5ddd37029695646003abaf49c3065e)

Approved by:	re (gjb)

libcrypto: fix the FIPS provider on amd64

2023-09-24T16:18:20+00:00

This corrects the list of source files required for the FIPS provider.

To test:

```
INSTALL PASSED
enter AES-128-CBC encryption password:
Verifying - enter AES-128-CBC encryption password:
U2FsdGVkX1+MGm7LbZou29UWU+KAyBX/PxF5T1pO9VM=
```

Reviewed by:	emaste
Fixes:		b077aed33b7b ("Merge OpenSSL 3.0.9")
Sponsored by:	The FreeBSD Foundation
Pull Request:	https://github.com/freebsd/freebsd-src/pull/837
Differential Revision: https://reviews.freebsd.org/D41720

(cherry picked from commit 8f37b3a142f2f7197896cd283c44c7e4fb64aaf3)
(cherry picked from commit abd9da936335eca88d670ad35a94ed67d911bdb1)

Approved by:	re (gjb)

libcrypto: link engines and the legacy provider to libcrypto

2023-09-19T17:19:17+00:00

OpenSSL's legacy provider module and engines need to link to
libcrypto.so, as it provides some of the actual implementations of
legacy routines.

This is a little tricky due to build order issues.  Introduce a small
hack (LIBCRYPTO_WITHOUT_SUBDIRS) that builds libcrypto.so in its usual
early phase without any OpenSSL provider modules or engines.  This is
intended to restore the test suite; a future change should remove the
hack and replace it with a better approach.

PR:		254853, 273528
Discussed with:	Folks at EuroBSDCon in Coimbra
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 1a18383a52bc373e316d224cef1298debf6f7e25)
(cherry picked from commit fd4b13acd90bdc107a072660d91baa163474ebef)

Approved by:	re (gjb)