aboutsummaryrefslogtreecommitdiff
path: root/crypto/openssl
Commit message (Collapse)AuthorAgeFilesLines
* OpenSSL: install .pc files from the exporters subdirEnji Cooper2025-10-172-41/+0
| | | | | | | | | | | | | | | | | | | | | | | | The .pc files generated in the root directory are used as part of the build; they should never be installed. Use the versions from the exporters subdirectory--which should be installed--as the .pc files which are distributed with FreeBSD. This avoids the need for "fixing up" these files after the fact (see `crypto/openssl/BSDmakefile` for more details as part of this change). Garbage collect `secure/lib/libcrypto/Makefile.version`, et al, as they're orphaned files. They were technically unused prior to this change as the vendor process properly embeds the version numbers in various files, but this commit formalizes the removal. This correction/clarification on the .pc files will be made in an upcoming release of OpenSSL [1]. References: 1. https://github.com/openssl/openssl/issues/28803 Suggested by: Richard Levitte (OpenSSL project) MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D53043
* crypto/openssl: remove autogenerated filesEnji Cooper2025-10-175-37037/+0
| | | | | | | | | | | | These files contain build host paths and other configuration details that can be regenerated via the standard vendor import process. Don't clutter up the FreeBSD tree with these files. Add the paths to .gitignore to prevent them from accidentally being added in a future update. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D53044
* crypto/openssl: update generated files to match 3.5.4 artifactsEnji Cooper2025-10-079-25/+576
| | | | | | MFC with: 046c625e9382 Fixes: 046c625e9382 ("crypto/openssl: update to 3.5.4") Reported by: Herbert J. Skuhra <herbert@gojira.at>
* crypto/openssl: update to 3.5.4Enji Cooper2025-10-0455-220/+1241
|\ | | | | | | | | | | | | | | | | | | This change includes all necessary changes required to update to OpenSSL 3.5.4. More information about the 3.5.4 release can be found in the relevant release notes (see 8e12a5c4eb3507846b5 for more details). Merge commit '8e12a5c4eb3507846b507d0afe87d115af41df40'
* | Fix multiple security issues in OpenSSL.Gordon Tetlow2025-09-303-99/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Timing side-channel in SM2 algorithm on 64 bit ARM (CVE-2025-9231) Out-of-bounds read in HTTP client no_proxy handling (CVE-2025-9232) Obtained from: OpenSSL Approved by: so Security: FreeBSD-SA-25:08.openssl Security: CVE-2025-9230 Security: CVE-2025-9231 Security: CVE-2025-9232
* | crypto/openssl: update build artifacts for the 3.5.3 releaseEnji Cooper2025-09-229-29/+25
| | | | | | | | | | | | | | | | | | This change updates the build artifacts to match the 3.5.3 release. Much of the change involves updating version numbers and release dates to match the release version's metadata. MFC after: 1 week MFC with: 88b8b7f0c4e9948667a2279e78e975a784049cba
* | crypto/openssl: update component to 3.5.3Enji Cooper2025-09-22158-653/+2705
|\| | | | | | | | | | | | | | | | | | | | | This change updates the sources for crypto/openssl. The subsequent commit will update the build artifacts to match the 3.5.3 release. More details about the update can be found in the related vendor branch commits. MFC after: 1 week Merge commit 'aed904c48f330dc76da942a8ee2d6eef9d11f572'
* | crypto/openssl: fix importing new versions from pristine treesEnji Cooper2025-09-211-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this change, CC was not being passed through to Configure, which was resulting in failures when Configure was running compiler checks. Pass through CC via `WRK_ENV` to Configure so the compiler is defined properly as part of the initial build. MFC after: 1 month Fixes: d18058b7b850 ("crypto/openssl: apply polish to new vendor import process") Differential Revision: https://reviews.freebsd.org/D52595
* | crypto/openssl: apply polish to new vendor import processEnji Cooper2025-09-161-28/+45
| | | | | | | | | | | | | | | | | | | | | | | | This change does the following 2 things: - Makes the build more repeatable by isolating the environment. This prevents bmake from leaking variables into gmake and makes the overall process a bit more robust. - Add debug printouts to make the process more straightforward to the reader and whoever is executing doing the current vendor import. MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D52420
* | crypto/openssl: make vendor imports easier/less error proneEnji Cooper2025-08-2121-1950/+715
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds a custom BSD makefile containing multiple high-level PHONY targets, similar to targets provided by the ports framework. The Makefile does the following: - Reruns Configure with a deterministic set of arguments to ensure that all appropriate features have been enabled/disabled in OpenSSL. - Preens the pkgconfig files to remove duplicate paths in their `CFLAGS` and `includedir` variables. - Rebuilds all ASM files to ensure that the content contained is fresh. - Rebuilds all manpages to ensure that the content contained in the manpages is fresh. Some additional work needs to be done to make the manpage regeneration "operation" reproducible (the date the manpages were generated is embedded in the files). All dynamic configuration previously captured in `include/openssl/configuration.h` and `include/crypto/bn_conf.h` has been moved to `freebsd/include/dynamic_freebsd_configuration.h` and `freebsd/include/crypto/bn_conf.h`, respectively. This helps ensure that future updates don't wipe out FreeBSD customizations to these files, which tune behavior on a per-target architecture basis, e.g., ARM vs x86, 32-bit vs 64-bit, etc. MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D51663
* | openssl: Import version 3.5.1Pierre Pronchery2025-08-0736-316/+45609
| | | | | | | | | | | | | | | | | | | | Migrate to OpenSSL 3.5 in advance of FreeBSD 15.0. OpenSSL 3.0 will be EOL after 2026-09-07. Approved by: philip (mentor) Sponsored by: Alpha-Omega Beach Cleaning Project Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D51613
* | Merge commit '1095efe41feed8ea5a6fe5ca123c347ae0914801'Pierre Pronchery2025-08-073038-42561/+441218
|\| | | | | | | | | | | Approved by: philip (mentor) Sponsored by: Alpha-Omega Beach Cleaning Project Sponsored by: The FreeBSD Foundation
* | OSSL_HTTP_get(): Reset redirection_url in each iterationEnji Cooper2025-05-291-7/+7
| | | | | | | | | | | | | | | | | | | | Also remove some dead assignments. Obtained from: openssl (e78c8b791c0e03e750ef7196bc7bfee8e5bd00a0) MFC after: 2 weeks Requested by: Phillip Sabatino Sponsored by: Dell, Inc.
* | openssl: update ASM and version info for 3.0.16 importEnji Cooper2025-03-141-5/+5
| | | | | | | | | | | | MFC after: 1 week MFC with: 0d0c8621fd181e507f0fb50ffcca606faf66a8c2 Differential Revision: https://reviews.freebsd.org/D49297
* | openssl: Import OpenSSL 3.0.16Enji Cooper2025-03-14166-1082/+2042
|\| | | | | | | | | | | | | | | | | | | | | | | This release incorporates the following bug fixes and mitigations: - [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176 - [CVE-2024-9143](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143) Release notes can be found at: https://openssl-library.org/news/openssl-3.0-notes/index.html MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49296
* | openssl: Remove the specific version numbers from the instructions.Gordon Tetlow2024-09-081-2/+2
| |
* | Update config/build info for OpenSSL 3.0.15Enji Cooper2024-09-081-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a companion commit to the OpenSSL 3.0.15 update. `opensslv.h` was regenerated via the following process: ``` cd crypto/openssl ./config git reset --hard gmake include/openssl/opensslv.h ``` `Makefile.inc` has been updated to match. MFC after: 1 week MFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09 Differential Revision: https://reviews.freebsd.org/D46603
* | openssl: Import OpenSSL 3.0.15.Enji Cooper2024-09-08174-812/+2312
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This release incorporates the following bug fixes and mitigations: - Fixed possible denial of service in X.509 name checks ([CVE-2024-6119]) - Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535]) Release notes can be found at: https://openssl-library.org/news/openssl-3.0-notes/index.html Co-authored-by: gordon MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D46602 Merge commit '108164cf95d9594884c2dcccba2691335e6f221b'
* | openssl: Update upgrade instructions.Gordon Tetlow2024-09-071-14/+6
| | | | | | | | | | | | Update download locations. Remove references to FREEBSD-Xlist. Remove reference to the fips module that has been removed.
* | openssl: Bring over fix for CVE-2024-6119 from vendor/openssl-3.0.Gordon Tetlow2024-09-035-26/+142
|\| | | | | | | Merge commit 'e60dbfd00b009d424dfc5446d132872c93dd0aed'
* | openssl: Add <sys/random.h> include for getrandom()John Baldwin2024-07-291-3/+4
| | | | | | | | | | | | | | | | | | | | | | GCC 14 (but not earlier versions) warns about a missing prototype for getrandom(). Include <sys/random.h> explicitly to bring in the prototype rather than depending on a nested include. While here, stop defining sysctl_random() since it is no longer used. Reviewed by: brooks Fixes: 838b6caababb openssl: use getrandom(2) instead of probing for getentropy(2) Differential Revision: https://reviews.freebsd.org/D45995
* | openssl: use getrandom(2) instead of probing for getentropy(2)Kyle Evans2024-07-161-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The probing for getentropy(2) relies on re-declaring getentropy(2) as weak and checking the address, but this is incompatible with the _FORTIFY_SOURCE symbol renaming scheme. It's always present on all supported FreeBSD versions now so we could cut it down to unconditional use, but there's another segment for getrandom(2) already that's cleaner to just add us to. We should upstream this. Reviewed by: kib (earlier version), markj Sponsored by: Klara, Inc. Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D45976
* | Update config/build info for OpenSSLEnji Cooper2024-06-261-5/+5
| | | | | | | | | | | | | | This is a companion commit to the OpenSSL 3.0.14 update. MFC after: 3 days MFC with: 44096ebd22ddd0081a357011714eff8963614b65
* | Update to OpenSSL 3.0.14Enji Cooper2024-06-26129-764/+2301
|\| | | | | | | | | | | | | | | | | | | This release resolves 3 upstream found CVEs: - Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow (CVE-2024-4603) - Fixed unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511) MFC after: 3 days Merge commit '1070e7dca8223387baf5155524b28f62bfe7da3c'
* | posix_async: FreeBSD also defines {make|swap|get|set}contextWarner Losh2024-05-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | FreeBSD also defines {make|swap|get|set}context for backward compatibility, despite also exposing POSIX_VERSION 200809L in FreeBSD 15-current. FreeBSD has defined these interfaces since FreeBSD 4.7, released over 20 years ago, so no further nuance in FreeBSD version number is necessary. Pull Request: https://github.com/openssl/openssl/pull/23885 Sponsored by: Netflix
* | Revert "OpenSSL: use the upstream provided version.map files for the ↵Enji Cooper2024-04-212-10/+0
| | | | | | | | | | | | | | | | | | | | | | | | fips/legacy providers" This change is still under review and should not have been merged directly to main (yet). This is a case and point for using `push.default` to nothing instead of matching or simple. This reverts commit 42ce242e353065dfbaa248955f6657005a395a95.
* | OpenSSL: use the upstream provided version.map files for the fips/legacy ↵Enji Cooper2024-04-212-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | providers This change introduces a static copy of the fips and legacy linker version maps generated by the OpenSSL 3.0.13 build process. This unbreaks the fips and legacy providers by not exposing unnecessary symbols from the fips/legacy provider shared objects shared with other providers (base, default) and libcrypto. More discussion: Prior to this change, loading the fips provider indirectly from a FreeBSD 14.0-CURRENT and 15.0-CURRENT host would result in a process-wide deadlock when invoking select OpenSSL APIs (CONF_modules_load* in this particular example). Speaking with the upstream maintainers [1], it became obvious that the FreeBSD base system was incorrectly building/linking the fips provider, resulting in a symbol collision at runtime, and thus a process-wide deadlock in specific circumstances. The fips provider would deadlock when trying to acquire a write lock on internal structures which should have only been available to the base and default providers, as certain preprocessor ifdefs only allow specific internal calls to be made with the base and default providers. 1. https://github.com/openssl/openssl/issues/24202 Differential Revision: https://reviews.freebsd.org/D44892
* | OpenSSL: Update date stringCy Schubert2024-02-051-2/+2
| | | | | | | | | | | | Reported by: "Herbert J. Skuhra" <herbert@gojira.at> Fixes: 74fe298c8299 MFC after: 3 days
* | OpenSSL: Update version stringsCy Schubert2024-02-031-4/+4
| | | | | | | | | | | | Reported by: "Herbert J. Skuhra" <herbert@gojira.at> Fixes: 9eb4e0b42d7c MFC after: 3 days
* | OpenSSL: Vendor import of OpenSSL 3.0.13Cy Schubert2024-02-021998-675/+451476
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) * Fix excessive time spent in DH check / generation with large Q parameter value ([CVE-2023-5678]) Release notes can be found at https://www.openssl.org/news/openssl-3.0-notes.html. Approved by: emaste MFC after: 3 days Merge commit '9dd13e84fa8eca8f3462bd55485aa3da8c37f54a'
* | OpenSSL: update to 3.0.12Ed Maste2023-10-2487-245/+440
|\| | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.12 addresses: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]). Relnotes: Yes Sponsored by: The FreeBSD Foundation
* | KTLS: Enable KTLS for receiving as well in TLS 1.3Daiki Ueno2023-10-191-11/+21
| | | | | | | | | | | | | | | | This removes a guard condition that prevents KTLS being enabled for receiving in TLS 1.3. Use the correct sequence number and BIO for receive vs transmit offload. Obtained from: OpenSSL commit 7c78932b9a4330fb7c8db72b3fb37cbff1401f8b
* | KTLS: Handle TLS 1.3 in ssl3_get_record.Daiki Ueno2023-10-191-15/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Don't unpad records, check the outer record type, or extract the inner record type from TLS 1.3 records handled by the kernel. KTLS performs all of these steps and returns the inner record type in the TLS header. - When checking the length of a received TLS 1.3 record don't allow for the extra byte for the nested record type when KTLS is used. - Pass a pointer to the record type in the TLS header to the SSL3_RT_INNER_CONTENT_TYPE message callback. For KTLS, the old pointer pointed to the last byte of payload rather than the record type. For the non-KTLS case, the TLS header has been updated with the inner type before this callback is invoked. Obtained from: OpenSSL commit a5fb9605329fb939abb536c1604d44a511741624)
* | KTLS: Add using_ktls helper variable in ssl3_get_record().John Baldwin2023-10-191-10/+10
| | | | | | | | | | | | | | | | | | | | | | When KTLS receive is enabled, pending data may still be present due to read ahead. This data must still be processed the same as records received without KTLS. To ease readability (especially in consideration of additional checks which will be added for TLS 1.3), add a helper variable 'using_ktls' that is true when the KTLS receive path is being used to receive a record. Obtained from: OpenSSL commit 031132c297e54cbc20404a0bf8de6ed863196399
* | KTLS: Check for unprocessed receive records in ktls_configure_crypto.John Baldwin2023-10-194-82/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KTLS implementations currently assume that the start of the in-kernel socket buffer is aligned with the start of a TLS record for the receive side. The socket option to enable KTLS specifies the TLS sequence number of this initial record. When read ahead is enabled, data can be pending in the SSL read buffer after negotiating session keys. This pending data must be examined to ensurs that the kernel's socket buffer does not contain a partial TLS record as well as to determine the correct sequence number of the first TLS record to be processed by the kernel. In preparation for enabling receive kernel offload for TLS 1.3, move the existing logic to handle read ahead from t1_enc.c into ktls.c and invoke it from ktls_configure_crypto(). Obtained from: OpenSSL commit 85773128d0e80cd8dcc772a6931d385b8cf4acd1
* | Add support for Chacha20-Poly1305 to kernel TLS on FreeBSD.John Baldwin2023-10-192-0/+15
| | | | | | | | | | | | FreeBSD's kernel TLS supports Chacha20 for both TLS 1.2 and TLS 1.3. Obtained from: OpenSSL commit 77f3936928068bee9d7e0c6939709ac179cb1059
* | OpenSSL: update to 3.0.11Pierre Pronchery2023-10-0975-220/+486
|\| | | | | | | | | | | | | | | | | | | OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/852 Sponsored by: The FreeBSD Foundation
* | aarch64: fix branch target indications in arm64cpuid.pl and keccak1600Tom Cosgrove2023-10-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing AARCH64_VALID_CALL_TARGET to armv8_rng_probe(). Also add these to the functions defined by gen_random(), and note that this Perl sub prints the assembler out directly, not going via the $code xlate mechanism (and therefore coming before the include of arm_arch.h). So fix this too. In KeccakF1600_int, AARCH64_SIGN_LINK_REGISTER functions as AARCH64_VALID_CALL_TARGET on BTI-only builds, so it needs to come before the 'adr' line. Change-Id: If241efe71591c88253a3e36647ced00300c3c1a3 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17653) Obtained from: OpenSSL 3a23f01268ec
* | aarch64: support BTI and pointer authentication in assemblyRuss Butler2023-10-0215-80/+228
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds optional support for - Armv8.3-A Pointer Authentication (PAuth) and - Armv8.5-A Branch Target Identification (BTI) features to the perl scripts. Both features can be enabled with additional compiler flags. Unless any of these are enabled explicitly there is no code change at all. The extensions are briefly described below. Please read the appropriate chapters of the Arm Architecture Reference Manual for the complete specification. Scope ----- This change only affects generated assembly code. Armv8.3-A Pointer Authentication -------------------------------- Pointer Authentication extension supports the authentication of the contents of registers before they are used for indirect branching or load. PAuth provides a probabilistic method to detect corruption of register values. PAuth signing instructions generate a Pointer Authentication Code (PAC) based on the value of a register, a seed and a key. The generated PAC is inserted into the original value in the register. A PAuth authentication instruction recomputes the PAC, and if it matches the PAC in the register, restores its original value. In case of a mismatch, an architecturally unmapped address is generated instead. With PAuth, mitigation against ROP (Return-oriented Programming) attacks can be implemented. This is achieved by signing the contents of the link-register (LR) before it is pushed to stack. Once LR is popped, it is authenticated. This way a stack corruption which overwrites the LR on the stack is detectable. The PAuth extension adds several new instructions, some of which are not recognized by older hardware. To support a single codebase for both pre Armv8.3-A targets and newer ones, only NOP-space instructions are added by this patch. These instructions are treated as NOPs on hardware which does not support Armv8.3-A. Furthermore, this patch only considers cases where LR is saved to the stack and then restored before branching to its content. There are cases in the code where LR is pushed to stack but it is not used later. We do not address these cases as they are not affected by PAuth. There are two keys available to sign an instruction address: A and B. PACIASP and PACIBSP only differ in the used keys: A and B, respectively. The keys are typically managed by the operating system. To enable generating code for PAuth compile with -mbranch-protection=<mode>: - standard or pac-ret: add PACIASP and AUTIASP, also enables BTI (read below) - pac-ret+b-key: add PACIBSP and AUTIBSP Armv8.5-A Branch Target Identification -------------------------------------- Branch Target Identification features some new instructions which protect the execution of instructions on guarded pages which are not intended branch targets. If Armv8.5-A is supported by the hardware, execution of an instruction changes the value of PSTATE.BTYPE field. If an indirect branch lands on a guarded page the target instruction must be one of the BTI <jc> flavors, or in case of a direct call or jump it can be any other instruction. If the target instruction is not compatible with the value of PSTATE.BTYPE a Branch Target Exception is generated. In short, indirect jumps are compatible with BTI <j> and <jc> while indirect calls are compatible with BTI <c> and <jc>. Please refer to the specification for the details. Armv8.3-A PACIASP and PACIBSP are implicit branch target identification instructions which are equivalent with BTI c or BTI jc depending on system register configuration. BTI is used to mitigate JOP (Jump-oriented Programming) attacks by limiting the set of instructions which can be jumped to. BTI requires active linker support to mark the pages with BTI-enabled code as guarded. For ELF64 files BTI compatibility is recorded in the .note.gnu.property section. For a shared object or static binary it is required that all linked units support BTI. This means that even a single assembly file without the required note section turns-off BTI for the whole binary or shared object. The new BTI instructions are treated as NOPs on hardware which does not support Armv8.5-A or on pages which are not guarded. To insert this new and optional instruction compile with -mbranch-protection=standard (also enables PAuth) or +bti. When targeting a guarded page from a non-guarded page, weaker compatibility restrictions apply to maintain compatibility between legacy and new code. For detailed rules please refer to the Arm ARM. Compiler support ---------------- Compiler support requires understanding '-mbranch-protection=<mode>' and emitting the appropriate feature macros (__ARM_FEATURE_BTI_DEFAULT and __ARM_FEATURE_PAC_DEFAULT). The current state is the following: ------------------------------------------------------- | Compiler | -mbranch-protection | Feature macros | +----------+---------------------+--------------------+ | clang | 9.0.0 | 11.0.0 | +----------+---------------------+--------------------+ | gcc | 9 | expected in 10.1+ | ------------------------------------------------------- Available Platforms ------------------ Arm Fast Model and QEMU support both extensions. https://developer.arm.com/tools-and-software/simulation-models/fast-models https://www.qemu.org/ Implementation Notes -------------------- This change adds BTI landing pads even to assembly functions which are likely to be directly called only. In these cases, landing pads might be superfluous depending on what code the linker generates. Code size and performance impact for these cases would be negligible. Interaction with C code ----------------------- Pointer Authentication is a per-frame protection while Branch Target Identification can be turned on and off only for all code pages of a whole shared object or static binary. Because of these properties if C/C++ code is compiled without any of the above features but assembly files support any of them unconditionally there is no incompatibility between the two. Useful Links ------------ To fully understand the details of both PAuth and BTI it is advised to read the related chapters of the Arm Architecture Reference Manual (Arm ARM): https://developer.arm.com/documentation/ddi0487/latest/ Additional materials: "Providing protection for complex software" https://developer.arm.com/architectures/learn-the-architecture/providing-protection-for-complex-software Arm Compiler Reference Guide Version 6.14: -mbranch-protection https://developer.arm.com/documentation/101754/0614/armclang-Reference/armclang-Command-line-Options/-mbranch-protection?lang=en Arm C Language Extensions (ACLE) https://developer.arm.com/docs/101028/latest Addional Notes -------------- This patch is a copy of the work done by Tamas Petz in boringssl. It contains the changes from the following commits: aarch64: support BTI and pointer authentication in assembly Change-Id: I4335f92e2ccc8e209c7d68a0a79f1acdf3aeb791 URL: https://boringssl-review.googlesource.com/c/boringssl/+/42084 aarch64: Improve conditional compilation Change-Id: I14902a64e5f403c2b6a117bc9f5fb1a4f4611ebf URL: https://boringssl-review.googlesource.com/c/boringssl/+/43524 aarch64: Fix name of gnu property note section Change-Id: I6c432d1c852129e9c273f6469a8b60e3983671ec URL: https://boringssl-review.googlesource.com/c/boringssl/+/44024 Change-Id: I2d95ebc5e4aeb5610d3b226f9754ee80cf74a9af Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16674) Reviewed by: emaste, Pierre Pronchery <pierre@freebsdfoundation.org> Obtained from: OpenSSL 19e277dd19f2 Differential Revision: https://reviews.freebsd.org/D41940
* | openssl: document the update processPierre Pronchery2023-09-251-0/+130
| | | | | | | | | | | | This is directly inspired from the equivalent document for OpenSSH. Sponsored by: The FreeBSD Foundation
* | OpenSSL: Fix handling of the "0:" label in arm-xlate.plTom Cosgrove2023-08-291-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When $label == "0", $label is not truthy, so `if ($label)` thinks there isn't a label. Correct this by looking at the result of the s/// command. Verified that there are no changes in the .S files created during a normal build, and that the "0:" labels appear in the translation given in the error report (and they are the only difference in the before and after output). Obtained from: OpenSSL commit 9607f5ccf285ac9988a86f95c5ad9f92b556a843 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D41587
* | OpenSSL: clean up botched merges in OpenSSL 3.0.9 importJung-uk Kim2023-08-112-43/+0
| | | | | | | | No functional change intended.
* | OpenSSL: regen opensslv.h for OpenSSL 3.0.10Jung-uk Kim2023-08-111-5/+5
| |
* | OpenSSL: update to 3.0.10Pierre Pronchery2023-08-10127-398/+846
|\| | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.10 addresses: - CVE-2023-3817 - CVE-2023-3446 - CVE-2023-2975 (Note that the vendor branch commit incorrectly referenced 3.0.9.) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/808 Sponsored by: The FreeBSD Foundation
* | libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* | libcrypto: Revert recent changes to fix legacy and fips providersMark Johnston2023-07-041-2/+0
| | | | | | | | | | | | | | They break the !amd64 builds due to an underspecified include path and will be re-applied once that's fixed. Reported by: Ronald Klop <ronald-lists@klop.ws>
* | libcrypto: add missing symbols to the fips providerPierre Pronchery2023-07-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3 supports a modular architecture, allowing different providers to bring specific implementations of cryptographical algorithms. One such provider, "fips", ships with OpenSSL 3 directly, and groups algorithms that can be FIPS 140-2 validated. The import of OpenSSL 3.0.9 was building this provider incorrectly, missing symbols required for proper operation. In addition, without the change in OpenSSL's crypto/bn/bn_const.c, the FIPS module fails loading: `Undefined symbol "ossl_bignum_modp_1536_p"`. This change is consistent with crypto/bn/bn_dh.c though. Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/787
* | Merge OpenSSL 3.0.9Pierre Pronchery2023-06-232983-132618/+385163
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation
* | OpenSSL: Merge OpenSSL 1.1.1uJung-uk Kim2023-05-3029-772/+344
| | | | | | | | (cherry picked from commit 8ecb489345f08012fdc92a202a40119891cac330)
* | OpenSSL: aes/asm/bsaes-armv7.pl: Replace adrl with addKornel Dulęba2023-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "adrl" is a pseudo-instruction used to calculate an address relative to PC. It's not recognized by clang resulting in a compilation error. I've stumbled upon it when trying to integrate the bsaes-armv7 assmebly logic into FreeBSD kernel, which uses clang as it's default compiler. Note that this affect the build only if BSAES_ASM_EXTENDED_KEY is defined, which is not the default option in OpenSSL. The solution here is to replace it with an add instruction. This mimics what has already been done in !BSAES_ASM_EXTENDED_KEY logic. Because of that I've marked this as trivial CLA. No objections from: jkim Obtained from: OpenSSL commit 27093ba73372935fe4ef91d0a45ce6ea90a1ac8e Differential Revision: https://reviews.freebsd.org/D39091
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-16 16:07:48 +0000