The 10.3 version is based on the work done in HardenedBSD on the master branch (FreeBSD CURRENT). The question there was if we could devise a structure that allows building with LibreSSL whilst not replacing OpenSSL. Replacing OpenSSL causes issues with maintaining a forked repo.

**Before you ask:** This will not be a fork! I intend to maintain this as a patch-set for the most recent release of FreeBSD and will maintain it for HardenedBSD as well.

Early March 2016 I managed to get LibreSSL to build, and all binaries to link to it on HardenedBSD. The patches were created on a derivative of the -to be released later this year- FreeBSD 11. See my earlier blog-posts for more details Part I and Part II.

I had tried to replace OpenSSL in FreeBSD 10 when I was at OpenBSD's LibreSSL hackathon in Varaždin (Croatia) last year but hadn't managed to complete the project. The release of LibreSSL 2.3 also removed SSLv3 so my attention was on fixing fallout from that removal. 'Evidence' of that work and the patches can be found in the No-SSLv3 wiki article. As it turned out this time, it wasn't extremely difficult to do so I thought it wouldn't take too much time to do this for FreeBSD 10 as well. FreeBSD 10.3 is nearing its completion, so where better to start than with the current first Release Candidate!

**Feedback appreciated:** I haven't replayed all the steps here, do let me know where I've hidden my typos and mistakes! (email, Twitter, GitHub, Facebook, avionary)

**You'll need to select the correct branch for your FreeBSD version**

1. Download the LibreSSL 2.3 tarball
   • Extract this tarball into /usr/src/crypto and rename the directory from libressl-2.3.3 to libressl
2. Apply the patch-set from my GitHub repo
3. Add WITH_LIBRESSL=yes to /etc/src.conf
4. Rebuild and install your kernel and world (see the FreeBSD handbook chapter for detail)
5. Reboot

As commands (assuming you already have checked out FreeBSD 10.3 into /usr/src)

cd ~
mkdir download && cd download
fetch http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz
fetch https://github.com/Sp1l/LibreBSD/raw/FreeBSD-10.3/patchset/patchset
cd /usr/src/crypto
tar xf ~/download/libressl-2.3.3.tar.gz
mv libressl-2.3.3 libressl
cd /usr/src
patch < ~/download/patchset
echo 'WITH_LIBRESSL=yes' >> /etc/src.conf
make buildworld && make buildkernel && make installkernel && make installworld
reboot

Line 3: You should verify the tarball using signify or gpg. Line 11: This should take quite a lot of time (probably hours) and is NOT the canonical way to do this. See the handbook chapter on rebuilding your system for a complete description!

Now that was easy wasn't it?

After upgrading the kernel and world you'll need to rebuild all ports. If before you had defined

WITH_OPENSSL_PORT= yes
OPENSSL_PORT=	security/libressl-devel

you can now remove these bits, but then you should rebuild world and kernel after every update of LibreSSL. Unless the shared library version -and thus the ABI- stay the same.

If LibreSSL receives an update that has the same shared library version, you can use my guidance from the FreeBSD wiki after downloading/extracting the latest LibreSSL tarball as discussed in the previous paragraph.

cd /usr/src/secure/lib/libcrypto
make obj && make depend && make includes && make
make install
cd /usr/src/secure/lib/libssl
make clean && make depend && make includes && make
make install
cd /usr/src/secure/usr.bin/openssl
make clean && make
make install

Next to the patchset, I've also added all the files that were changed to my GitHub repo. The files are in their original location so you can use these as an overlay for your /usr/src.

FreeBSD 11 changed quite a lot in the build framework, so I had to adapt the patches for libcrypto, libssl and openssl accordingly. This made the build for the openssl binary fail, so I had to change

LIBADD+= crypto ssl

into

DPADD=  ${LIBSSL} ${LIBCRYPTO}
LDADD=  -lssl -lcrypto

The bulk of the patches I created for HardenedBSD just worked just fine on 10.3

Most of the patches that I created for HardenedBSD applied cleanly.

1. The patches for libtelnet and ppp worked fine.
2. The wpa patches are not required, in 10.3 there's a much older version that doesn't have all the OpenSSL version checks.
3. The heimdal patches I've not yet tested but these patches.

AKA HEAD, master, 11, …

The original patch set was created for HardenedBSD for their playground/master branch.

Early March 2016 I managed to get LibreSSL to build, and all binaries to link to it on HardenedBSD. The patches were created on a derivative of the -to be released later this year- FreeBSD 11. See my earlier blog-posts for more details Part I and Part II.

The build system for FreeBSD 11 is slightly different from the 10 branch. All of the resources you need can be found on the HardenedBSD-playground repo in the hardened/current/libressl branch.

The recipe doesn't differ from the recipe for 10.3 but you'll need a different patch-set.

1. Create a branch in the LibreBSD repo for FreeBSD current.
2. Create a patch-set for vanilla FreeBSD head in the LibreBSD repository

Starting point

Base programs/libraries known to link with LibreSSL when installed as a port

• sendmail
• libfetch (fetch links to base libcrypto/ssl) Fixed in 10.2?

1. ldns → replace with ports' dns/ldns
2. pkg → replace with ports' ports-mgmt/pkg
3. svnlite → replace with ports' devel/subversion
4. libfetch → https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191951
5. bsdinstall
6. iscsi
7. ppp (also relies on deprecated des_ functions)
8. bsdmp (not in 10.2?)

bsdx' patches here http://www.egr.msu.edu/~mcdouga9/nossl-patches/

patch Pre-req patch for pkg

Really, really experimental!

1. Grab the tarball from github/libressl-portable/openbsd (NOT the portable bits!)
2. Hack the secure/lib/libcrypto/Makefile (align with OpenBSD's lib/libcrypto/Makefile)