The OpenBSD project has multiple branches of LibreSSL. This chapter describes how the upstream project and the FreeBSD ports correlate.

Not to be confused with FreeBSD's -STABLE

The stable versions correspond to a version of OpenBSD (planned versions/dates in parentheses)

OpenBSD releases happen every 6 months and the project will provide updates for stable versions for one year after release of the corresponding OpenBSD version. With the release of the next OpenBSD version, the ABI will remain stable and the major shared library versions do not change.

These are point versions for the next OpenBSD release. Up to the release of the corresponding OpenBSD version, the ABI and major shared library version keep changing. The snapshot version contains features that are not found in the stable version. To use the latest LibreSSL features, this is the branch to follow.

The snapshots are considered to be secure just like the stable versions

To stay in line with the upstream OpenBSD project, the ports tree will (as of version 2.2/2.3) contain the stable version and the next/snapshot version for early adopters.

As OpenBSD releases their next version of LibreSSL-Portable, the libressl-devel port will link to that next-stable version and you must rebuild all your ports.

The standard packages from FreeBSD are still being built with OpenSSL from base and for some packages requiring a newer OpenSSL with OpenSSL from ports.

The following FreeBSD derivatives are known to use LibreSSL

1. PC-BSD by default since PC-BSD 10.1.2¹⁾
2. OPNsense available since OPNsense 15.7²⁾

To build ports against LibreSSL, add the following lines to /etc/make.conf

# Build ports against security/libressl
WITH_OPENSSL_PORT=	yes
OPENSSL_PORT=		security/libressl

Most ports will build without issue, some need fixing. See following paragraphs for the most notable.

If you require the latest features LibreSSL provides or wish to use the previous stable version, use the following in /etc/make.conf

WITH_OPENSSL_PORT=	yes
# Use the latest release with frequently changing API
OPENSSL_PORT=		security/libressl-devel

After switching this will most likely hit you.

• GSS-API: If you need this you must select one of the ports implementations, you cannot combine ports Open-/LibreSSL with base GSS-API
• Secure Remote Password (TLS-SRP): Must be disabled

As of python27-2.7.10 and python34-3.4.3 Python has included fixes for LibreSSL.
Python 3.2 and 3.3 have not been fixed yet but you can find patches in this section

Currently there's no solution available to create a FreeBSD installation where LibreSSL replaces the default OpenSSL libraries. Work is undergoing to see if this is viable.

security/p5-openxpi: Claimed to not be fully functional by the developers
security/py-cryptography: Claimed to not be fully functional by the developers

When you build world when you have LibreSSL installed, some base utilities will link to LibreSSL. These you will have to update every time there are shared library versions are bumped

The detailed version history was moved to the LibreSSL history sub-page

Detailed information on specific ports can now be found in the sub-page

The first build of all ports with LibreSSL for PC-BSD revealed 81 ports which require patching to work properly.

The build of all ports with LibreSSL 2.3, which has removed SSLv3, revealed 92 ports which require patching to work. This has been captured in the OpenSSL section as this fallout is considered equal to the fallout of building all ports with OpenSSL with SSLv3 disabled (security_openssl_UNSET=SSL3 / –no-ssl3).

Note: Counts are not up-to-date

The net-p2p/bitcoin and other virtual currency applications will/can not be fixed, they require bug-compatible OpenSSL libaries.

You can find examples of fixes in this GitHub repo, cross-reference with the PC-BSD 10.1.2 ports build chapter of the Ports sub-page.

Specific guidance for fixing the problems in the table above can be found here

Advisories prior to the initial release of LibreSSL (portable) are not included.

^* NVD Medium + OpenSSL Moderate

LibreSSL PRNG found to be unsafe. LibreSSL refers to this as the 'Linux forking and PID wrap issue'.

This was fixed in 2.0.2

No official rating, rated low for the counts above

OpenSSL published 9 vulnerabilities

OpenSSL responds to the POODLE attack and published 4 vulerabilities

NB: As of this advisory, OpenSSL includes severity ratings to vulnerabilities

OpenSSL published 8 vulerabilities

OpenSSL published 14 vulnerabilities and LibreSSL confirmed that it has 5 of these vulnerabilities as well, notably not CVE-2015-0297 which has the highest possible impact rating for OpenSSL.

Links

• OpenSSL confirmed these
• LibreSSL is said to be not vulnerable to the high rated vulnerability CVE-2015-0208 that will be published 2015/03/19 by the author of the high rated vulnerability.
  

OpenSSL publishes 7 vulnerabilities. LibreSSL confirms that 3 of these vulnerabilities apply to LibreSSL as well and one is still under review.

OpenSSL publishes a single vulnerability in the most recent versions of 1.0.1 and 1.0.2. Bob Beck announces that this vulnerability does not apply to LibreSSL.

Qualys discovered a memory leak and a buffer overflow in LibreSSL when reviewing OpenSMTPD. Qualys Security Advisory

Some more info

• Cumulative update to arc4random(3)
• lib/25367 arc4random state is shared across forks
• LibreSSL: More Than 30 Days Later (EuroBSDCon Paper)
• EuroBSDCon 2014 presentation arc4random: 1996 to present