Raise an error if PBKDF2 iteration count set to zero on check disabled in default provider

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27589)

Add retry capability to apt commands in quic interop

We're getting more frequent overnight failures in quic interop due to
failing updates that appear transient when conducting apt installs

Add the capability to do retry commands here

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27489)

SHA512/x86_64: Fix SIGSEGV on $avx=0 path

Fixes #27555

When $avx>1, codegen is:
    lea OPENSSL_ia32cap_P(%rip),%r10
    mov 0(%r10),%r9
    mov 8(%r10),%r11d
    mov 20(%r10),%r10d

When $avx is true, codegen was:
    lea OPENSSL_ia32cap_P(%rip),%r10
    mov 0(%r10),%r9
    mov 8(%r10),%r11d
    mov 20(%r10),%r10d    # not used by dispatcher

When $avx=0, codegen was:
    mov 20(%r10),%r10d    # %r10 not initalized, causing SIGSEGV

After fix, `mov 20(%r10),%r10d` is only included when $avx>1

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27574)

test/timing_load_creds.c: Free contents in error handling to avoid memory leak

Add a call to OPENSSL_free() in the error handling path to ensure contents is properly freed and prevent a memory leak.

Fixes: 45479dcee1 ("test/timing_load_creds.c: fix coding style and other (mostly minor) issues")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27570)

chacha_poly: fix settable ctx param list

The settable list used the generic AEAD cipher list which included
an extra parameter and omitted the IV length one.  The set ctx param call
was custom so the errant list didn't directly impact operation.

The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus.
That parameter isn't accepted either here or by the shared AEAD cipher params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27534)

(cherry picked from commit 1c63382294750c9111e23931dcd5637d60d1b6c4)

Update IMPL_*_SIGALG to not have to stringify parameter

Noted while playing with some c-style tools that these macros got
mis-handled when doing style changes.  Specifically, the last parameter,
as it passed externally as a token, but stringified internal to the
associated macro, got handled as an arithmetic expression rather than a
string.

Given that the only thing this parameter is used for is as a string, cut
out the middle man and just pass it as a string in the first place

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27579)

Add a test for app data received too early

Add a test for app data which was received prior to the Finished is read
correctly, and that if we continue to read we get the expected result.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

Ensure we properly release DTLS buffered app data records

If we read an app data record before we have read the Finished we buffer
it. Once we've read it we need to make sure we've properly released it
otherwise we will attempt to read it again (and this time there will be
no data in it).

Fixes #27316

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

test/bio_comp_test.c: Initialize pointer to avoid undefined behavior

If the allocation for "original" fails, "result" may be freed without being
properly initialized. Since result could hold a random value due to its
assignment in do_bio_comp_test(), freeing it without initialization is unsafe
and may lead to undefined behavior.

Fixes: 12e96a2360 ("Add brotli compression support (RFC7924)")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27569)

CHANGES/NEWS entries for configutl

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Configutl tests

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

configutl documentation

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Utility for dumping OpenSSL config file

Based on @neverpanic code`

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27290)

Fix memory management in port_make_channel

Also make port_new_handshake_layer processing clearer.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27562)

Add a test for sending an empty app data record in DTLS

DTLS should ignore this

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

Drop empty app data records in DTLS

App data records with 0 bytes of payload will confuse callers of SSL_read().
This will cause a successful read and return 0 bytes as read. Unfortunately
a 0 return from SSL_read() is considered a failure response. A subsequent
call to SSL_get_error() will then give the wrong result.

Zero length app data records are actually allowed by the spec, but have
never been handled correctly by OpenSSL. We already disallow creating such
empty app data records. Since the SSL_read() API does not have a good way to
handle this type of read, we simply ignore them.

Partial fix for #27316

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

Align PBKDF2 indicator behavior with other implementations

Fixes #26983

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27001)

crypto/provider_conf.c: Fix possible memory leak

Assign the return value of ossl_provider_info_add_to_store to added instead of
setting it directly to 1, in order to avoid a memory leak caused by entry not
being freed if ossl_provider_info_add_to_store() fails.

Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27472)

ccm: update CCM mode ciphers to use the TRIE param name decoder for AEAD ciphers

This brings the implementation in line with GCM which has had this capability
for a while.  It will improveme performance setting and retrieving the
authenticatoin tag.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

gcm: use TRIE based param name decoder

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

AEAD params: generate a TRIE to decode AEAD cipher parameter names

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

rename ciphercommon.c

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: update generation script to support multiple TRIE output

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: don't build removed file

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

params: don't build global param name TRIE

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27392)

Fixed chacha20 get updated IV

Fixes #26998

Addresses an issue where the EVP_CIPHER_CTX_get_updated_iv() function
does not properly return the updated IV for the ChaCha20 cipher.
chacha20_get_ctx_params was updated to be sensitive to the
OSSL_CIPHER_PARAM_UPDATED_IV parameter.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27484)

Enable AES and SHA3 optimisations on Qualcomm Snapdragon X systems

For larger data blocks, AES gets performance gains of up to 26.5%,
and SHA3 up to 15%. Tested on a Dell 9345 with Snapdragon X1E-80-100.
Below are detailed data.

Before:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM     176805.90k   677599.17k  1932362.15k  4803628.03k  7696804.52k  8036674.22k
AES-192-GCM     178621.88k   673165.14k  1884515.41k  4690465.11k  7669383.17k  8021562.71k
AES-256-GCM     177187.09k   668302.19k  1843664.13k  4405732.35k  6911937.19k  7201800.19k
sha3-224         71694.30k   286854.87k   686716.67k   784932.86k   922643.11k   926182.06k
sha3-256         71997.70k   288208.13k   688777.98k   786555.22k   865192.62k   874643.46k
sha3-384         72167.35k   287085.80k   487257.00k   639260.33k   673180.33k   675108.18k
sha3-512         71581.52k   287953.09k   378381.31k   436353.02k   471433.22k   472804.01k

After:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM     177140.20k   674365.06k  1928108.37k  5285980.84k  9581854.72k 10167205.89k
AES-192-GCM     178512.57k   669584.09k  1890147.75k  5052911.96k  8831027.88k  9337787.73k
AES-256-GCM     177685.05k   664798.83k  1844782.17k  4816555.35k  8176435.20k  8592359.42k
sha3-224         71444.47k   286178.99k   747224.32k   911052.46k  1063985.15k  1067712.51k
sha3-256         71188.32k   285318.74k   746304.34k   903716.52k   984566.44k   997430.61k
sha3-384         71715.30k   285965.27k   546631.59k   733781.67k   766448.98k   768262.14k
sha3-512         70853.85k   284883.33k   427553.71k   489698.99k   520415.91k   520743.59k

Change:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM      +0.2 %       -0.5 %      -0.2 %      +10.0 %      +24.5 %     +26.5 %
AES-192-GCM      -0.1 %       -0.5 %      +0.3 %       +7.7 %      +15.1 %     +16.4 %
AES-256-GCM      +0.3 %       -0.5 %      +0.1 %       +9.3 %      +18.3 %     +19.3 %
sha3-224         -0.3 %       -0.2 %      +8.8 %      +16.1 %      +15.3 %     +15.3 %
sha3-256         -1.1 %       -1.0 %      +8.4 %      +14.9 %      +13.8 %     +14.0 %
sha3-384         -0.6 %       -0.4 %     +12.2 %      +14.8 %      +13.9 %     +13.8 %
sha3-512         -1.0 %       -1.1 %     +13.0 %      +12.2 %      +10.4 %     +10.1 %

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27503)

Fix SSL_{set1,add1}_host() handling of host name/IP address and related documentation

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27457)

SSL_set1_host.pod: add recommendation to use SSL_{set1,add1}_host() and SSL_set_tlsext_host_name()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27457)

RISC-V: Provide generic optimized SHA-256 implementation for rv64gc

Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27381)

pkcs12: increase macsaltlen from 8 to 16 as per NIST SP 800-132

Align PKCS12 PBMAC1 PBKDF2 salt length with
PKCS5_DEFAULT_PBE2_SALT_LEN.

With this change, newly created PKCS12 PBMAC1 PBKDF2 keystores use mac
salt length of 16 bytes by default. This increases interoperability
with FIPS implementations which require at least 16 bytes of salt
length. Otherwise FIPS implementations fail to to open keystore with
invalid salt length errors (unapproved):

    Mac verify error: invalid password?
    80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293:
    80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143:
    80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324:
    80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293:
    80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143:
    80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324:

The compile time constant is made possible to override with a build
time define, such that one can revert back to 8 if so is needed for
backwards compatibility.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27446)

Removed references to vxworks because it is an unsupported platform

Fixes #26558

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26630)

Fix use after free bugs for public_keys and private_keys in evp_test

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27421)

Add a target config for MINGW on ARM64

This is necessary to build OpenSSL native on Windows on Arm64 with gcc or clang.
It also works when cross compiling on Linux for aarch64-w64-windows-gnu.

This patch is used since years on MSYS2:
  https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-openssl/001-support-aarch64.patch

Fixes #10533

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26605)

Drop "by store"'s by_store_subject_ex()

It was used to pass libctx and propq, which would override the
corresponding values passed to by_store_ctrl_ex().  This wasn't
really reasonable to do either way, as it could potentially be a
surprise to the user, who can reasonably expect that the URI is
opened with the libctx and propq that was passed with the URI, and
not with those passed later.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

Add test_verify tests

Originally from https://github.com/openssl/openssl/pull/27507, with some
changes.

Co-authored-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

Rework the "by store" X509_LOOKUP method to open the given URI early

The cached X509_LOOKUP method data is no longer just the URI, but now
includes the OSSL_STORE_CTX pointer, and required parameters to reopen
the URI at any time.  cache_objects() is modified to handle this, and
only (re)open the URI when it wasn't previously opened, or when it was
closed by an earlier call.

This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
get to see possible errors when the URI is loaded.

This assumes that if the URI could be opened once, it can be opened
again.

Fixes #27461

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

Run tests nightly on riscv64 runner

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27240)

Disable unterminated-string-initialization in strict-warnings

Recently updated to fedora 42, which includes an updated gcc, which
triggers a new warning:

test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization]
   44 |         "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67"

The warning occurs because in some locations we create char buffers of
length X, and fill it with X bytes of data, truncating the NULL
terminator.

We could fix it by adding the nonstring attribute, but given that:
1) Adding attributes might impact other platforms that don't understand the
   attribute.

2) We often create char buffers that don't expect a NULL terminator.

3) Converting the unsigned char arrays to uint8_t, or other types that
   could be interpreted as non-strings has no impact, only applying the
   nonstring attribute silences the warning.

It seems more sensible to just disable the warning entirely

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27490)

apps/prime.c: Remove dead code

Fixes Coverity 1646773

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27524)

Expand gettable params for HKDF

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27365)

Update test/ossl_store_test.c

Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27393)

Update test/ossl_store_test.c

Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27393)

Adding winstore open test

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27393)

bio_b64.c: Replace OPENSSL_assert() calls with ossl_assert()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27401)

sslecho: Rename bool to flag to avoid C23 conflict

Fixes #27516

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27519)

Fix a typo in evpciph_des3_common.txt

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27408)

Fix a deadlock while attempting to get the Primary EVP_RAND_CTX

When only the FIPS provider was loaded we could get a deadlock when
calling RAND_get0_primary() due to attempting to obtain a recursive
lock.

We reduce the scope of the locks that we hold to avoid this.

Fixes #27391

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27408)

Ensure that our fips internal provider is always loaded

The fips provider has an internal provider. In some circumstances we
could end up trying to find it, but failing because it hasn't been loaded
yet. We just always ensure it is loaded early to avoid this.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27408)

Assert that we successfully obtained a lock

We should never fail to obtain a lock, so assert that we are successful

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27408)

Add a test for calling RAND_get0_primary()

We simply test that calling RAND_get0_primary() returns a success
for both the default and fips providers.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27408)

Fix aesv8 arm assembler code not working on 32 bit Android

OpenSSL uses 'void' as perlasm for the 32 bit armeabi-arm target, which
most notably lacks a 32 or 64 in its name. So while most code that is
targeted for 32 uses !~ /64/ there is one instance that uses ~= /32/,
introduced by commit 8e69c18 between 3.4.0 and 3.5.0. This leaves out
that line on 32 bit android causing a segfault.

This fixes the compilation issue by replacing the ~= /32/ with !~ /64/
compilation taget (see 15-android.conf)

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27510)

ossl_json_f64() seems to be unused, remove it to avoid libm dependency

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27434)

doc/man3: Document missing macro function history

By updating the `util/find-doc-nits` new missing history sections were
discovered. This commit adds the missing.

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27488)

doc/man3: Change formulation to let the script to catch it

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27488)

other.syms: These functions were deprecated

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27488)

util/find-doc-nits: Check function macros in history

Add a checker for function macros if they are present in the HISTORY
section of the man page.

Resolves: #26774

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27488)

Clarify how s_client -ign_eof and -quiet impact command processing

If -ign_eof -or -quiet are passed to s_client this implicitly turns off
command processing (i.e. equivalent to -nocommands). This was stated on
the man page in the "CONNECTED COMMANDS" section, but not in the
documentation for "-ign_eof" or "-quiet" directly. We state it here as
well to make it clearer.

Fixes #27443

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27500)

Test+fix handling "wrong" downgrade signals

This accounts for cases that can only occur when een non-compliant server sends
the wrong downgrade signal. (TLS1.1 signal when negotiating TLS1.2 or TLS1.2
signal when negotiating TLS1.0/TLS1.1). According to the TLS1.3 RFC these
cases should be rejected:

RFC8446, section 4.1.3: TLS 1.3 clients receiving a ServerHello indicating
TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of
these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are
not equal to the second value if the ServerHello indicates TLS 1.1 or below.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27518)

Repair downgrade tests

A number of these tests were failing for the wrong reasons. The intention is to verify
that the client sends an illegal parameter alert when an unexpected downgrade signal
is received. Instead, a number of tests failed because TLS1.1 was not available. The
tests are adapted to explicitly check for an illegal parameter alert from the client.

Client and server flags are updated to enable TLS1.1 where required and a few tests
requiring TLS1.1 were moved to be disabled when TLS1.1 is not available.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27518)

Make cpuid_setup non-constructor

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27466)

Improve documentation for -cipher option in openssl genpkey

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27260)

doc: OSSL_PROV_PARAM_STATUS is signed integer

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26994)

apps/prime.c: Fix memory leak of a BIGNUM

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27521)

Update to use BIO_get_line() with support for multiple primes per in file

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26549)

Address and add tests for edge cases involving short or empty files

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26549)

Fix issue where file is not read correctly with Windows line endings

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26549)

Add 20-test_prime unit test

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26549)

Add -in option to prime function to allow input from file for primality testing. Update -hex option documentation to reflect use with input and output.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26549)

Added quotes to mask spaces in the path when building

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27495)

BIO_dump_indent_cb(): Check for negative return from BIO_snprintf()

In practice this cannot happen but Coverity complains.

Fixes Coverity 1646683

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27493)

Fix also BIO_printf formatting for INF and NAN

Avoid infinite loooooooops in %e and %g formatting for +/-INF and
make the invalid value at least visible by using '?' as signvalue.

Fixes #26973

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27491)

Fix POD indentation in OSSL_CMP_CTX_new

Fixes #27459

Sourced from
https://github.com/quictls/quictls/commit/0c12a613effc9dac8abc9a68e31e641d0cdb6541

Plus one line of documentation fixes

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27481)

Fix typo in SHA256 RISC-V64 Zbb comments: Sigma0 -> Sum0

This corrects a misleading comment in sha256-riscv64-zbb.pl. The rotation
operation corresponds to the Sum0 function as defined in the FIPS 180-4
standard, not Sigma0.

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27480)

Test ML-DSA, SLH-DSA, and ML-KEM PCT implementations

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27436)

Move to error state if ML-DSA / SLH-DSA PCT fails

As required by FIPS 140-3 AS10.07, if the module fails a self-test, it
shall enter an error state.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27436)

Facilitate corruption in ML-DSA PCT

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27436)

Add verbose output to 'openssl list -store-loaders'

The provider based STORE loaders do have settable parameters, so they should
be displayed when '-verbose' is given, just like for any other list.

Out of necessity, this also introduces OSSL_STORE_LOADER_settable_ctx_params()

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26437)

poll builder: add dummy field

The microsoft compiler does not like the empty struct,
so go add a dummy field instead.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27494)

app/s_client.c: clean up and broaden use of ERR_print_errors()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27492)

file_store.c: give detail on file_set_ctx_params() error

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27498)

by_store.c: suppress in cache_objects() likely non-relevant error queue entries calling OSSL_STORE_find()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27498)

Fix P-384 curve on lower-than-P9 PPC64 targets

The change adding an asm implementation of p384_felem_reduce incorrectly
uses the accelerated version on both targets that support the intrinsics
*and* targets that don't, instead of falling back to the generics on older
targets.  This results in crashes when trying to use P-384 on < Power9.

Signed-off-by: Anna Wilcox <AWilcox@Wilcox-Tech.com>
Closes: #27350
Fixes: 85cabd94 ("Fix Minerva timing side-channel signal for P-384 curve on PPC")
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27429)

Add test to check SKEYMGMT interfaces

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27483)

SKEYMGMT: Expose settable params

This is needed for tools that do things like passing
    -skeyopt hexraw-bytes:0102030405060708090a0b0c0d0e0f10
to tools.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27483)

Relax absolut path checking in our 'file' scheme implementation

So far, we strictly obeyed [RFC 8089], which only allows absolute paths
in a 'file:' URI.  However, this seems to give a confusing user
experience, where something like 'file:foo.pem' wouldn't open foo.pem,
even though it's there in the current directory, but 'file:$(pwd)/foo.pem'
would.

To be less surprising for such use cases, we relax our implementation
visavi [RFC 8089] to allow relative paths.

[RFC 8089]: https://datatracker.ietf.org/doc/html/rfc8089

Fixes #27461

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27482)

Properly zeroize ML-KEM z and d values

Ensure z and d are actually zeroized by cleansing the full size of s,
rather than just vector_bytes.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27437)

Add a test for calling SSL_accept() on a listener

We expect this scenario to fail

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27351)

Fix errors on SSL_accept() and SSL_get_error()

Calling SSL_accept() was raising two errors on the stack if you passed
the wrong object type. Similarly SSL_get_error() was adding an error to
the stack if the wrong object type was passed and returning the wrong
result.

We also ensure SSL_set_accept_state() and SSL_set_connect_state() don't
raise spurious errors since these are void functions.

Fixes #27347
Fixes #27348

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27351)

Fix BIO_printf formatting for negative numbers formatted with %e

Some parts of the formatting code assumed that the input number is
positive.  This is fixed by working on its absolute value.

test/bioprinttest.c is amended to test the output of negative numbers
as well.

Fixes #26973

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27478)

docs: update OSSL_PARAM_int documentation

This change adds an example to allow compilation without warnings using
compiler options like `-Wincompatible-pointer-types-discards-qualifiers`

Code for the example was inspired by libarchive's https://github.com/libarchive/libarchive/pull/1869/commits/9e3a7e4b6c77e8aa19a69430f48917dbc15b319d

Fixes #20956

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27157)

Improved error message for X509_V_ERR_CERT_NOT_YET_VALID

In addition to an invalid certificate, it is not unlikely that this
exact error (case X509_V_ERR_CERT_NOT_YET_VALID) is caused by an
incorrect system clock. This cannot be trivially fixed, so for now,
we simply improve the quality of the error message.

Fixes #14771

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27141)

Fix default pkey(1) DER output

This is expected to be PKCS#8, but was defaulting to traditional when
possible.  Changed default DER output format to PKCS#8 and extended the
`-traditional` option to apply also to DER output.

Fixes: #21708
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27273)

Advertize signature setting in settable_ctx fn

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Add test for ML-DSA sig/ver message update

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Add ml_dsa msg_update functions to provider code

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Make public ml_dsa_mu_.. helpers

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Split the ML-DSA internal sigver functions

Deconstruct the functions into 2 parts:
- mu computation (if needed)
- actual signing/verification

Adds helper to compute mu that is split in 3 parts
(init/update/finalize) where the update part can be used to feed the message
to be signed or verified in chunks of any size.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Fix EVP_PKEY_verify man page

Various functions were misnamed in the descriptions.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)

Fix mldsa'a msg_inits operation type

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27342)