Prepare for 3.7

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Release: yes

make update

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Release: yes

Copyright year updates

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Release: yes

Release news and changelog for version 3.6

Release: yes

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28403)

Make update

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Implement EVP_KDF_CTX_set_SKEY

This allows to use a SKEY as input to a KDF derive operation.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Implement EVP_PKEY_derive_SKEY

Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Implement EVP_KDF_derive_SKEY

Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

We use evp_skey_alloc from several source files

It shouldn't be static

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Correctly dealing with refcount in EVP_SKEY

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Implementation of EVP_SKEY_import_SKEYMGMT

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Add GENERIC SKEYMGMT to the legacy provider

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Design document of using opaque object as symmetric key

Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28369)

Fix typos and whitespace

Added "the" before "use"
Add missing whitespace
Removed unnecessary apostrophe in FIPS.md

CLA: trivial

Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28362)

Document the OSSL_SELF_TEST_TYPE_PCT_IMPORT failure state

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

ml-kem: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

ml-dsa: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

ecx: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

ec: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

dh: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

rsa: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

Add OSSL_SELF_TEST_TYPE_PCT_IMPORT transient error state

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

add new error

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

test/bioprinttest.c: move the %n result to the field that is later checked

The test_n test implicitly assumed a certain union layout, as the %n was
writing to the union field in accordance with the length modifier being
tested, but comparison of the expected value was dan agains the val field,
and that is incorrect, especially on big-endian architectures.  Fix that
by explicitly assigning the result to the val field of the union and
updating the expected values where the resulting value overflows
into negative.

Fixes: 9deaf8383338 "test/bioprinttest.c: add some checks for integer and string printing"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28388)

test/bioprinttest.c: fix sloppy length modifier usage in int_data

Some test vectors used in int_data have mismatching (or, more
spercifically) missing length modifiers in conversion specifiers;
most of the time it has gone unnoticed, but on some architectures where
64-bit arguments supplied differently (sugh as mips and armv7) it led
to garbage being retrieved instead of the expected values.  Fix it
by properly providing proper length modifiers.

Fixes: 9deaf8383338 "test/bioprinttest.c: add some checks for integer and string printing"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28388)

slh-dsa: add a PCT for key import when in FIPS mode

Fixes #28182

Co-Authored-By: slontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28276)

test/bioprinttest.c: add some checks for integer and string printing

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

test/bioprinttest.c: check the output against libc's one as well

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

test/bioprinttest.c: constify test vectors

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

test/bioprinttest.c: use the whole buffer for checks

There is no need to decrement the size of buffer by 1, snprintf should
terminate the output with a \0.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: handle the case of 0 with zero precision

Per [1]:

    The result of converting zero with an explicit precision of zero
    shall be no characters.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: improve the precision handling in fmtint

Per [1]:

    * A negative precision is taken as if the precision were omitted.
    * The default precision is 1.
    * For d, i, o, u, x, and X conversion specifiers, if a precision
      is specified, the '0' flag shall be ignored.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: bring back the length modifier support for %n

For some reason, it has been removed in commit 15b337fa58ba "bio/b_print.c:
switch to int64_t as "greatest-width integer type".", despite being a part
of the standard in both ANSI C and POSIX.1-2001.  Bring it back for all
the supported length modifiers.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: make %n in line with other libc implementations

The standard[1] is pretty vague in its definition of the %n specifier
by using "the number of bytes written to the output so far", without
actually elaborating, whether only the actually written bytes, or the bytes
that would be written (but discarded) are used;  the consensus across
implementations, however, seems to gravitate towards the latter.  Track
the virtual "write position" separately and use its value when %n format
is occurred.  That also means that we cannot finish the output early
upon reach of the end of buffer (unless we made sure that no %n specifiers
occur in the remainder of the format string).

[1] https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: avoid integer overflow when reading width/precision

Both width and precision are "decimal digit strings" of unspecified size,
but we can realistically cap it at INT_MAX.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: always terminate output with \0

Man page states that the result is terminated with \0 on error, however,
when the jump to the "out" label is performed in _dopr, writing out \0
is skipped.  Rearrange the end of the routine to make the "out" part
include the overflow calculation and the final \0 writing.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: consolidating print arguments in a structure

buffer/sbuffer/maxlen/currlen are passed together between _dopr, fmt*,
and doapr_outch;  consolidate them together in a structure and pass
it instead.  A preparatory commit before introducing a separate "write
position" parameter, that is also to be passed around.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: reset max to zero if empty precision string is provided

Per [1]:

    a null digit string is treated as zero.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: add 't' (ptrdiff_t) length modifier

As specified by POSIX.1-2001 and C99.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: fix space padding calculation

Sign, prefix, and zero padding should count towards precision.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: '-' flag has priority over '0'

Per [1]:

    If the '0' and '-' flags both appear, the '0' flag is ignored.

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: avoid superfluous zero padding in %#o

Zero prefix in the alternative octal form count towards precision,
per [1]:

    For o conversion, it **shall increase the precision**...

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: no prefix for zero value in alternative form

Per [1] (emphasis is added):

    - For o conversion, it shall increase the precision,
      **if and only if necessary**, to force the first digit of the result
      to be a zero (**if the value and precision are both 0,
      a single 0 is printed**).
    - For x or X conversion specifiers, a **non-zero** result shall have
      0x (or 0X) prefixed to it.

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: handle negative width argument

Per [1]:

    A negative field width is taken as a '-' flag followed by a positive field
    width.

So, printf("%-*d", -12, 34) should lead to a 123-wide left-aligned output,
"34          ".

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: correctly print 0X prefix for X conversion

Per [1]:

   For x or X conversion specifiers, a non-zero result shall have 0x (or 0X)
   prefixed to it.

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

crypto/bio/bio_print.c: support hh length modifier in _dopr

Per [1]:

    hh
        Specifies that a following d, i, o, u, x, or X conversion specifier
        applies to a signed char or unsigned char argument

[1] https://pubs.opengroup.org/onlinepubs/9799919799//functions/printf.html

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28177)

Add SKEYMGMT support to the FIPS provider

And extend the SKEY managers listing test with a FIPS case.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28339)

NOTES-WINDOWS.md: correct the Windows context macro name

Fix incorrect Windows context macro spelling "OPENSSL_WINCTX"
by replacing it with "OSSL_WINCTX".

Reported-by: https://github.com/sjan1970
Resolves: https://github.com/openssl/openssl/issues/28329
Fixes: 630e3a168446 "Change WININSTALLCONTEXT to OSSL_WINCTX"
Complements: c2ab75e30a21 "doc: fix OSSL_WINCTX spelling windows notes"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28338)

doc: Fix function name in example code

CLA: trivial
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28334)

aes-s390x.pl: Initialize reserved and unused memory

The reserved bytes in the parameter block (bytes 0-11) for the KMA
instruction should be set to zero to be compatible in case of future
architecture changes.

While at it, also the following unused parts of the parameter block
(bytes 48-63) are also cleared to avoid false positives with various
memory checkers like valgrind.

As it makes - performance wise - no difference to process 12, 48 or 64
bytes with one XC call, but two XC calls are slower than one call, the
first 64 bytes of the parameter block will be cleared with a single XC
call. This will also initialize the counter in the parameter block
(bytes 12-15), although it is not strictly necessary.

Co-developed-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28315)

doc/man3/SSL_poll.pod: mention SSL_POLL_EVENT_{EL,IC} in SYNOPSIS

While the constants are present since the initial commit 2a5ee0a08d2c "QUIC:
Add polling API", they weren't initially documented in c9b0df2250e2 "QUIC:
Add manpage for SSL_poll" (probably due to absence of the QUIC server
mode support at the time), and mentioned for the first time in b20f55702100
"QUIC: Update SSL_poll documentation", but without the accompanying update
of the SYNOPSIS section.  Rescind the omission by updating it as well.

Complements: b20f55702100 "QUIC: Update SSL_poll documentation"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28303)

Add targets to skip build of non-installable programs

These make it possible to split the build into two
parts, e.g., when tests should be built with different
compiler flags than installed software.

Also use these as dependecies where appropriate.

Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28302)

rebase to master fixing some missing group references

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26965)

Fix: Add free to avoid memory leak.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28289)

Correct fixed cert validity end date in oqsprovider testing

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28350)

Fix `VC-WIN64-CLANGASM-ARM` target

This was broken for Windows ARM64 in #22949

The comments were in the wrong format, and a define check of `_M_ARM64` was missed in places

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27958)

params: add features to param parser generator

Support BN as an available type.

If a param name is repeated, use the extra fields for the first not the last.

Include the parameter name in a comment in the generated parser.  This
Fixes #28257

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28273)

dh: add FIPS 140-3 PCT on key generation

According to FIPS 140-3 IG 10.3.A Additonal Comment 1, a PCT shall be
performed.

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28280)

fix(pkcs12): prevent PKCS7 memleak in p12_npas.c

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28292)

Add design doc for rfc4514 DN output format

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28104)

crypto\cms\cms_kem.c: Add ASN1_TYPE_free when EVP_CIPHER_param_to_asn1() fails

Signed-off-by: Nachel72 <Nachel72@outlook.com>
CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28210)

Fix null pointer check in pkey_dh_derive to ensure both keys are set

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28259)

Fix: Check for wrong object. The converted sc should be checked instead of the original s

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28248)

Ignore generated assembler files for cpuid functions

The architecture-specific code to detect CPU features at runtime is
generated from Perl Assembler. Modify the ignore pattern to match the
generated .S files for all architectures.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28318)

Fix reallocation failure condition in qtx_resize_txe()

Returning the same pointer does not mean that the reallocation failed,
it would also prevent updating alloc_len down below.
This is similar code and a similar change to 043a41ddee.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28317)

Android: Enable 16 KB ELF alignment for `arm64-v8a` and `x86_64` platforms

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28277)

changes: add a CHANGES.md entry covering the generated parameter name decoding

This isn't a user visible change but it's sufficiently noteworthy to
justify a changes entry.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

keymgmt: update template

The template file is exhibiting some bitrot:
1. convert to using generated param name decoders
2. add the missing `template_imexport_types` function.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

ecx: convert to using generated parameter decoding

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

lms: convert to using generated parameter decoding

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

slh-dsa: convert to using a generated decoder

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

key management: rename key management files in anticipations of generated decoding

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28275)

Make error checks on RSA_public_decrypt() consistent

Some are only checking for a value < 0, some for <= 0, some for == 0, etc.
The documentation tells us that -1 is returned on error, so at least the
== 0 ones are wrong. In general, the return values are checked
inconsistently. This patch makes the return value checks consistent to
the form that seems to occur most.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28306)

Make SSL_poll() and SSL_shutdown() better friends

Current QUIC stack may leave connection monitored by SSL_poll() to stale
during regular shutdown.  The issue is triggered when ACK for client's
FIN gets delayed. The sequeance of operations to trigger
the stale of QUIC connection at client goes as follows:

- application calls SSL_shutdown() on connection,
  the shutdown can not proceed, because bi-directional
  stream must be flushed. The client awaits ACK from
  server acknowledging reception of FIN on client's stream

- the stream object gets destroyed, because application
  received all data from server.

- application updates poll set and passes to SSL_poll()

- ssl poll ticks the engine. Engine receives delayed ACK
  and marks stream as flushed. At this point the SSL_shutdown()
  operation may proceed given the application calls the
  SSL_shutdown(). However there is no mechanism to make SSL_poll()
  return so application is unable to proceed with its event
  loop where SSL_shutdown() may get called.

This change introduces ossl_quic_channel_notify_flush_done() function
which notifies channel when all streams are flushed (all FINs got ACKed).

The first thing SSL_shudown() does it calls ossl_quic_stream_map_begin_shutdown_flush().
The function walks list of all streams attached to channel and notes how many
streams is missing ACK for their FIN. In our test case it finds one such stream.
Call to SSL_shutdown() returns and application destroys the SSL stream object
and updates a poll set.

SSL_poll() gets called. The QUIC stack (engine) gets ticked and reads data
from socket. It processes delayed ACK now. The ACK-manager updates the
stream notifying the server ACKs the FIN sent by client. The stream
is flushed now. Thw shutdown_flush_done() for stream gets called on
behalf of ACK manager.

The shutdown_flush_done() does two things:
- it marks stream as flushed
- it decrements the num_shutdown_flush counter initialized
  be earlier call to ossl_quic_stream_map_begin_shutdown_flush()
  called by SSL_shutdown()
The change here calls ossl_quic_channel_notify_flush_done() when
num_shutdown_flush reaches zero.

The ossl_quic_channel_notify_flush_done() then calls function
ossl_quic_channel_notify_flush_done(), which just moves the state
of the channel (connection) from active to terminating state.
The change of channel state is sufficent for SSL_poll() to
signal _EC event on connection.

Once application receives _EC event on connection it should
check the state of the channel/reason of error. In regular case
the error/channel state hints application to call SSL_shutdown()
so connection object can proceed with connection shutdown.
The SSL_shutdown() call done now moves channel to terminated
state. So the next call to SSL_poll() can signal _ECD which
tells application it's time to stop polling on SSL connection
object and destroy it.

Fixes openssl/project#1291

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28116)

Fix a race in by_store_subject

When looking in the stack of objects in the store we need to ensure we
are holding a read lock for the store.

Issue detected via thread sanitizer after the test from the previous
commit was added.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28198)

Add a test for accessing an X509_STORE from multiple threads

Check we don't have any threading issues when accessing an X509_STORE
simultaneously

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28198)

Don't keep the store open in by_store_ctrl_ex

Previously #27529 made a change to `by_store_ctrl_ex` in order to open
the OSSL_STORE early. The reason given in that PR is:

"This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
get to see possible errors when the URI is loaded"

That PR then kept the store open until cache_objects is called and then
reused it. Unfortunately by the time cache_objects() is called we could be
in a multi-threaded scenario where the X509_STORE is being shared by
multiple threads. We then get a race condition where multiple threads are
all using (and ultimately closing) the same `OSSL_STORE_CTX`.

The purpose of keeping the `OSSL_STORE` object between by_store_ctrl_ex()
and `cache_objects` is presumably an optimisation to avoid having to open
the store twice. But this does not work because of the above issue.

We just take the hit and open it again.

Fixes #28171

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28198)

Fix S390 ECDSA Deterministic mode fails tests in FIPS mode.

Fixes #28313

Recently Deterministic ECDSA was added to the FIPS provider.

I cant run s390 directly but I suspect the call to
ossl_ec_group_do_inverse_ord() fails because it passes a NULL bn_ctx.

This potentially then calls ec_field_inverse_mod_ord() that has code in
it that fails in fips mode if the BN_CTX is not passed.

It cant create it internally since it does not know what the OSSL_LIB_CTX is,
which is required when creating a BN_CTX.

The solution is to create a BN_CTX that uses the ec_key lib ctx and pass
that in.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28314)

fips: upgrade self-test KATs to reduce SHA-1/SHA-224 usage

FIPS 140-3 IG states that SHA-224 needs standalone KAT, if it is
implemented without SHA-256. As OpenSSL implements SHA-256, upgrade
existing higher level KAT from SHA-224 to SHA-256 without adding
SHA-224 digest KAT.

Upgrade KATs that use SHA-1 to SHA-256, and add explicit SHA-1 KAT.

SHA-1 and SHA-224 are promised to be deprecated by 2030, as per draft
[NIST SP 800-131A Rev. 3](https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd).

With upgrades to these KATs it makes it easier to build a modules with
SHA-1 and SHA-224 marked as unapproved services, or removed
altogether.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28307)

fips: add news & changes entry for DetECDSA

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

fips: update provider-signature docs for DetECDSA

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

Add DetECDSA self test, signature is one byte shorter somehow

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

fips: enabled deterministic ecdsa tests

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

fips: make PROV_NAMES_HMAC_DRBG_KDF internal only

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

fips: implement deterministic ECDSA

[FIPS 186-5](https://doi.org/10.6028/NIST.FIPS.186-5) approved
deterministic ECDSA in the same manner as [RFC
6979](https://datatracker.ietf.org/doc/html/rfc6979).

Thus add deterministic ECDSA capability to the FIPS provider.

DSA signature generation has been deprecated and removed from FIPS
186-5, thus deterministic DSA signature creation is not added to the
FIPS provider.

Testing can be done by performing 20-test_dgst.t but need to version
guarded against different FIPS provider versions. Thus is left out of
this PR for now.

It is not clear if HMAC-DRBG-KDF should be exposed publically for
direct usage as an approved usage, or if it should be marked as
unapproved or better yet made completely internal to the FIPS
provider.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28213)

apps/speed.c: Support more signature algorithms

Some signature algorithms (e.g., ML-DSA-65) cannot be initialized
via EVP_PKEY_sign_init, so try also EVP_PKEY_sign_message_init
before reporting an error.

Fixes #27108.

Signed-off-by: Pavol Žáčik <zacik.pa@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28224)

apps/speed.c: Disable testing of composite signature algorithms

Creating public key context from name would always fail
for composite signature algorithms (such as RSA-SHA256)
because the public key algorithm name (e.g., RSA) does
not match the name of the composite algorithm.

Relates to #27855.

Signed-off-by: Pavol Žáčik <zacik.pa@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28224)

Avoid doublefree of OCSP_SINGLERESP

It is referenced by OCSP_BASICRESP and will be
freed when that is freed.

Issue and a proposed fix reported by Stanislav Fort (Aisle Research).

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28300)

Remove unnecessary fetch-depth in GitHub Actions workflow

Fixes #28107

The build_quic_interop_container.yml workflow does not need the
full git history. Removing fetch-depth: 0 reduces unnecessary checkout.

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28299)

Test setting a client to send a key share not allowed in TLSv1.3

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28283)

Fail immediately if we have no key shares to send

If we are configured in such a way that we have no valid key shares to
send in the ClientHello we should immediately abort the connection.

Fixes #28281

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28283)

test/stack_test.c: check sk_sint_push result in test_int_stack

coverity complains about possible double free, which does not seem
to be the case with the current implementation, but it still
would be nice to check and reacto on unexpected sk_sint_push result.

Complements: 9837496142cf "Unit tests for crypto/stack."
Resolves: https://scan5.scan.coverity.com/#/project-view/65249/10222?selectedIssue=1662046
Related: https://github.com/openssl/project/issues/1317
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28238)

test/mem_alloc_test.c: tfix in test_xaligned_alloc

Change "=" to "==" in "if ((exp == EXP_NONNULL) ...".

Fixes: d090695101a9 "test: add a sanity test for memory allocation functions"
Resolves: https://scan5.scan.coverity.com/#/project-view/65279/10222?selectedIssue=1662047
Resolves: https://scan5.scan.coverity.com/#/project-view/65279/10222?selectedIssue=1662049
Related: https://github.com/openssl/project/issues/1317
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28238)

test/mem_alloc_test.c: avoid referencing potentially freed old_ret

Referencing to old_ret after it has been freed by realloc is UB, so drop
its usage in the printing routine, and don't check it for being non-NULL
(as it is not a mistake to call free() on NULL pointer anyway).

Fixes: d090695101a9 "test: add a sanity test for memory allocation functions"
Resolves: https://scan5.scan.coverity.com/#/project-view/65279/10222?selectedIssue=1662052
Related: https://github.com/openssl/project/issues/1317
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28238)

test/sslapitest.c: tfix in row allocation in create_new_vfile

sizeof(*row) and not sizeof(row) is supposed to be used for the array
allocation.

Fixes: 76fd7a1d6192 "Add a test for SRP"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1662054
Related: https://github.com/openssl/project/issues/1317
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28238)

Fix the return value of OBJ_create

OBJ_create is supposed to return NID_undef on error
and the newly created NID on success.

Fixes: 88a1fbb8d1b2 ("reduce lock contention when adding objects to ADDED_OBJ hash table")
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28293)

BIO_dgram: Fix BIO_CTRL_DGRAM_QUERY_MTU for IPv4-mapped IPv6 addresses

Ensure the correct IP header size is subtracted by reusing
dgram_get_mtu_overhead(), which handles address families properly.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28088)

We should not remove symlinks in submodules

Fixes #28285

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28286)

Missing .gitignore entries

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28282)

CI: cross-compile: riscv: enable more tests on extensions

[riscv ci]

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24403)