Import OpenSSL 3.0.17

[ngie]

Summary

Per the upstream release notes, this is a "bugfix release". It does not
contain any security-critical bugfixes, unlike the most recent prior releases
of OpenSSL 3.0.

This release is not an immediate candidate for inclusion in
14.3-* releases. That being said, content from this release will
potentially be rolled into upcoming releases by virtue of this being an
iterative 3.0.x release.

The changes may be benign, but some care might be required in the event
that some of the bugfixes affect shipping code which requires behavior
that may have been changed in this release.

Obtained from: https://github.com/openssl/openssl/releases/download/openssl-3.0.17/openssl-3.0.17.tar.gz

MFC after: 2 weeks

Merge commit 'ecf8229ffeb17a05c78fab6b973b0cccb84e25c5'

[khorben]

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

• secure/lib/libcrypto/man/man3/CMS_sign.3
• secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3
• secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3
• secure/lib/libcrypto/man/man3/EVP_RAND.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3
• secure/lib/libcrypto/man/man3/PKCS7_sign.3
• secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3
• [A few more manual pages]
• secure/usr.bin/openssl/man/openssl-s_client.1
• secure/usr.bin/openssl/man/openssl-s_rehash.1

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

Otherwise looks fine to me!

[ngie]

In D51283#1171870, @khorben_defora.org wrote:

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

Yup -- that definitely needs to be done.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

• secure/lib/libcrypto/man/man3/CMS_sign.3
• secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3
• secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3
• secure/lib/libcrypto/man/man3/EVP_RAND.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3
• secure/lib/libcrypto/man/man3/PKCS7_sign.3
• secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3
• [A few more manual pages]
• secure/usr.bin/openssl/man/openssl-s_client.1
• secure/usr.bin/openssl/man/openssl-s_rehash.1

Good point.

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

I need to regenerate the assembly files. Good eye!

Otherwise looks fine to me!

[ngie]

In D51283#1173327, @ngie wrote:

In D51283#1171870, @khorben_defora.org wrote:

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

Yup -- that definitely needs to be done.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

• secure/lib/libcrypto/man/man3/CMS_sign.3
• secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3
• secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3
• secure/lib/libcrypto/man/man3/EVP_RAND.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM.3
• secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3
• secure/lib/libcrypto/man/man3/PKCS7_sign.3
• secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3
• [A few more manual pages]
• secure/usr.bin/openssl/man/openssl-s_client.1
• secure/usr.bin/openssl/man/openssl-s_rehash.1

Good point.

Still need to do this. I wish this was better automated, but that requires relying on the OpenSSL build system/perl -_-...

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

I need to regenerate the assembly files. Good eye!

Otherwise looks fine to me!

make buildasm had no differences.

[ngie]

In D51283#1180017, @ngie wrote:

Still need to do this. I wish this was better automated, but that requires relying on the OpenSSL build system/perl -_-...

I just checked and there are no manpage content differences. Updating the build date/version is the only thing that's required.

[ngie]

And of course we added the manpages to a separate prefix that isn't in .PATH...