riscv: add dl_hwcap for capability detection

Availability of ZVK* should be determined with dl_hwcap and hwcap.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26811)

fix: add OOM handler for x509 fuzz test

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26830)

Make the KEM operating mode optional

There is only one operating mode supported for each of RSA, EC and ECX.
We should not require an explicit setting for the obvious default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26872)

doc: document that the FIPS provider doesn't support deterministic ECDSA sigs

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26880)

Revert wrong macos RCU fix

This reverts #23974 which seems to be no longer needed now,
due to other fixes nearby.  Most likely the change did just
slightly decrease the performance of the reader threads, and
did therefore create the wrong impression that it fixed the issue.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26881)

Coverity fixes

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643042
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643047
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643089
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643091
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643095

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26845)

More seed and private key checks for ML-DSA

- Check seed/key consistency when generating from a seed and the private
  key is also given.
- Improve error reporting when the private key does not match an
  explicit public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26865)

Fix ci break on building quic with no-siphash

SHARED_SOURCE doesn't pull in siphash if its disabled in the
configuration leading to undefined symbols, which we need for quic.

If siphash is disabled in the build, then pull it in via a SOURCE
addition, otherwise pull it in via SHARED_SOURCE

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26874)

separate intval into separate variable in OSSL_PARAMS

construction of int params holds a pointer to an int rather than an int
value, so we need to use separate variables when constructing separate
int params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)

Fix slh-dsa fuzzer on invalid param inputs

oss-fuzz issue:
https://issues.oss-fuzz.com/issues/397734693

Fails because the fuzzer occasionaly provides inputs which drives the
fuzzer to create an octet-string for the context_string param which
violates the 255 byte constraint documented on that parameter.

Fix it by detecting that condition, expecting failure in the call to
EVP_sign_message_init, and bailing out when it occurs.

Fixes openssl/project#1109

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)

Use siphash to implement lcidm hash function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)

Add siphash to shared source for quic

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)

Update LCIDM lookups to include hash keys

In preparation for using siphash in our hash function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)

Add random hash key value to lcidm struct

This is in preparation for using siphash to compute lcidm hash table
values

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)

Re-enable RCU torture test on MACOSX

This test was disabled due to "Stochastic failures in
the RCU test on MACOSX" by #23967, which sounds like an
issue that is probably fixed now.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26834)

SLH-DSA - restrict keygen seed length to exact value of 3*n

It was allowing the seed to be larger, and then just ignoring the
trailing bytes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26858)

SLH-DSA fixup tests to adjust the private key getter returning the
public component

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)

SLH-DSA Update private key getter to also return public components.

The private key is defined in FIPS 205 as containing the public key,
so we return this also. This also matches what happens in fromdata.

Updated Documentation for SLH_DSA.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)

doc: fixup FIPS self test names

Missing names and categories in the documentation

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

fipsinstall: update tests to use corrent key gen test name

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

fips: update FIPS self test defines

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

fips: refactor to unify the ST_KAT_PARAM -> OSSL_PARAM code

This code was duplicated multiple times throughout the self tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

fips: refactor ML-KEM tests so that key generation is separate

Encapsulation and decapsulation remain as their own CAST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

fips: add key generation name for ML-KEM CASTs

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)

Use linux-arm64 or the public ubuntu-24.04-arm runner image

dependent on whether this runs on the openssl/openssl repository
or a clone.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26855)

Various NULL checks

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643035
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643039
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643041
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643044
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643045
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643046

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26840)

EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26832)

Update oqsprovider git submodule and start testing with it again

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26848)

Provide aliases to ML-DSA without dashes

oqsprovider did not use dashes in the algorithm names for ML-DSA. Make
the transition smoother by also accepting the names without dashes as
aliases.

See also #26326 for the same thing for ML-KEM.

Signed-off-by: Clemens Lang <cllang@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26853)

Make CRYPTO_atomic_load/store use the same preprocessor guards

as the other CRYPTO_atomic_X functions.
All CRYPTO_atomic functions should use the same logic here,
just in case...

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

Cleanup atomic fallbacks in threads_pthread.c

the unused atomic stub functions make clang issue
unused function warnings -Wunused-function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

Enhance thread sanitizer CI tests

Related to issue #26798

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

cross-compiles.yml: Disable FIPS for cross compiles

When running tests things are too slow due to SLH-DSA POST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)

run-checker-daily.yml: Add memory sanitizer run with SLH-DSA enabled

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)

make-test: No verbose tar output

This just clutters the logs otherwise.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)

run-checker-daily.yml: Adjust the list of jobs

Some of the disablables are already disabled by default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)

Disable SLH-DSA in memory sanitizer

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)

Added new API to enable 0-RTT for 3rd party QUIC stacks.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26842)

Use OPENSSL_strdup instead of strdup

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643038

Also NULL check for the allocation.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26843)

fips: change SLH-DSA key generation to use a fast algorithm flavour

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26837)

slh-dsa: avoid pairwise test when doing key generation CAST

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)

ml-kem: avoid pairwise test when doing key generation CAST

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)

ml-dsa: avoid pairwise test when doing key generation CAST

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)

fips: add function to detect if the self tests are running

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)

SLH-DSA coverity fixes.

Fixes 1643092 and 1643093

Neither of these are major issues, but fixed anyway..

i.e. 1<<hm is bounded by the parameter set so this is not an issue
Not checking an error from WPACKET_memcpy() would also not cause an
issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26835)

Refactor EVP_SKEY initialization

Enforce that skeymgmt cannot ever be NULL in EVP_SKEY.

Also add missing allocation checks.

Fixes multiple issues found by Coverity.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26795)

Make org.openssl.winstore: work in openssl-ts

Fixes #26739

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26833)

Set op_num to 0

Here, op_num is just used for logging purposes (number of completed operations), so start it at 0

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643034

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26829)

Fix coverity finding

Coverity ID: 1643094

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26831)

ssl_lib.c: Check for NULL from SSL_CONNECTION_FROM_SSL()

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643027
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643028

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26824)

EC_get_buildin_curves does not return an error, this check is unnecessary.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

unused code has been removed

delete whitespace

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26719)

NULL checks for QUIC code

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643033
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643032
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643031
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26825)

CI: ssl-trace is enabled by default

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)

test/quicapitest.c: Fix build with no-ssl-trace

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)

fix: add check for NULL zalloc in tls-provider.c (reverse if statement)

CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26814)

Configurable import-time PCT for ML-KEM

And related cleanup.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26789)

slh-dsa: use fast flavours for FIPS Power Up Self Test

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26821)

testutil: remove unused buffer from stanza structure

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slh-dsa: update changes authorship

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slh-dsa: add key generation tests

These are reasonably fast so are not flagged as extended tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slhdsa: add Python script to convert NIST ACVP data to evp_test format

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slh-dsa: change the seed parameter name from entropy to seed

This brings it inline with the same parameter for ML-KEM and ML-DSA.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

evp_test: include signature generation and verification tests for SLH-DSA

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slh-dsa: add signature generation tests

This marks the first use of the extended test feature in evp_test.
The reason behind this is the amount of time the full SLH-DSA tests consume.
The non-extended tests chosen so that they exercise all of the algorithms
at least once and all the varying combinations of features for the fast
algorithms.

On my build machine the full test suite takes: 290 seconds.
With the reduction to a dozen tests it takes: 10.5 seconds.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

slh-dsa: add signature verification failure tests

These are fast and don't require reduction in number.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

evp_test: add a Verify-Message-Public test type

This is like Verify-Message but accepts a public key instead of a private one.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

testutil: increase the line length for reading stanzas

PQC algorithms and SLH-DSA in particular have very long lines of data.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

coverage: enable extended EVP tests

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

evp_test: add concept of extended tests to evp_test

These tests are not run by default, instead they run when the EVP_TEST_EXTENDED environment variable
has an integer value other than zero.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)

More consistent ML-KEM key checks

- Cross-check seed `z` value on import as well as load.
- In import/load When re-generating from a seed, check hash of any
  explicit private key when both provided.
- Avoid leak of expanded key encoding when load fails.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26812)

Typo fix

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26813)

Merge quic client and quic server interop CI

Now that quic server is merged, we can merge the CI jobs that test the
client and server interop tests

Fixes openssl/project#1105

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26804)

Add the SSL_NO_EOED macro test

test_no_end_of_early_data

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)

Add the SSL_NO_EOED internal macro

The TLS EndOfEarlyData message is not applicable in some scenarios (e.g., QUIC).
This adds a macro to handle this message.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)

ssl3_ctrl(): Fix condition in SSL_CTRL_GET_PEER_SIGNATURE_NAME

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26819)

Relax checking of supported-groups/keyshare ordering

quic interop testing showed that interop with the mvfst client was
failing, due to detecting mis ordering of supported groups and keyshare
extensions

This is strictly a mvfst problem to fix, but RFC 8446 indicates that we
MAY check the ordering but don't strictly have to.

We've opened an issue with the client to fix this, but in the interests
of client compatibility relax the ordering check so that, instead of
issuing a fatal alert, we just log a trace message indicating the
discrepancy

Fixes openssl/project#1106

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26818)

Fix memory leak in ecdsa_keygen_knownanswer_test

We allocate an EC_POINT with EC_POINT_new here, but in failing a
subsequent check, we don't free it, correct that.

Fixes #26779

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26799)

ML-KEM Add ACVP tests using latest values from

https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/
Which are parsed using mlkem_parse.py

The existing BoringSSL related .txt files have been left in place.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)

 ML-KEM: Modify existing ML-KEM keygen tests to not use custom data.

There are general input and output controls that are used instead.
Also fix a memory leak in keygen.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)

ssl_test: correctly handle ML-DSA being disabled

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)

mldsa: add run-checker workflow for no-ml-dsa option

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)

ml-kem: add ML-KEM to bulk disable cascade

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26807)

ml-dsa: test ML-DSA under FIPS

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26805)

Fix coverity issues

Fixes coverity issues 1642964, 1642965, 1642966, 1642968, 1642969

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26793)

Free hashtable prior to freeing atomic worker_lock

lhash_test uses a hashtable that may not be empty at the end of the test

Given that the free function frees the elements in the list and uses the
atomic worker_lock to do so, we need to free the hash table prior to
freeing the working lock to avoid the use of unallocated memory.

Fixes #26798

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26800)

Adds missing checks of return from XXX_up_ref().

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26294)

Do not call BIO_printf() from FIPS_MODULE

Fixes #26743

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26744)

OSSL_CMP_MSG_http_perform(): support using BIO from OSSL_CMP_CTX_set_transfer_cb_arg()

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26628)

Initial slh-dsa fuzzer

Current preforms the following operations

1) Generates arbitrary key pairs
2) Generates key pairs with parameters (both correct and incorrect)
   based on fuzzer input buffer
3) Exports and re-imports keys, confirming validity
4) Preforms Sign and Verify operations with optional parameters based on
   fuzzer input buffer

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26708)

SLH-DSA: Add EVP_PKEY_CTX_dup() support.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26701)

SLH_DSA: Make apps.c do_X509_REQ_verify() call work correctly.

- Added sigid_algs for SLH_DSA such that OBJ_find_sigid_algs() works.
- OBJ_sn2nid() was also being called, so the SN form of SLH_DSA
  algorithms needed to be added to the provider dispatch tables.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)

SLH_DSA: Add support for generating X509 certs via the openssl
command line app.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)

SLH-DSA cleanups

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

SLH-DSA More fixups

Also added slh_dsa_key_dup()

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

SLH-DSA: Remove legacy ASN1 method tables for SLH-DSA. Update to use
custom encoders for SLH_DSA decode_der2key.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

SLH-DSA cleanups

Addressed some review comments.
- Ref counting has been removed from SLH_DSA_KEY (EVP_PKEY is responsible
for the keys ref counting).
- Moved constants and prefetched objects into SLH_DSA_KEY.
- The SLH_DSA_HASH_CTX is still required since there are multiple
  contexts that need to propagate to a lot of functions, but it no
  longer contains the constants. Note that it also holds a pointer to
  the SLH_DSA_KEY.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

Add SLH_DSA key validation.

The pairwise test requires that the computed PK_ROOT key matches the
keys PK_ROOT value. The public and private key tests just require the
key elements to exist.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

Add SLH-DSA FIPS self tests

This requires a keygen test, as well as Sign/Verify tests for at least 1
sha2 algorithm and 1 shake related algorithm.

A pairwise consistency test has also been added to the key generation.

Note that self test datat for the signature is currently stored as a
sha256 digest in order to reduce the memory footprint.
(Since the signature size for sha2/shake using 128s = ~8K, and for 128f = ~17K)

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

Add SLH-DSA encoder/decoder support.

This required adding additional EVP_PKEY_ASN1_METHOD methods.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)

Address style check nits for SLH-DSA

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)