From 46453f0abb85c1c93dce7139950c6343a6cf04df Mon Sep 17 00:00:00 2001 From: Gordon Tetlow Date: Fri, 6 Nov 2026 10:42:45 -0800 Subject: [PATCH] openssl: build legacy provider as upstream does - Build with libcrypto's compile flags: modules/Makefile.inc now includes libcrypto's Makefile.inc, which brings in Makefile.common (NDEBUG, the asm dispatch defines, OPENSSL_PIC, the directory defines). Before this change, assertions were enabled in legacy.so. - Use upstream's per-architecture source list: the provider's own CPU capability code (cpuid asm and armcap.c/ppccap.c, or mem_clr.c without asm), and the MD5, RC4 and DES asm where upstream uses it. The provider no longer uses libcrypto's exported RC4, SHA1 and CRYPTO_*128 functions. - Drop the objects that upstream's linker leaves out of legacy.so (fcrypt_b.c, md5_one.c, md5_sha1.c, provider_err.c and ciphercommon_{ccm,gcm}*.c / ciphercommon_hw.c). Without them, params_idx.c is not needed either. - Add a version script, a copy of upstream's providers/legacy.ld, so that only OSSL_provider_init is exported. Around 209 symbols were exported before. Reviewed by: ngie MFC after: 2 weeks MFC to: stable/15 Event: FreeBSD Vendor Summit 2026 Differential Revision: https://reviews.freebsd.org/D60398 --- secure/lib/libcrypto/modules/Makefile.inc | 12 +--- secure/lib/libcrypto/modules/legacy/Makefile | 67 ++++++++++++++----- .../lib/libcrypto/modules/legacy/Version.map | 5 ++ 3 files changed, 57 insertions(+), 27 deletions(-) create mode 100644 secure/lib/libcrypto/modules/legacy/Version.map diff --git a/secure/lib/libcrypto/modules/Makefile.inc b/secure/lib/libcrypto/modules/Makefile.inc index 64fb57ee74c5..75f9218c8e29 100644 --- a/secure/lib/libcrypto/modules/Makefile.inc +++ b/secure/lib/libcrypto/modules/Makefile.inc @@ -1,13 +1,7 @@ -PACKAGE?= openssl -LIB_PACKAGE= SHLIBDIR= ${LIBDIR}/ossl-modules -LCRYPTO_SRC= ${SRCTOP}/crypto/openssl - -CFLAGS+= -I${LCRYPTO_SRC} -CFLAGS+= -I${LCRYPTO_SRC}/include -CFLAGS+= -I${LCRYPTO_SRC}/providers/common/include -CFLAGS+= -I${LCRYPTO_SRC}/providers/fips/include -CFLAGS+= -I${LCRYPTO_SRC}/providers/implementations/include +# Same compile flags as libcrypto (asm dispatch defines, NDEBUG, ...), as +# upstream builds its modules with the library flags. +.include "../Makefile.inc" WARNS?= 0 diff --git a/secure/lib/libcrypto/modules/legacy/Makefile b/secure/lib/libcrypto/modules/legacy/Makefile index 8f91d9504504..7aa9ece42d28 100644 --- a/secure/lib/libcrypto/modules/legacy/Makefile +++ b/secure/lib/libcrypto/modules/legacy/Makefile @@ -1,12 +1,14 @@ SHLIB_NAME?= legacy.so LIBADD= crypto +VERSION_MAP= ${.CURDIR}/Version.map + +# Pull in ../Makefile.inc now: the ASM_* tests below need Makefile.common. +.include SRCS+= legacyprov.c prov_running.c # ciphers -SRCS+= ciphercommon.c ciphercommon_hw.c ciphercommon_block.c \ - ciphercommon_gcm.c ciphercommon_gcm_hw.c \ - ciphercommon_ccm.c ciphercommon_ccm_hw.c +SRCS+= ciphercommon.c ciphercommon_block.c SRCS+= cipher_desx.c cipher_desx_hw.c cipher_des.c cipher_des_hw.c SRCS+= cipher_tdes_common.c SRCS+= cipher_blowfish.c cipher_blowfish_hw.c @@ -16,18 +18,47 @@ SRCS+= cipher_rc4.c cipher_rc4_hw.c SRCS+= cipher_rc4_hmac_md5.c cipher_rc4_hmac_md5_hw.c SRCS+= cipher_seed.c cipher_seed_hw.c -# crypto -SRCS+= cpuid.c -SRCS+= ctype.c +# crypto: the provider has its own copy of the CPU capability code +SRCS+= cpuid.c ctype.c +.if defined(ASM_aarch64) +SRCS+= arm64cpuid.S armcap.c +.elif defined(ASM_amd64) +SRCS+= x86_64cpuid.S +.elif defined(ASM_arm) +SRCS+= armv4cpuid.S armcap.c +.elif defined(ASM_i386) +SRCS+= x86cpuid.S +.elif defined(ASM_powerpc) || defined(ASM_powerpc64) || defined(ASM_powerpc64le) +SRCS+= ppccpuid.S ppccap.c +.else +SRCS+= mem_clr.c +.endif # crypto/des +.if defined(ASM_i386) +SRCS+= crypt586.S des-586.S +.else SRCS+= des_enc.c -SRCS+= fcrypt_b.c +.endif # crypto/md5 SRCS+= md5_dgst.c -SRCS+= md5_one.c -SRCS+= md5_sha1.c +.if defined(ASM_aarch64) +SRCS+= md5-aarch64.S +.elif defined(ASM_amd64) +SRCS+= md5-x86_64.S +.elif defined(ASM_i386) +SRCS+= md5-586.S +.endif + +# crypto/rc4 +.if defined(ASM_amd64) +SRCS+= rc4-md5-x86_64.S rc4-x86_64.S +.elif defined(ASM_i386) +SRCS+= rc4-586.S +.else +SRCS+= rc4_enc.c rc4_skey.c +.endif # providers/implementations/digests SRCS+= digestcommon.c @@ -38,26 +69,26 @@ SRCS+= pbkdf1.c SRCS+= pvkkdf.c # common -SRCS+= provider_err.c provider_ctx.c -SRCS+= provider_util.c +SRCS+= provider_ctx.c provider_util.c SRCS+= tls_pad.c -# This is needed so the provider can be loaded for us. -# -# There's a discrepancy between how this provider gets built in OpenSSL proper -# and FreeBSD. -SRCS+= params_idx.c - .include +.if defined(ASM_${MACHINE_CPUARCH}) +.PATH: ${SRCTOP}/sys/crypto/openssl/${MACHINE_CPUARCH} +.elif defined(ASM_${MACHINE_ARCH}) +.PATH: ${SRCTOP}/sys/crypto/openssl/${MACHINE_ARCH} +.endif + .PATH: ${LCRYPTO_SRC}/crypto \ ${LCRYPTO_SRC}/crypto/des \ ${LCRYPTO_SRC}/crypto/md5 \ + ${LCRYPTO_SRC}/crypto/rc4 \ ${LCRYPTO_SRC}/providers \ ${LCRYPTO_SRC}/providers/common \ ${LCRYPTO_SRC}/providers/implementations/ciphers \ ${LCRYPTO_SRC}/providers/implementations/digests \ ${LCRYPTO_SRC}/providers/implementations/kdfs \ ${LCRYPTO_SRC}/ssl \ - ${LCRYPTO_SRC}/ssl/record/methods \ + ${LCRYPTO_SRC}/ssl/record/methods diff --git a/secure/lib/libcrypto/modules/legacy/Version.map b/secure/lib/libcrypto/modules/legacy/Version.map new file mode 100644 index 000000000000..1debaaa7ff65 --- /dev/null +++ b/secure/lib/libcrypto/modules/legacy/Version.map @@ -0,0 +1,5 @@ +{ + global: + OSSL_provider_init; + local: *; +};