Base [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== OpenSSL 1.1.x / 12.x ======

During BSDCan 2018 the intention to update %%OpenSSL%% in base to 1.1.x branch was documented.

Intention is to update 12-STABLE to current 1.1.0 and subsequently update it to 1.1.1 when that is released.
The intent to update %%OpenSSL%% to 1.1 in 12 has now officially been documented in Bug #228912

Team (Provisional):

^ Who ^ %%FreeBSD%% account ^
| [[/GordonTetlow|Gordon Tetlow]] | gordon@ |
| [[/JungukKim|Jung-uk Kim]] | jkim@ |
| [[/BernardSpil|Bernard Spil]] | brnrd@ |

===== OpenSSL options =====

Default options of port and features enabled in base (%%LibreSSL%% as reference)

| **Feature** | 1.0.2 / 11 || 1.1.x / 12 ||
| ::: | **Base** | **Ports** | **Base** | **Ports** | **1.1.0h** | **%%LibreSSL%%** | **Comment** |
| NPN |  | X |  | X | X | X |  |
| SCTP |  | X |  | X | O | - |  |
| SSLv2 |  | X |  | O | O | - |  |
| SSLv3 |  | X |  | O | O | - |  |
| TLSv1 |  | X |  | X | X | X |  |
| TLSv1.1 |  | X |  | X | X | X |  |
| TLSv1.2 |  | X |  | X | X | X |  |
| TLSv1.3 | - | - |  | X | - | - |  |
| CAMELLIA |  |  |  |  | X | X |  |
| CAST5 |  |  |  |  |  | - |  |
| %%ChaCha20%% |  |  |  | X | X | X |  |
| DES | X | X | X | X | X | X | Required for TLSv1 compat? |
| GOST |  |  |  |  | - | X |  |
| IDEA |  |  |  | O | X | - |  |
| J-Pake |  |  |  | O | - | - |  |
| RC2 | X |  |  | X | X | - |  |
| RC4 | X |  |  | X | X | X | Required for TLSv1 compat? |
| RC5 | O | O |  | O | O | - |  |
| MD2 | O | X |  | O | O | - |  |
| MD4 |  |  |  | X | X |  |  |
| MD5 | X |  |  | X | X | X |  |
| MDC2 | O |  |  | O | X | - |  |
| RMD160 |  |  |  | X | X |  |  |
| SEED | X |  |  | - | X |  |  |
| ASM |  | X |  | X | X |  |  |
| SSE2 |  | X |  |  |  |  |  |
| Threads | X |  |  |  |  |  |  |
| EGD |  |  |  | O | O | - |  |
| EC |  | X |  | X | X |  |  |
| zlib | O |  |  |  | O | - |  |

| X | enabled |
| O | disabled |
| - | feature not available |
|  | not yet determined |

===== Relevant PRs and Reviews =====

^ PR ^ Summary ^
| [[https://bugs.freebsd.org/228865|PR228865]] | security/openssl-devel: Multiple ports fail with %%OpenSSL%% 1.1 |
| [[https://bugs.freebsd.org/228912|PR228912]] | %%OpenSSL%% 1.1 in the base system |
| [[https://bugs.freebsd.org/228911|PR228911]] | %%FreeBSD%% 12.0 Release action items |

====== Issues in base with OpenSSL 1.1.1 ======

===== libfetch =====

<code>
===> lib/libfetch (all)
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -O2 -pipe   -I. -DINET6 -DWITH_SSL -DFTP_COMBINE_CWDS -g -MD  -MF.depend.common.pico -MTcommon.pico -std=iso9899:1999 -fstack-protector-strong -Wsystem-headers -Werror -Wall -Wno-format-y2k -W -Wno-unused-parameter -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wreturn-type -Wcast-qual -Wwrite-strings -Wswitch -Wshadow -Wunused-parameter -Wcast-align -Wchar-subscripts -Winline -Wnested-externs -Wredundant-decls -Wold-style-definition -Wno-pointer-sign -Wmissing-variable-declarations -Wthread-safety -Wno-empty-body -Wno-string-plus-int -Wno-unused-const-variable  -Qunused-arguments  -c /usr/src/lib/libfetch/common.c -o common.pico
/usr/src/lib/libfetch/common.c:677:22: error: 'ASN1_STRING_data' is deprecated [-Werror,-Wdeprecated-declarations]
                ns = (const char *)ASN1_STRING_data(name->d.ia5);
                                   ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/asn1.h:554:1: note: 'ASN1_STRING_data' has been explicitly marked deprecated here
DEPRECATEDIN_1_1_0(unsigned char *ASN1_STRING_data(ASN1_STRING *x))
^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/opensslconf.h:121:34: note: expanded from macro 'DEPRECATEDIN_1_1_0'
# define DEPRECATEDIN_1_1_0(f)   DECLARE_DEPRECATED(f)
                                 ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/opensslconf.h:90:53: note: expanded from macro 'DECLARE_DEPRECATED'
# define DECLARE_DEPRECATED(f)    f __attribute__ ((deprecated));
                                                    ^
1 error generated.
</code>

Patch based on [[https://wiki.openssl.org/index.php/Hostname_validation|information on the OpenSSL wiki]]

<code>
Index: lib/libfetch/common.c
===================================================================
--- lib/libfetch/common.c       (revision 335478)
+++ lib/libfetch/common.c       (working copy)
@@ -648,6 +648,7 @@
        return (ret);
 }

+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 /*
  * Verify server certificate by subjectAltName.
  */
@@ -755,6 +756,7 @@
                GENERAL_NAMES_free(altnames);
        return (ret);
 }
+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */

 /*
  * Configure transport security layer based on environment.
@@ -965,7 +967,12 @@
        if (getenv("SSL_NO_VERIFY_HOSTNAME") == NULL) {
                if (verbose)
                        fetch_info("Verify hostname");
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
                if (!fetch_ssl_verify_hname(conn->ssl_cert, URL->host)) {
+#else
+               SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+               if (!SSL_set1_host(ssl, URL->host)) {
+#endif
                        fprintf(stderr,
                            "SSL certificate subject doesn't match host %s\n",
                            URL->host);
</code>

===== OpenSSH =====

When building the port with %%OpenSSL%% 1.1.1, it fails in configure stage

<code>
checking OpenSSL header version... 10101007 (OpenSSL 1.1.1-pre7 (beta) 29 May 2018)
checking OpenSSL library version... configure: error: OpenSSL >= 1.1.0 is not yet supported (have "10101007 (OpenSSL 1.1.1-pre7 (beta) 29 May 2018)")
===>  Script "configure" failed unexpectedly.
</code>

There's work on supporting %%OpenSSL%% 1.1.0 with a patch in [[https://github.com/openssh/openssh-portable/pull/48|OpenSSH's github]]

===== libradius =====

<code>
===> lib/libradius (obj,all,install)
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -O
2 -pipe   -Wall -DWITH_SSL -g -MD  -MF.depend.radlib.pico -MTradlib.pico -std=gnu99 -fstack-protector-strong -Wsystem-headers -Werror -Wall
 -Wno-format-y2k -W -Wno-unused-parameter -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wno-uninitialized -Wno-pointer-sign -Wn
o-empty-body -Wno-string-plus-int -Wno-unused-const-variable -Wno-tautological-compare -Wno-unused-value -Wno-parentheses-equality -Wno-unu
sed-function -Wno-enum-conversion -Wno-unused-local-typedef -Wno-address-of-packed-member  -Qunused-arguments  -c /usr/src/lib/libradius/ra
dlib.c -o radlib.pico
/usr/src/lib/libradius/radlib.c:159:11: error: variable has incomplete type 'HMAC_CTX' (aka 'struct hmac_ctx_st')
        HMAC_CTX ctx;
                 ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/ossl_typ.h:102:16: note: forward declaration of 'struct hmac_ctx_st'
typedef struct hmac_ctx_st HMAC_CTX;
               ^
...
</code>

===== heimdal =====

<code>
===> kerberos5/lib/libhx509 (obj,all,install)
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -O
2 -pipe -I/usr/src/crypto/heimdal/lib/hx509 -I/usr/src/crypto/heimdal/lib/hx509/ref -I/usr/src/crypto/heimdal/lib/asn1 -I/usr/src/crypto/he
imdal/lib/wind -I/usr/src/crypto/heimdal/lib/roken -I.   -DHAVE_CONFIG_H -I/usr/src/kerberos5/include -g -MD  -MF.depend.crypto.pico -MTcry
pto.pico -std=gnu99 -fstack-protector-strong    -Qunused-arguments  -c /usr/src/crypto/heimdal/lib/hx509/crypto.c -o crypto.pico
/usr/src/crypto/heimdal/lib/hx509/crypto.c:229:5: error: incomplete definition of type 'struct bignum_st'
    BN_set_negative(bn, i->negative);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/kerberos5/include/crypto-headers.h:22:40: note: expanded from macro 'BN_set_negative'
#define BN_set_negative(bn, flag) ((bn)->neg=(flag)?1:0)
                                   ~~~~^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/ossl_typ.h:80:16: note: forward declaration of 'struct bignum_st'
typedef struct bignum_st BIGNUM;
               ^
...
</code>

The 7.5 [[https://keg.brnrd.eu/data/111amd64-default-openssl111/2018-06-10_09h22m06s/logs/heimdal-7.5.0.log|port builds with OpenSSL 1.1.1]]. Base currently has 1.5.2.
===== ldns =====

After refresh of config.h for %%OpenSSL%% 1.1.1, fails with

<code>
===> lib/libldns (obj,all,install)
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -O
2 -pipe -I/usr/src/contrib/ldns   -g -MD  -MF.depend.dnssec.pico -MTdnssec.pico -std=gnu99 -fstack-protector-strong -Wsystem-headers -Werro
r -Wall -Wno-format-y2k -W -Wno-unused-parameter -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wno-uninitialized -Wno-pointer-s
ign -Wno-empty-body -Wno-string-plus-int -Wno-unused-const-variable -Wno-tautological-compare -Wno-unused-value -Wno-parentheses-equality -
Wno-unused-function -Wno-enum-conversion -Wno-unused-local-typedef -Wno-address-of-packed-member  -Qunused-arguments  -c /usr/src/contrib/l
dns/dnssec.c -o dnssec.pico
/usr/src/contrib/ldns/dnssec.c:1761:12: error: incomplete definition of type 'struct DSA_SIG_st'
        R = dsasig->r;
            ~~~~~~^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/dsa.h:65:16: note: forward declaration of 'struct DSA_SIG_st'
typedef struct DSA_SIG_st DSA_SIG;
               ^
...
</code>

The ldns [[https://keg.brnrd.eu/data/111amd64-default-openssl111/2018-06-10_09h22m06s/logs/ldns-1.7.0_1.log|port builds OK with OpenSSL 1.1.1]].

===== libssh =====

<code>
===> secure/lib/libssh (obj,all,install)
rm -f .depend
echo libprivatessh.so.5.full: /usr/obj/usr/src/amd64.amd64/tmp/usr/lib/libcrypto.a /usr/obj/usr/src/amd64.amd64/tmp/usr/lib/libcrypt.a /us$
/obj/usr/src/amd64.amd64/tmp/usr/lib/libz.a >> .depend
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -$
2 -pipe   -I/usr/src/crypto/openssh -include ssh_namespace.h -g -MD  -MF.depend.sshkey.pico -MTsshkey.pico -std=gnu99 -fstack-protector-st$
ong -Wno-pointer-sign -Wno-empty-body -Wno-string-plus-int -Wno-unused-const-variable -Wno-tautological-compare -Wno-unused-value -Wno-par$
ntheses-equality -Wno-unused-function -Wno-enum-conversion -Wno-unused-local-typedef -Wno-address-of-packed-member -Wno-switch -Wno-switch$
enum -Wno-knr-promoted-parameter -Wno-parentheses  -Qunused-arguments  -c /usr/src/crypto/openssh/sshkey.c -o sshkey.pico
/usr/src/crypto/openssh/sshkey.c:74:2: warning: OPENSSL_VERSION_NUMBER ${OPENSSL_VERSION_NUMBER} [-W#warnings]
#warning OPENSSL_VERSION_NUMBER ${OPENSSL_VERSION_NUMBER}
 ^
/usr/src/crypto/openssh/sshkey.c:279:28: error: incomplete definition of type 'struct rsa_st'
                return BN_num_bits(k->rsa->n);
                                   ~~~~~~^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/ossl_typ.h:110:16: note: forward declaration of 'struct rsa_st'
typedef struct rsa_st RSA;
               ^
</code>

Currently the [[https://keg.brnrd.eu/data/111amd64-default-openssl111/2018-06-10_09h22m06s/logs/errors/libssh-0.7.5.log|port fails to build with OpenSSL 1.1.1]] too.

===== libbsnmp =====

<code>
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -fpic -DPIC  -O2 -pipe   -I/usr/src/contrib/bsnmp/lib -DHAVE_ERR_H -DHAVE_GETADDRINFO -DHAVE_STRLCPY -DHAVE_STDINT_H -DHAVE_INTTYPES_H -DQUADFMT='"llu"' -
DQUADXFMT='"llx"' -DHAVE_LIBCRYPTO -g -MD  -MF.depend.snmpcrypto.pico -MTsnmpcrypto.pico -std=gnu99 -fstack-protector-strong -Wsystem-heade
rs -Werror -Wall -Wno-format-y2k -W -Wno-unused-parameter -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wreturn-type -Wcast-qua
l -Wwrite-strings -Wswitch -Wshadow -Wunused-parameter -Wcast-align -Wchar-subscripts -Winline -Wnested-externs -Wredundant-decls -Wold-style-definition -Wno-pointer-sign -Wmissing-variable-declarations -Wthread-safety -Wno-empty-body -Wno-string-plus-int -Wno-unused-const-vari
able  -Qunused-arguments  -c /usr/src/contrib/bsnmp/lib/snmpcrypto.c -o snmpcrypto.pico
/usr/src/contrib/bsnmp/lib/snmpcrypto.c:97:13: error: variable has incomplete type 'EVP_MD_CTX' (aka 'struct evp_md_ctx_st')
        EVP_MD_CTX ctx;
                   ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/ossl_typ.h:92:16: note: forward declaration of 'struct evp_md_ctx_st'
typedef struct evp_md_ctx_st EVP_MD_CTX;
               ^
/usr/src/contrib/bsnmp/lib/snmpcrypto.c:127:3: error: implicit declaration of function 'EVP_MD_CTX_cleanup' is invalid in C99 [-Werror,-Wim
plicit-function-declaration]
                EVP_MD_CTX_cleanup(&ctx);
                ^
/usr/src/contrib/bsnmp/lib/snmpcrypto.c:127:3: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
...
</code>

===== libtelnet =====

I have already [[https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207743|an open PR]] for this one I believe.

<code>
--- all_subdir_lib/libtelnet ---
--- enc_des.o ---
/usr/src/contrib/telnet/libtelnet/enc_des.c:69:2: error: unknown type name 'des_key_schedule'; did you mean 'DES_key_schedule'?
        Schedule krbdes_sched;
        ^~~~~~~~
        DES_key_schedule
</code>

Using the patch from the PR, libtelnet builds OK.

===== libexec/dma =====

<code>
cc -target x86_64-unknown-freebsd12.0 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin  -O2 -pipe   -I
/usr/src/contrib/dma  -DHAVE_REALLOCF -DHAVE_STRLCPY -DHAVE_GETPROGNAME  -DCONF_PATH='"/etc/dma"'  -DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VE
RSION='"v0.11+"'  -DDMA_ROOT_USER='"mailnull"'  -DDMA_GROUP='"mail"' -g -MD  -MF.depend.crypto.o -MTcrypto.o -std=gnu99 -fstack-protector-s
trong -Wsystem-headers -Werror -Wall -Wno-format-y2k -W -Wno-unused-parameter -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wre
turn-type -Wcast-qual -Wwrite-strings -Wswitch -Wshadow -Wunused-parameter -Wcast-align -Wchar-subscripts -Winline -Wnested-externs -Wredun
dant-decls -Wold-style-definition -Wno-pointer-sign -Wformat=2 -Wno-format-extra-args -Werror -Wmissing-variable-declarations -Wthread-safe
ty -Wno-empty-body -Wno-string-plus-int -Wno-unused-const-variable  -Qunused-arguments  -c /usr/src/contrib/dma/crypto.c -o crypto.o
/usr/src/contrib/dma/crypto.c:96:9: error: 'TLSv1_client_method' is deprecated [-Werror,-Wdeprecated-declarations]
        meth = TLSv1_client_method();
               ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/ssl.h:1844:1: note: 'TLSv1_client_method' has been explicitly marked deprecated here
DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_client_method(void))
^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/opensslconf.h:121:34: note: expanded from macro 'DEPRECATEDIN_1_1_0'
# define DEPRECATEDIN_1_1_0(f)   DECLARE_DEPRECATED(f)
                                 ^
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/openssl/opensslconf.h:90:53: note: expanded from macro 'DECLARE_DEPRECATED'
# define DECLARE_DEPRECATED(f)    f __attribute__ ((deprecated));
                                                    ^
...
</code>

====== Process ======

See [[OpenSSL/Base/Update110|Update 1.1.0]] sub-page\\ 
See [[OpenSSL/Base/Update111|Update 1.1.1]] sub-page

====== Private Libraries ======

There have been ideas to make %%OpenSSL%%'s libraries private in %%FreeBSD%% base.
During BSDCan 2018 [[/DevSummit|DevSummit]] the consensus was that we should not make these libraries private.
Current state is that this is an abandoned project. For historical purposes the content of this chapter has been [[OpenSSL/Base/Private|preserved in a sub-page]].