rsa: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

ml-kem: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

ml-dsa: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

ecx/ml-kem: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

ecx: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

ec: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

dsa: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

dh: add security category support

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

evp_test: support security-category for public key operations

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

doc: document the security category param for pkeys

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

Add security-category param name

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27571)

quic-interop-ci: Fix docker install

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27687)

Add more instructions in HACKING.md

It's been long since it was updated or refined, and it was a bit too
vague in certain areas.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27674)

Avoid leaking duplicated EVP_PKEY_CTX in case of error

Fixes Coverity 1647946 1647947

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27686)

(cherry picked from commit 240228979b92b5f45d5c0a42997d86755c850001)

Fix memory leaks after failure of PKCS7_add_signed_attribute()

If PKCS7_add_signed_attribute fails,
seq never escapes out of the callee and will
therefore result in a memory leak.
This is similar to ed3d277127.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27670)

Updated Windows notes on the use of “no-makedepend” for new builds

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27361)

quic-interop-ci: Fix failing CI

The issue was a flaky "impossible to reach server" in the CI.

The issue was caused by introduction of indeterminism to docker
networking (docker engine v28.0) and docker compose is affected by that
since v2.33.1.

Using constant network interface names solves the issue. The
"interface_name" was introduced in docker compose v2.36.0.

Resolves: https://github.com/openssl/project/issues/1182

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27682)

apps/x509.c: Fix the -addreject option adding trust instead of rejection

Fixes CVE-2025-4575

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27672)

Update pkcs11-provider submodule

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

test: reduce the scope of pkcs11-provider external test

To ease maintenance and improve reliability of pkcs11-provider
external test we only want it to run with kryoptic token.

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

test: skip tlsfuzzer tests pkcs11-provider test

Tlsfuzzer tests in pkcs11-provider external test currently uses hard-coded
lists of TLS 1.3 signature algorithms expected from openssl. However, openssl
neither promises a fixed default set of the signature algorithms nor promises
a fixed default ordering ofthese algorithms and hence test might fail
eventually even though there is nothing wrong anywhere.

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

ci: run all non-external tests on fedora:latest

Before pkcs11-provider external test runs, we run all
non-external tests since we want to make sure they work
fine on fedora:latest container.

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

ci: run pkcs11-provider external test on Fedora

We want to be able to run pkcs11-provider external test with
kryoptic token that is currently only available on Fedora.
Therefore we have to separate the test from the external test
for oqs provider.

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

ci: re-enable pkcs11-provider external test

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27602)

crypto/evp/signature.c: add checks for consistent presence of 'update' and 'final' functions

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

provider-signature.pod: add missing doc of OSSL_FUNC_signature_query_key_types(), fix doc of return types, etc.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

crypto/evp/signature.c: add more specific diagnostic data in case provider does not implement functions needed

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

crypto/evp/signature.c: compensate for providers not adding error queue entries on operation failure

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

crypto/evp: compensate for providers not adding error queue entries for keymgmt, sigver, and asymcipher

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

store_result.c: add to error queue which provider failed to load credential and hint on using default provider

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

80-test_cms.t: Fix indentation by replacing tabs with spaces

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27590)

Fix some typos in the man pages

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27590)

The condition that is never checked has been removed.
If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27607)

Check NASM version for {vex} prefix support

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

Remove redundant space in effective address

To have effective address of vmovapd instruction recognized and
translated to Intel format by the x86_64 assembler translator.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

Pick up {vex} in x86_64 assembler translator

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

apps/prime.c: Remove unused assignment

The variable is never read after the assignment.

Coverity issue: 1646789

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27636)

demos/bio/sconnect.c: Free ssl_bio on error to avoid memory leak

Call BIO_free() to release ssl_bio if an error occurs before BIO_push(), preventing a memory leak.

Fixes: 396e720965 ("Fix certificate validation for IPv6 literals in sconnect demo")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27639)

crypto/x509/v3_lib.c: Free tmpext if X509V3_EXT_add() fails to avoid memory leak

Add OPENSSL_free to free tmpext if X509V3_EXT_add() fails to avoid memory leak.

Fixes: 878dc8dd95 ("Join the x509 and x509v3 directories")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27566)

Workaround for issue with assembler on OS X 10.4

Local labels cannot be used in some circumstances as they might
be pointing to wrong locations.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/27017)

Fix AIX build in test/radix/quic_tests.c

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27354)

Fix build failure on AIX

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27354)

ssl/t1_lib.c: Free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak

Add OPENSSL_free() to free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak

Fixes: 4b1c73d2dd ("ML-KEM hybrids for TLS")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27568)

demos/guide/tls-client-block.c Spelling correction

Fix spelling error in one word.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27611)

s3_lib.c: Use illegal_parameter for failing encapsulation in ml_kem

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27627)

Fix trace output for provider algorithm names

Use the index variable to print out the provider algorithm details.

CLA: trivial

Signed-off-by: Ilie Halip <ilie.halip@nxp.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27624)

prime.c: Remove uneeded if check for NULL value

This was reported by coverity scan issue 1646789

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27623)

cipher_chacha20_poly1305.c: Remove unneeded check

This iterates through the given param list which means the param p
should always be present in the given array.

Resolves coverity scan issue 1646880.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27623)

configutl.c: Resolve possible resource leak of config file

The coverity detects Resource leak here. It may come to leak when the
option is passed multiple times.

Resolve coverity scan issue 1646846

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27623)

configutl.c: Remove dead code

Resolve coverity issue 1646848, 1646847

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27623)

Add NULL check in ossl_quic_get_peer_token

If a peer address hasn't been set on a quic channel yet, we will not
yield a token from our hashtable of available tokens.  Fail the
get_peer_token lookup in that event

Fixes #27608

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27610)

s3_lib.c: Handle weak x keys as illegal_parameter alert

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27597)

APPS/x509: add -multi option for outputting all certs found in input

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27340)

d2i_X509.pod: add missing doc of return value of i2d_ASN1_bio_stream()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

asn_mime.c multi_split(): add missing I/O error checking

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

SMIME_text(): add missing I/O error checking

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

SMIME_crlf_copy(): add missing I/O error checking

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

PEM_write_bio_ASN1_stream(): complete I/O error checking

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

apps/cms.c: add failure handling for I/O errors of 'BIO_printf(out, ...)'

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

apps/cms.c: clarify treatment of 'ret' variable in cms_main()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

apps/cms.c: remove needless ERR_print_errors() calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

apps/cms.c: add missing error messages in various error cases

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

fix asn1_write_micalg() in asn_mime.c on GostR3411 and SHAKE, also return 0 on I/O errors

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

SMIME_write_ASN1_ex() used for CMS: add error checking for calls to BIO_printf(), BIO_puts(), and asn1_write_micalg()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

apps/cms.c: add missing error message on error writing CMS output (ret == 6)

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27368)

Return SLH-DSA public key when requested

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27605)

Return ML-DSA public key when requested

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27605)

chacha_poly: use TRIE based param name decoder

Converted to using a TRIE based param name decoder to improve
performance.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27523)

test/testutil/testutil_init.c: Add OPENSSL_free() to avoid memory leak

Free trace_data if error occurs to avoid memory leak.

Fixes: d73458d17a ("Add tracing capability in test utilities")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27600)

Stop a TLSv1.3 server emitting an unsolicited PSK extension

If we attempt to accept a connection on an SSL object, and the
application has set an SSL_SESSION on that SSL object then we
can mistakenly believe that we are resuming and
emit an unsolicited PSK extension back to the client.

This can especially happen when using SSL_clear() which leaves
any SSL_SESSION associated with the SSL object.

See
https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352
and
https://github.com/openssl/openssl/discussions/24567

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27584)

statem_srvr.c: Add check for empty ecdhe encoded key

The RFC definition about the errors is very vague. The TLSv1.3 RFC is a
bit more specific about decode_error (but if this specific case goes for
decode_error or illegal parameter is still debatable):

```
 decode_error:  A message could not be decoded because some field was
      out of the specified range or the length of the message was
      incorrect.  This alert is used for errors where the message does
      not conform to the formal protocol syntax.  This alert should
      never be observed in communication between proper implementations,
      except when messages were corrupted in the network.
```

Thank you @GeorgePantelakis for reporting this issue!

Resolves: #27530

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27594)

APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN

Fixes #27572

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27592)

Check rand_meth_lock existence before trying to lock it

There are situations during exit clean up where dependent libraries
might be using TLS to finalize stuff but that might crash because
the rand_meth_lock can get freed and there is still an attempt to
get rand bytes. This change makes sure that things fail nicely.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27119)

Raise an error if PBKDF2 iteration count set to zero on check disabled in default provider

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27589)

Add retry capability to apt commands in quic interop

We're getting more frequent overnight failures in quic interop due to
failing updates that appear transient when conducting apt installs

Add the capability to do retry commands here

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27489)

SHA512/x86_64: Fix SIGSEGV on $avx=0 path

Fixes #27555

When $avx>1, codegen is:
    lea OPENSSL_ia32cap_P(%rip),%r10
    mov 0(%r10),%r9
    mov 8(%r10),%r11d
    mov 20(%r10),%r10d

When $avx is true, codegen was:
    lea OPENSSL_ia32cap_P(%rip),%r10
    mov 0(%r10),%r9
    mov 8(%r10),%r11d
    mov 20(%r10),%r10d    # not used by dispatcher

When $avx=0, codegen was:
    mov 20(%r10),%r10d    # %r10 not initalized, causing SIGSEGV

After fix, `mov 20(%r10),%r10d` is only included when $avx>1

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27574)

test/timing_load_creds.c: Free contents in error handling to avoid memory leak

Add a call to OPENSSL_free() in the error handling path to ensure contents is properly freed and prevent a memory leak.

Fixes: 45479dcee1 ("test/timing_load_creds.c: fix coding style and other (mostly minor) issues")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27570)

chacha_poly: fix settable ctx param list

The settable list used the generic AEAD cipher list which included
an extra parameter and omitted the IV length one.  The set ctx param call
was custom so the errant list didn't directly impact operation.

The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus.
That parameter isn't accepted either here or by the shared AEAD cipher params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27534)

(cherry picked from commit 1c63382294750c9111e23931dcd5637d60d1b6c4)

Update IMPL_*_SIGALG to not have to stringify parameter

Noted while playing with some c-style tools that these macros got
mis-handled when doing style changes.  Specifically, the last parameter,
as it passed externally as a token, but stringified internal to the
associated macro, got handled as an arithmetic expression rather than a
string.

Given that the only thing this parameter is used for is as a string, cut
out the middle man and just pass it as a string in the first place

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27579)

Add a test for app data received too early

Add a test for app data which was received prior to the Finished is read
correctly, and that if we continue to read we get the expected result.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

Ensure we properly release DTLS buffered app data records

If we read an app data record before we have read the Finished we buffer
it. Once we've read it we need to make sure we've properly released it
otherwise we will attempt to read it again (and this time there will be
no data in it).

Fixes #27316

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

test/bio_comp_test.c: Initialize pointer to avoid undefined behavior

If the allocation for "original" fails, "result" may be freed without being
properly initialized. Since result could hold a random value due to its
assignment in do_bio_comp_test(), freeing it without initialization is unsafe
and may lead to undefined behavior.

Fixes: 12e96a2360 ("Add brotli compression support (RFC7924)")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27569)

CHANGES/NEWS entries for configutl

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Configutl tests

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

configutl documentation

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Utility for dumping OpenSSL config file

Based on @neverpanic code`

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Fix memory management in port_make_channel

Also make port_new_handshake_layer processing clearer.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27562)

Add a test for sending an empty app data record in DTLS

DTLS should ignore this

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

Drop empty app data records in DTLS

App data records with 0 bytes of payload will confuse callers of SSL_read().
This will cause a successful read and return 0 bytes as read. Unfortunately
a 0 return from SSL_read() is considered a failure response. A subsequent
call to SSL_get_error() will then give the wrong result.

Zero length app data records are actually allowed by the spec, but have
never been handled correctly by OpenSSL. We already disallow creating such
empty app data records. Since the SSL_read() API does not have a good way to
handle this type of read, we simply ignore them.

Partial fix for #27316

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

Align PBKDF2 indicator behavior with other implementations

Fixes #26983

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27001)

crypto/provider_conf.c: Fix possible memory leak

Assign the return value of ossl_provider_info_add_to_store to added instead of
setting it directly to 1, in order to avoid a memory leak caused by entry not
being freed if ossl_provider_info_add_to_store() fails.

Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27472)

ccm: update CCM mode ciphers to use the TRIE param name decoder for AEAD ciphers

This brings the implementation in line with GCM which has had this capability
for a while.  It will improveme performance setting and retrieving the
authenticatoin tag.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

gcm: use TRIE based param name decoder

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

AEAD params: generate a TRIE to decode AEAD cipher parameter names

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

rename ciphercommon.c

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: update generation script to support multiple TRIE output

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: don't build removed file

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: don't build global param name TRIE

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

Fixed chacha20 get updated IV

Fixes #26998

Addresses an issue where the EVP_CIPHER_CTX_get_updated_iv() function
does not properly return the updated IV for the ChaCha20 cipher.
chacha20_get_ctx_params was updated to be sensitive to the
OSSL_CIPHER_PARAM_UPDATED_IV parameter.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27484)

Enable AES and SHA3 optimisations on Qualcomm Snapdragon X systems

For larger data blocks, AES gets performance gains of up to 26.5%,
and SHA3 up to 15%. Tested on a Dell 9345 with Snapdragon X1E-80-100.
Below are detailed data.

Before:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM     176805.90k   677599.17k  1932362.15k  4803628.03k  7696804.52k  8036674.22k
AES-192-GCM     178621.88k   673165.14k  1884515.41k  4690465.11k  7669383.17k  8021562.71k
AES-256-GCM     177187.09k   668302.19k  1843664.13k  4405732.35k  6911937.19k  7201800.19k
sha3-224         71694.30k   286854.87k   686716.67k   784932.86k   922643.11k   926182.06k
sha3-256         71997.70k   288208.13k   688777.98k   786555.22k   865192.62k   874643.46k
sha3-384         72167.35k   287085.80k   487257.00k   639260.33k   673180.33k   675108.18k
sha3-512         71581.52k   287953.09k   378381.31k   436353.02k   471433.22k   472804.01k

After:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM     177140.20k   674365.06k  1928108.37k  5285980.84k  9581854.72k 10167205.89k
AES-192-GCM     178512.57k   669584.09k  1890147.75k  5052911.96k  8831027.88k  9337787.73k
AES-256-GCM     177685.05k   664798.83k  1844782.17k  4816555.35k  8176435.20k  8592359.42k
sha3-224         71444.47k   286178.99k   747224.32k   911052.46k  1063985.15k  1067712.51k
sha3-256         71188.32k   285318.74k   746304.34k   903716.52k   984566.44k   997430.61k
sha3-384         71715.30k   285965.27k   546631.59k   733781.67k   766448.98k   768262.14k
sha3-512         70853.85k   284883.33k   427553.71k   489698.99k   520415.91k   520743.59k

Change:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM      +0.2 %       -0.5 %      -0.2 %      +10.0 %      +24.5 %     +26.5 %
AES-192-GCM      -0.1 %       -0.5 %      +0.3 %       +7.7 %      +15.1 %     +16.4 %
AES-256-GCM      +0.3 %       -0.5 %      +0.1 %       +9.3 %      +18.3 %     +19.3 %
sha3-224         -0.3 %       -0.2 %      +8.8 %      +16.1 %      +15.3 %     +15.3 %
sha3-256         -1.1 %       -1.0 %      +8.4 %      +14.9 %      +13.8 %     +14.0 %
sha3-384         -0.6 %       -0.4 %     +12.2 %      +14.8 %      +13.9 %     +13.8 %
sha3-512         -1.0 %       -1.1 %     +13.0 %      +12.2 %      +10.4 %     +10.1 %

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27503)