Import OpenSSL 3.0.17
Needs ReviewPublic
Actions

Authored by ngie on Jul 12 2025, 6:02 PM.

Details

Reviewers

khorben
andrew

Summary

Per the upstream release notes, this is a "bugfix release". It does not
contain any security-critical bugfixes, unlike the most recent prior releases
of OpenSSL 3.0.

This release is not an immediate candidate for inclusion in
14.3-* releases. That being said, content from this release will
potentially be rolled into upcoming releases by virtue of this being an
iterative 3.0.x release.

The changes may be benign, but some care might be required in the event
that some of the bugfixes affect shipping code which requires behavior
that may have been changed in this release.

Obtained from: https://github.com/openssl/openssl/releases/download/openssl-3.0.17/openssl-3.0.17.tar.gz

MFC after: 2 weeks

Merge commit 'ecf8229ffeb17a05c78fab6b973b0cccb84e25c5'

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 65384
Build 62267: arc lint + arc unit

Event Timeline

ngie created this revision.Jul 12 2025, 6:02 PM

Herald added a reviewer: andrew. · View Herald TranscriptJul 12 2025, 6:02 PM

Herald added a subscriber: imp. · View Herald Transcript

ngie requested review of this revision.Jul 12 2025, 6:02 PM

Harbormaster completed remote builds in B65384: Diff 158383.Jul 12 2025, 6:02 PM

ngie added a parent revision: D51282: vendor/openssl: import OpenSSL 3.0.17.Jul 12 2025, 6:02 PM

ngie edited reviewers, added: khorben; removed: andrew.Jul 12 2025, 6:03 PM

ngie added subscribers: andrew, emaste, philip.

Herald added a reviewer: andrew. · View Herald TranscriptJul 12 2025, 6:03 PM

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

secure/lib/libcrypto/man/man3/CMS_sign.3
secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3
secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3
secure/lib/libcrypto/man/man3/EVP_RAND.3
secure/lib/libcrypto/man/man3/OSSL_PARAM.3
secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3
secure/lib/libcrypto/man/man3/PKCS7_sign.3
secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3
[A few more manual pages]
secure/usr.bin/openssl/man/openssl-s_client.1
secure/usr.bin/openssl/man/openssl-s_rehash.1

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

Otherwise looks fine to me!

In D51283#1171870, @khorben_defora.org wrote:

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

Yup -- that definitely needs to be done.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

secure/lib/libcrypto/man/man3/CMS_sign.3

secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3

secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3

secure/lib/libcrypto/man/man3/EVP_RAND.3

secure/lib/libcrypto/man/man3/OSSL_PARAM.3

secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3

secure/lib/libcrypto/man/man3/PKCS7_sign.3

secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3

[A few more manual pages]

secure/usr.bin/openssl/man/openssl-s_client.1

secure/usr.bin/openssl/man/openssl-s_rehash.1

Good point.

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

I need to regenerate the assembly files. Good eye!

Otherwise looks fine to me!

In D51283#1173327, @ngie wrote:

In D51283#1171870, @khorben_defora.org wrote:

I think this diff should also update secure/lib/libcrypto/Makefile.inc with the corresponding OPENSSL_VER and OPENSSL_DATE.

Yup -- that definitely needs to be done.

I suspect that some manual files should also be re-generated from their corresponding .pod.in or .pod templates:

secure/lib/libcrypto/man/man3/CMS_sign.3

secure/lib/libcrypto/man/man3/DTLS_set_timer_cb.3

secure/lib/libcrypto/man/man3/EVP_PKEY_CTX_new.3

secure/lib/libcrypto/man/man3/EVP_RAND.3

secure/lib/libcrypto/man/man3/OSSL_PARAM.3

secure/lib/libcrypto/man/man3/OSSL_PARAM_int.3

secure/lib/libcrypto/man/man3/PKCS7_sign.3

secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3

[A few more manual pages]

secure/usr.bin/openssl/man/openssl-s_client.1

secure/usr.bin/openssl/man/openssl-s_rehash.1

Good point.

Still need to do this. I wish this was better automated, but that requires relying on the OpenSSL build system/perl -_-...

The other differences I spot all seem to be related to changes local to FreeBSD around KTLS and the assembly files, exceeding my current knowledge of what's needed there.

I need to regenerate the assembly files. Good eye!

Otherwise looks fine to me!

make buildasm had no differences.

In D51283#1180017, @ngie wrote:

Still need to do this. I wish this was better automated, but that requires relying on the OpenSSL build system/perl -_-...

I just checked and there are no manpage content differences. Updating the build date/version is the only thing that's required.

And of course we added the manpages to a separate prefix that isn't in .PATH...