Show pageOld revisionsBacklinksBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. <callout type="danger"> **Note:** As of %%FreeBSD%% 10.3-RC1 this is a working proof of concept for the RELEASE branch. </callout> ====== FreeBSD 10.3 Release ====== The 10.3 version is based on the work done in [[https://hardenedbsd.org|HardenedBSD]] on the master branch (%%FreeBSD%% CURRENT). The question there was if we could devise a structure that allows building with %%LibreSSL%% whilst not replacing %%OpenSSL%%. Replacing %%OpenSSL%% causes issues with maintaining a forked repo. {{https://cloud.githubusercontent.com/assets/7547697/13683368/9a2d31f0-e706-11e5-8c72-4f66273040ac.png|LibreBSD}} %%**%%Before you ask:%%**%% This will not be a fork! I intend to maintain this as a patch-set for the most recent release of %%FreeBSD%% and will maintain it for [[https://hardenedbsd.org|HardenedBSD]] as well. Early March 2016 I managed to get %%LibreSSL%% to build, and all binaries to link to it on %%HardenedBSD%%. The patches were created on a derivative of the -to be released later this year- %%FreeBSD%% 11. See my earlier blog-posts for more details [[https://brnrd.eu/libressl/2016-03-05/libressl-in-hardenedbsd-base-part-i.html|Part I]] and [[https://brnrd.eu/libressl/2016-03-06/libressl-in-hardenedbsd-base-part-ii.html|Part II]]. I had tried to replace %%OpenSSL%% in %%FreeBSD%% 10 when I was at %%OpenBSD%%'s %%LibreSSL%% hackathon in Varaždin (Croatia) last year but hadn't managed to complete the project. The release of %%LibreSSL%% 2.3 also removed SSLv3 so my attention was on fixing fallout from that removal. 'Evidence' of that work and the patches can be found in [[OpenSSL/No-SSLv3|the No-SSLv3]] wiki article. As it turned out this time, it wasn't extremely difficult to do so I thought it wouldn't take too much time to do this for %%FreeBSD%% 10 as well. %%FreeBSD%% 10.3 is nearing its completion, so where better to start than with the current first Release Candidate! %%**%%Feedback appreciated:%%**%% I haven't replayed all the steps here, do let me know where I've hidden my typos and mistakes! (email, Twitter, [[/GitHub|GitHub]], Facebook, avionary) ===== The 'recipe' ===== %%**%%You'll need to select the correct branch for your %%FreeBSD%% version%%**%% - Download the [[http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz|LibreSSL 2.3 tarball]] * Extract this tarball into /usr/src/crypto and rename the directory from ''%%libressl-2.3.3%%'' to ''%%libressl%%'' - Apply the patch-set from [[https://github.com/Sp1l/LibreBSD/tree/FreeBSD-10.3/patchset|my GitHub repo]] - Add WITH_LIBRESSL=yes to /etc/src.conf - Rebuild and install your kernel and world (see the [[https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html|FreeBSD handbook chapter]] for detail) - Reboot ==== Commands ==== As commands (assuming you already have checked out %%FreeBSD%% 10.3 into /usr/src) <code bash> cd ~ mkdir download && cd download fetch http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz fetch https://github.com/Sp1l/LibreBSD/raw/FreeBSD-10.3/patchset/patchset cd /usr/src/crypto tar xf ~/download/libressl-2.3.3.tar.gz mv libressl-2.3.3 libressl cd /usr/src patch < ~/download/patchset echo 'WITH_LIBRESSL=yes' >> /etc/src.conf make buildworld && make buildkernel && make installkernel && make installworld reboot </code> Line 3: You should verify the tarball using ''%%signify%%'' or ''%%gpg%%''. Line 11: This should take quite a lot of time (probably hours) and is NOT the canonical way to do this. See the handbook [[https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html|chapter on rebuilding your system]] for a complete description! Now that was easy wasn't it? ==== Update your ports ==== After upgrading the kernel and world you'll need to rebuild all ports. If before you had defined <code make> WITH_OPENSSL_PORT= yes OPENSSL_PORT= security/libressl-devel </code> you can now remove these bits, but then you should rebuild world and kernel after every update of %%LibreSSL%%. Unless the shared library version -and thus the ABI- stay the same. ==== Updating LibreSSL ==== If %%LibreSSL%% receives an update that has the same shared library version, you can use my guidance from [[BernardSpil/PartialWorldBuilds|the FreeBSD wiki]] after downloading/extracting the latest %%LibreSSL%% tarball as discussed in the previous paragraph. <code bash> cd /usr/src/secure/lib/libcrypto make obj && make depend && make includes && make make install cd /usr/src/secure/lib/libssl make clean && make depend && make includes && make make install cd /usr/src/secure/usr.bin/openssl make clean && make make install </code> ===== The detail ===== Next to the patchset, I've also added all the files that were changed to my [[/GitHub|GitHub]] repo. The files are in their original location so you can use these as an overlay for your ''%%/usr/src%%''. ==== LibreSSL patches ==== %%FreeBSD%% 11 changed quite a lot in the build framework, so I had to adapt the patches for libcrypto, libssl and openssl accordingly. This made the build for the ''%%openssl%%'' binary fail, so I had to change <code make> LIBADD+= crypto ssl </code> into <code make> DPADD= ${LIBSSL} ${LIBCRYPTO} LDADD= -lssl -lcrypto </code> The bulk of the patches I created for %%HardenedBSD%% just worked just fine on 10.3 ==== base software patches ==== Most of the patches that I created for %%HardenedBSD%% applied cleanly. - The patches for ''%%libtelnet%%'' and ''%%ppp%%'' worked fine. - The ''%%wpa%%'' patches are not required, in 10.3 there's a much older version that doesn't have all the %%OpenSSL%% version checks. - The ''%%heimdal%%'' patches I've not yet tested but these patches. ====== FreeBSD CURRENT ====== AKA HEAD, master, 11, ... The original patch set was created for [[https://hardenedbsd.org|HardenedBSD]] for their playground/master branch. Early March 2016 I managed to get %%LibreSSL%% to build, and all binaries to link to it on %%HardenedBSD%%. The patches were created on a derivative of the -to be released later this year- %%FreeBSD%% 11. See my earlier blog-posts for more details [[https://brnrd.eu/libressl/2016-03-05/libressl-in-hardenedbsd-base-part-i.html|Part I]] and [[https://brnrd.eu/libressl/2016-03-06/libressl-in-hardenedbsd-base-part-ii.html|Part II]]. The build system for %%FreeBSD%% 11 is slightly different from the 10 branch. All of the resources you need can be found on [[https://github.com/HardenedBSD/hardenedBSD-playground/tree/hardened/current/libressl|the HardenedBSD-playground repo]] in the ''%%hardened/current/libressl%%'' branch. ===== recipe ===== The recipe doesn't differ from the recipe for 10.3 but you'll need a different patch-set. ===== TODO ===== - Create a branch in [[https://github.com/Sp1l/LibreBSD|the LibreBSD repo]] for %%FreeBSD%% current. - Create a patch-set for vanilla %%FreeBSD%% head in the %%LibreBSD%% repository ====== Historical information ====== [[http://bsdxbsdx.blogspot.nl/2015/04/build-packages-in-poudriere-without.htm|Starting point]] Base programs/libraries known to link with %%LibreSSL%% when installed as a port * sendmail * <del>libfetch (''%%fetch%%'' links to base libcrypto/ssl)</del> Fixed in 10.2? ===== Software linking to OpenSSL libs in base ===== - ldns -> replace with ports' dns/ldns - pkg -> replace with ports' ports-mgmt/pkg - svnlite -> replace with ports' devel/subversion - libfetch -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191951 - bsdinstall - iscsi - ppp (also relies on deprecated des_ functions) - bsdmp (not in 10.2?) bsdx' patches here http://www.egr.msu.edu/~mcdouga9/nossl-patches/ ===== Make ssl/crypto in base private ===== [[http://www.allanjude.com/bsd/privatessl.patch|patch]] [[https://github.com/freebsd/pkg/compare/master...allanjude:privatessl|Pre-req patch for pkg]] ===== Hackathon build ===== Really, really experimental! - Grab the tarball from github/libressl-portable/openbsd (NOT the portable bits!) - Hack the secure/lib/libcrypto/Makefile (align with %%OpenBSD%%'s lib/libcrypto/Makefile) libressl/base.txt Last modified: 2016/03/23 12:27by BernardSpil