git.ipfire.org Git - thirdparty/openssl.git/log

Add a test for mismatch between the pkey and sigalg

We add a test for sending an mldsa65 sigalg while using an mldsa44 key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29019)

(cherry picked from commit 236bc0d2f919bcd6a91c7dc8a0a3a1088089d1c8)

Use the actual NID for provided signature algorithms

Prior to this change we could confuse the nid used in the pkey with the
nid in the sigalg and mistakenly accept signatures by the wrong algorithm.

Fixes #28762

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29019)

(cherry picked from commit cbfc8cc3dc4f2b437f4dd65a266c9f8ff4cd5781)

add trivial pre-commit.ci config to avoid CI failure

Reference: https://github.com/pre-commit-ci/issues/issues/122

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29050)

Modernize header macros for C23 compatibility

Replace old-style (int (*)()) and (char *(*)()) casts with proper typed
prototypes (i2d_of_void *, d2i_of_void *, void *(*)(void)) to comply
with stricter C23 function pointer rules.

Fixes #27938

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29048)

(cherry picked from commit 0b7afd6d303d150c13c04f66e77fcbcdaeec2a84)

Rename SSL_CERT_LOOKUP.nid to pkey_nid

Hopefully, this will help further clarify the intent of this
SSL_CERT_LOOKUP field to future developer.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29027)

(cherry picked from commit 96459b12aa094ea35c71263422d2f101ea724351)

Fix NID bug in SSL_CERT_LOOKUP array construction

The SSL_CERT_LOOKUP NID should be for the public key algorithm (what is
often called the "key type". Yet, when populating the SSL_CERT_LOOKUP
table with 'ssl_load_sigalgs', only the sigalg name is used to find a
NID.

This is perfectly OK to do, *if* the sigalg and the associated key type
share the same name. However, that's not always the case.

This change infers the key type name in 'ssl_load_sigalgs' the same way
as it was already done in 'add_provider_sigalgs'.

Related-to: https://github.com/openssl/openssl/pull/29019#discussion_r2472219647
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29027)

(cherry picked from commit aedcdc6d0f5bfb16af7d0065157af84e671159e0)

Fix util/find-doc-nits' check_env_vars to look for files with 'git ls-files'

If that fails, it will fall back to finding the files with Find::file.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28601)

(cherry picked from commit 4da42df5d332987fd01d259e5c77d57be432bd84)

Fix util/find-doc-nits' check_env_vars to show where envvars were found

This displays the list of files with line number for each envvar.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28601)

(cherry picked from commit 56d138ec3d0fc77630b5ed8dcced3539018294e1)

Fix util/find-doc-nits' environment variable check exceptions

Some files in @except_env_files are located in the build directory,
not the source directory.

Furthermore, because the files and directories in @except_dirs and
@except_env_files may look different than the elements in what find()
returns, realpath() must be used to ensure that file name comparison
matches when it should.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28601)

(cherry picked from commit 29fa220a36012b94923e8bc0d9b048688aab9f27)

Move CI jobs with macos large runners

Running CI jobs on MacOS large runner on each pull request
is problematic for forks. These runners are not free and require
billing to setup. Therefore it makes more sense move macos-14-large
and macos-15-large into os-zoo.yml which is scheduled to run nightly.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29007)

(cherry picked from commit f7a284b49d11dc5cb8012db157743ffd7df54c59)

bss_dgram: set *num_processed = 0 in error path

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28913)

(cherry picked from commit eedb6df889fb69b9c4571be5616fa22e6b62dc7c)

rc4: Remove the pointless if() operator, its condition is always true

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28827)

(cherry picked from commit 10093b63dcdbfa52ad59d53b20bdea9bfa2c5825)

apps/s_time: reset reused SSL with SSL_clear in doConnection

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28911)

(cherry picked from commit 6f6948b21503d0ef8bea3ea6321c40dbbf4e5c9c)

comp/zstd: make bio_zstd_read return -1 on hard errors

Split NULL out param from zero outl. Return -1 on malloc failure and
NULL parameter. Keep 0 only for outl <= 0 and clean EOF. This lets
callers distinguish errors from empty reads without inspecting the
error queue.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28908)

(cherry picked from commit 5871953822fb02bb651abf60dfc4a0785a5a3caa)

store: check for NULL uri argument

Fixes #28978

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28980)

(cherry picked from commit e9e643bc580e4ba0c6f8f9b4dd2ce59397b1b786)

FIPS: Fix RSA X.931 padding check

The padding check was not complete and would miss the Message
Signature API case, which also needs to be rejected.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28741)

(cherry picked from commit b632daa5255614db0a305cd2f4eaf84d1816b540)

threads: Replace CRYPTO_THREAD_clean_local_for_fips() with CRYPTO_THREAD_clean_local()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28781)

(cherry picked from commit 9f87698878c25b53f5ddb662ae8eb9bcf80d7959)

threads: Cleanup master key sparse array in OPENSSL_thread_stop()

Fixes #28770

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28781)

(cherry picked from commit 0655eaf4f6e428d3c2e7c1c1937a852c52fcaa5c)

Fix memory leak in x509_pubkey_ex_d2i_ex()

If the call to ASN1_item_ex_d2i() from x509_pubkey_ex_d2i_ex() fails
*pval is freed by asn1_item_ex_d2i_intern()->ASN1_item_ex_free()->ossl_asn1_item_embed_free()
inside the ASN1_item_ex_d2i() function without freeing the
string buffer X509_PUBKEY::propq that was previously allocated
in x509_pubkey_ex_new_ex() and we lose the pointer to this buffer.

The function we are fixing here is one of the functions used
to define X509_PUBKEY - so any operations that work directly
on X509_PUBKEY_INTERNAL should be prevented from freeing
the structure because they don't know how to handle it.

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27333)

(cherry picked from commit 11e1ea9d4d0c9a5e84b944535332aebf673e82f0)

Copy impls stack when calling ossl_method_store_do_all

PR https://github.com/openssl/openssl/pull/24782 introduced a copying of
the algs stack in ossl_method_store_do all, so that the subsequent
iteration of elements through alg_do_one could be done without a lock,
and without triggering a tsan error as reported in:
https://github.com/openssl/openssl/issues/24672

However, the problem wasn't completely fixed.  Issue:
https://github.com/openssl/openssl/issues/27726

Noted that, sometimes we still get a crash when iterating over each algs
impls stack.  This occurs because, even though we've cloned the algs to
a private data area, the impls stack for each alg still points to shared
data, which we are accessing without the benefit of a lock.  Because of
that, if some other thread calls a function that mutates the impl stack
(say ossl_method_store_remove()), we may encounter a NULL or garbage
value in one of the impl stack values, leading to an unexpected NULL
pointer or simmilar, which in turn leads to a crash.

Unfortunately we can't use a lock to create exclusive access here, as
there are several paths that lead to a recursive mutation of the stack,
which would deadlock.

So the only way that I see to prevent this (which is admittedly ugly),
is to not only clone the alg stack, but to duplicate each algs impl
stack with the read lock held, prior to doing the iteration.

Further, we've been unable to test this, as the problem is rare, and we
don't have a solid reproducer for the issue, but visual inspection
suggests this should fix that.  Hopefully:

Fixes #27726

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28783)

(cherry picked from commit 9ef4f426157e8a100b816c962fea1a168010bde2)

clang deprecates sprintf on macos

test/threadstest.c:1376:9: error: 'sprintf' is deprecated.

The same issues is in the ossl-nghttp3-demo.

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28903)

(cherry picked from commit 60e699a4549779f72b8621415b7565d422127285)

Scope aes_cfb128_vaes_encdec_wrapper to x64

This function is only used on x64 and relies on other functions which
are only implemented for x64.
Fixes #28745.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28792)

(cherry picked from commit c20d4704e9e99a89d29f5ee848f9498694388905)

CMP client: fix three memory leaks in error handling of the polling mechanism added in 3.3

These are in poll_for_response(), OSSL_CMP_try_certreq(), and OSSL_CMP_exec_certreq().

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/28840)

(cherry picked from commit c2e845914a4f999183ceb950e915c5525ccdf643)

ci.yml: Update macos runners as macos-13 is discontinued

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28900)

(cherry picked from commit 40b22874b12b8c1aade772912258c120a49b9212)

Fixes for NonStop builds on 3.5 to handle OS platform header file changes.

This changes handles the introduction of _POSIX_VERSION into the NonStop x86
header files that tricks OpenSSL into thinking that ucontext.h is available.

Fixes #28498

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28769)

(cherry picked from commit fb2f239ca1bd05f609e9e1e06b4b84f7f628d21b)

Serial submission policy

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28897)

(cherry picked from commit ac35ce393184736156460f2cb28c4253ece2e9d3)

bss_dgram.c: Fix potential buffer overread and remove asserts

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28896)

(cherry picked from commit b9d19562c0e88e31f43c10126dc91cad9e720953)

bio_sock: fix inverted BIO_lookup return value check

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28862)

(cherry picked from commit 1c1dcfc269c35e3f8fdbc72b78378aac90a61a81)

freebsd ktls: avoid unaligned 16 bit length store in ktls_read_record

This prevents SIGBUS on strict alignment architectures when p+3 is not aligned
for 16 bit access. Behavior is unchanged on x86 and matches the Linux path.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28860)

(cherry picked from commit c33120d0e403b4079e5104fd20040a51930e8d8e)

Do not allow zstd 0.9

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28843)

(cherry picked from commit 86780465afb8680f5697c3047b7f0027dd6a04cc)

Correct error code in raise in bio_zstd/brotli_flush()

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28839)

(cherry picked from commit 604d926abb875a88bef80eda4268390a3c7982d0)

NEWS.md: add missing SP 800-208 link

It was referenced, but the relevant link hasn't been added to the Links
session. Fix that omission.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28732)

Fix wrong buffer and version in outgoing msg callback

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28816)

(cherry picked from commit f7c0fcf0282435687010a34184d4248566008c35)

apps/s_socket: fix double close of listening socket when naccept==0

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28813)

(cherry picked from commit 76b4fa346c364cccc9123efdeac95e5dc85f0a75)

Fix off-by-one overflow in the AST resubmit

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28811)

(cherry picked from commit 3aa2f3a4566f34e99050efdb074fc1375b1572ad)

s_server: print program not, not port

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28807)

(cherry picked from commit 0d3efc875483d212b4cc2082247bf6abb2b56aca)

Disallow Message sequence number 2 in DTLSv1_listen

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28788)

(cherry picked from commit dc242b16954552c7589a6c2ea829c2a888878f27)

ssl: fix OOB write in SSL_get_shared_ciphers when no shared ciphers

When no cipher names are appended, p remains at buf and the unconditional
p[-1] = '\0' underflows. Only NUL-terminate if at least one cipher was written;
otherwise return an empty string safely.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28785)

(cherry picked from commit 680491a2a7403fc6e5e1759e0eabeceeacaf37f9)

CMS: Produce error when AEAD algorithms are used in enveloped data

Fixes GH-21414

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27772)

(cherry picked from commit 2dda0c50eafc1de8a2c008fbf60340ba5e60bfb3)

apps/cmp.c: must not try acting as server if -reqout_only option is given

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28891)

(cherry picked from commit 82fb46debc1b059fb876d0ba3f5594e8135f6ccb)

apps/cmp.c and doc/man3: add clarifying comments and doc line on CMP context used in two function calls; move one of these calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28891)

(cherry picked from commit 3e77acbff1991ebaae0dcaa41e24a26e408cc159)

Correct assembler version checking in perlasm scripts

Fixes #20520

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28901)

(cherry picked from commit 9820582da330151a1238a33e5c6e23ed31324164)

http_client.c: make sure to raise error 404 (also in case of further errors like content type mismatch)

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28895)

(cherry picked from commit 5aaf9746f649d15b3ad006acdc6a958819acc536)

quic: pass is_write to quic_classify_stream in quic_get_stream_error_code

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28820)

(cherry picked from commit 2466b57b893503f602622ad4f7cba1f3a2585ec0)

Update size check condition for probable primes to align with FIPS 186-5.

Fixes #28540

In FIPS 186-4 (Table B.1), the upper bounds for probable primes p and q were
defined using strict inequalities. In FIPS 186-5, Table A.1 replaces the
previous Table B.1 (dropping the nlen=1024 case) and revises the upper bound
condition to use weak inequalities.

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28540)

(cherry picked from commit 1d0a29d557fa70dfe0e7286e61f552c1b99d1921)

ssl: call SSLfatal on realloc failures in extract_keyshares

Initial malloc path already does this. Realloc path went to failure
without recording a fatal alert.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28873)

(cherry picked from commit 43cddc534eebf33c301bf2fabed8fa52fb92526c)

bio/dgram: use IPV6_PMTUDISC_* with IPV6_MTU_DISCOVER

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28809)

(cherry picked from commit e4b3f5fee947ae5915437ca5ba6a248c6720223b)

bio/dgram: fix local addr clear for i-th message

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Fixes #28871

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28808)

(cherry picked from commit ad26aee904413119c21ae1dafb10a156d0474e72)

Fix an error check for EVP_PBE_CipherInit_ex()

As pointed out during the review for the recent security issue in this
file, this error check is incorrect: as documented, this function has
the usual Boolean return values.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28727)

(cherry picked from commit f0efd026f7d69da97ec8f3b05f05a322e98fb21f)

ktls: move ktls_enable() within ktls_start()

On linux ktls can only be enabled on established TCP sockets.
When SSL_set_fd() is called before the connection is established
ktls_enable() fails and ktls is not setup.

This moves ktls_enable() call within then ktls_start() function.
Multiple calls to ktls_start() will trigger additional ktls_enable()
calls which fail with EEXIST, but do not affect the ktls socket.

CLA: trivial

Signed-off-by: Ulrich Weber <ulrich.weber@gmail.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27908)

(cherry picked from commit f23f706a26f2e7cd5dd5221d57e2d0db28530f4e)

- remove CYGWWIN (requested by Brandt)

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28759)

(cherry picked from commit f2917ee0e0b9e5dd34a6a6be8aaca0fe7a64c8a6)

- fix suggested by Bernd

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28759)

(cherry picked from commit 1ec5811d0f9d049d4ffa169d79e63deeb70a251b)

OPENSSL_SYS_WINDOWS is also enabled for mingw build

the test_n() in bioprinttest.c must differentiate between
MSVC runtime libc and ming runtime libc. The function
_set_printf_count_output() must be called when openssl
is linked with MSVC libc only.

Fixes #28679

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28759)

(cherry picked from commit af3a3f8205968f9e652efa7adf2a359f4eb9d9cc)

Check return code of BIO_ADDR_rawaddress

Fixes coverity issue: https://scan5.scan.coverity.com/#/project-view/64471/10222?selectedIssue=1666584
Thank you for the report!

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/28751)

(cherry picked from commit 7fb9163586234ed9eecf95ae2fd7185a9dcb556e)

Reduce Max number of commands handled per fuzzer pass in quic-lcidm.

We've gotten a few recent reports of a hang in the quic-lcidm fuzzer:

https://issues.oss-fuzz.com/issues/448510502

It looks pretty straightforward (I think).  The fuzzer input buffer is
used in this particular case to randomly issue commands to the lcidm
hash table (add/delete/query/flush/etc).

The loop for the command processing (based on the input buffer), is
limited to 10k commands.  However the fuzzer will on occasion provide
very large buffers (500k) which easily saturate that limit.  If the
input buffer happens to do something like get biased toward mostly
additions, we wind up with a huge hashtable that has to constantly grow
and rehash, which we've seen leads to timeouts in the past.

Most direct fix I think here, given that this is something of an
artificial failure in the fuzzer, is to simply clamp the command limit
more.

Fixes openssl/project#1664

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28724)

(cherry picked from commit 01c7958f2359e951a95350affb6b178fb50fed03)

tests: temporarily skip MLDSA pkcs11-provider test

External pkcs11-provider test requires at least kryoptic 1.2 for
MLDSA tests. But the current fedora:latest (42) still contains
kryoptic 1.1 and hence we need to temporarily disable MLDSA tests
until Fedora 43 is released.

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28716)

(cherry picked from commit 2b97f4d300f18b209983046f49e12f3028ba79f5)

Update pkcs11-provider submodule (663dea3)

Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28716)

(cherry picked from commit 786cb9680f1ea700262120333e52b20bdc61ceb5)

ts_conf: fix memory leak in TS_CONF_set_policies

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28686)

(cherry picked from commit 1f3a6602a13b382c0f09d6659e0d49ec2e41646d)

Fix riscv64 chacha crash due to unaligned data

The linux-riscv64 test machine crashes due to unaligned data,
when the V extension is enabled, while QEMU seems to have no
problems with unaligned data.

So check for aligned data and fall back to C code in case the
input or output values are unaligned.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28684)

(cherry picked from commit 22417bc14d6bde173425ba4f87c68be0cf394fa4)

Enable the V extension in the OS-Zoo CI job

and also fix the unintentional omission of the ZBA extension,
since the first word in the OPENSSL_riscvcap environment variable
is ignored, because it is assumed to be the processor base
architecture, e.g. something like RV64GC.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28684)

(cherry picked from commit 0e5e84c48690ecab4eda7cbee948b791623b137a)

Fix Memory leak in CMS_EncryptedData_set1_key

When CMS_EncryptedData_set1_key is called repeatedly it will
leak data on the second call. This was because
cms->d.encryptedData was already set and needed to be cleared
before the call to M_ASN1_new_of.

Fixes: #28606
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28668)

(cherry picked from commit 7de825efa26d136c7bb118156190437bdcf130b7)

Prepare for 3.6.1

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

Prepare for release of 3.6.0

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

make update

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

Copyright year updates

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

CHANGES.md, NEWS.md: update for 3.6.0

* Add the release date for 3.5.4
* Various touch-ups aimed at improving consistency of the news
* ffixes, wfixes

Release: Yes
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28712)

CHANGES.md, NEWS.md: update for 3.5.4

3.5.4 CHANGES.md includes the following:
* https://github.com/openssl/openssl/pull/28415
* https://github.com/openssl/openssl/pull/28573
* https://github.com/openssl/openssl/pull/28603

3.5.4 NEWS.md includes the following:
* https://github.com/openssl/openssl/pull/28603

Release: Yes
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28712)

Add CHANGES.md and NEWS.md updates

Including a few corrections of the previous entries.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>

use_proxy(): Add missing terminating NUL byte

Fixes CVE-2025-9232

There is a missing terminating NUL byte after strncpy() call.
Issue and a proposed fix reported by Stanislav Fort (Aisle Research).

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 6bca15039e99d37ce3a3564eb862a3b1ff40e63d)

ecp_sm2p256.c: Remove unused code

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 56c89cd2de75055ecf4b705824fb354631d5d810)

SM2: Use constant time modular inversion

Fixes CVE-2025-9231

Issue and a proposed fix reported by Stanislav Fort (Aisle Research).

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit dff94dba75490d03926e77be9f2da3bcf4485820)

kek_unwrap_key(): Fix incorrect check of unwrapped key size

Fixes CVE-2025-9230

The check is off by 8 bytes so it is possible to overread by
up to 8 bytes and overwrite up to 4 bytes.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(cherry picked from commit 9c462be2cea54ebfc62953224220b56f8ba22a0c)

Revert "fips: remove redundant RSA encrypt/decrypt KAT"

This reverts commit 635bf4946a7e948f26a348ddc3b5a8d282354f64.

During code review for FIPS-140-3 certification, our lab noticed that
the known answer test for RSA was removed. This was done in the above
commit, as part of
https://github.com/openssl/openssl/pull/25988

Under the assertion that FIPS 140-3 Implementation Guidance section D.G
had relaxed the requirements for testing, obviating the need for this
test.

However, for the 3.5 FIPS-140-3 certification we are adding assertions
for support of KAS-IFC-SSC, which follows FIPS-140-3 I.G section D.F,
which does not contain the same relaxed constraints. As such we need to
reintroduce the test.

While the specifics of the I.G requirements are slightly different in
D.F (allowing for other, potentially less time-consuming tests), the
most expedient path forward here is to simply re-introduce the test as
it existed previously, hence the reversion of the above commit.

Fixes openssl/private#832

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28676)

(cherry picked from commit 3206bb708246a97b281133009a419fb7421971d9)

krb5kdf.c.in: Check the key size before applying the key

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28663)

(cherry picked from commit 3addc8bb3a8e62e701d44ae849437f97940632cd)

Add test for using KRB5KDF with erroneous key size

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28663)

(cherry picked from commit c18b6968cc1824bd3280cffa914093bba85dff3f)

test/radix/terp.c: avoid accessing uninitialised terp on error

Stats printing in TERP_run() assumes that terp has been initialised,
which is not the case when a jump to the err label has been performed
before successful TERP_init() call; avoid it by enframing the offending
call within a have_terp guard check.

Fixes: 4a2d5fe812f8 "QUIC RADIX: Add RADIX test framework implementation"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665430
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

apps/storeutl.c: avoid signed integer overflow in indent_printf()

As two arbitrarily large printf return values can trigger signed integer
overflow, rewrite the return value handling to avoid it.

Fixes: fb43ddceda79 "Add a recursive option to 'openssl storeutl'"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665428
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

crypto/evp/ctrl_params_translate.c: fix a typo in the error message

The ERR_raise_data() call on failure to find ctx->p2 in str_value_map
erroneously refers to ctx->p1 instead; fix that but supplying the
correct field and casting it to the supposed const char * type.

Fixes: 9a1c4e41e8d3 "EVP: Implement data-driven translation between known ctrl and OSSL_PARAMs"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665427
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

crypto/bio/bss_file.c: add missing cast in format arg in ERR_raise_data()

"%s" conversion specifier requires a "char *" argument, so ptr needs
to be cast to it there, as Coverity has noted.

Fixes: ff988500c2f39 "Replace FUNCerr with ERR_raise_data"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665423
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

test/wpackettest.c: remove bogus cleanup() in test_WPACKET_quic_vlint_random()

In the beginning of the iteration, pkt is not initialised yet, so there
is no need to clean it up on RAND_bytes() failure. Replace
"return cleanup(&pkt)" with plain "return 0".

Fixes: 416d0a638c16 "QUIC wire format support"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665422
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

crypto/x509/t_x509.c: check i2d_X509_NAME() return value in X509_ocspid_print()

There is little reason for this call to fail, but there is also little
reason for not to check for it, and, since Coverity noticed
that the check is missing, just add it.

Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665420
References: https://github.com/openssl/project/issues/1432
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28647)

Fix EVP_PKEY_can_sign() handling of NULL from query_operation_name()

EVP_PKEY_can_sign() assumed query_operation_name(OSSL_OP_SIGNATURE)
always returns a non-NULL string. According to the documentation,
query_operation_name() may return NULL, in which case
EVP_KEYMGMT_get0_name() should be used as a fallback.

Fixes #27790

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28620)

(cherry picked from commit 051108ee53d5b0ff5a125d32acfbc7e20899b022)

Check for OBJ_create() conflicts after write lock.

For now subsequent calls to OBJ_create() with identical inputs return
NID_undef.  It may be better to return the previous NID in the future.

The real work actually happens in OBJ_add_object().  Duplicate compares
*all* the input object's fields with any of the objects found by lookup.

If these are identical, then necessarily all the lookups found the same
data, and we can return the existing nid in low-level calls via
OBJ_add_object() that specify the nid also.  If any of the fields are
different the new object is not installed and NID_undef is returned.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28582)

(cherry picked from commit 556ba81601a37530c3620016bdeaf13094b4fb91)

Add a test for multi-threaded OBJ_create

After a successful OBJ_create the returned NID should
be the same NID that is returned from OBJ_ln2nid and
should not change any more, but after an unsuccessful
OBJ_create, another thread must have created the object,
therefore OBJ_ln2nid should not return NID_undef in that
case.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28582)

(cherry picked from commit 5909d0d3fc9b99b7b9f0577d29515a72fa94bfa0)

Fix length of digestinfo_sm3_der

This fixes the RSA-SM3 signatures to conform to the standard.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28415)

(cherry picked from commit de0944c9b3a77b6f3c7ed07a90f7d463301851a8)

Fix doublefree after failure in ossl_siv128_init()

The issue was reported by Ronald Crane from Zippenhop LLC.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28644)

(cherry picked from commit 3185e2762402dffba569d9a7377d51d5bb0e4382)

Print PowerPC CPUINFO

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28535)

(cherry picked from commit 03a9584499589f14363de758fdfb887cbef84790)

Correct the documentation for OPENSSL_sk_find

Since April of 2023 with commit eb0935f, these functions have not
sorted the stack if it was not sorted. The documentation was noti
changed at the time to reflect this changed behaviour.

This corrects the documentation to reflect the current behaviour
of these functions

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28578)

Close small race condition on error raising in QUIC

Github issue #28501 reported an odd condition in which a double free was
occuring when a given thread was popping entries of its error stack.

It was hypothesized that, because a few places in the quic stack save
error state to a shared structure (ch->err_state, port->error_state,
qtls->error_state), that multiple threads may attempt to mutate the
shared structure during error save/restore in parallel.

Investigation showed that all paths which led to such mutations were
done under lock, so that shouldn't occur.

Except for one case, which this PR addresses.

In ossl_quic_conn_stream_conclude, we unlock our protecting mutex, prior
to calling QUIC_RAISE_NON_NORMAL_ERROR. If that function is called with
an reason code of SHUTDOWN, it attempts to restore the channel error
state. Given that the lock was released first, this creates a small
race condition in which two threads may manipulate the shared error
state in the channel struct in parallel.

According to the reporter, applying this patch prevents the reported
error from occuring again.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28642)

(cherry picked from commit 1e70e8080a5b8766cb5f8b81127f90db9081e856)

CHANGES.md, NEWS.md: various ffixes

* Adding missing periods.
* Consistently using "OpenSSL" as the project's name.
* Fixing the "`EVP_SKEY`" formatting reverted by a merge resolution
in f815ee19e066 "Harden RSA public encrypt".
* Fitting the lines in 80 characters, do a bit more semantic line breaks.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28586)

NEWS.md: remove PCT on key import for SLH-DSA mention

This news-worthy change has been removed in [1].

[1] https://github.com/openssl/openssl/pull/28447

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28586)

CHANGES.md, NEWS.md: sync 3.5 changes/news with 3.5.3

There were minor discrepancies in 3.5 NEWS which are now corrected.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28586)

Skip LMS tests if fetch for the LMS algorithm fails

Check for specific LMS error

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28580)

(cherry picked from commit 3b00a132291ef83cc349b8f1f27d7daec3b43388)

Do not use RW mutexes on RISC-V arch

For unknown reasons using RW mutexes on RISC-V arch
seems to be broken, at least with glibc.

Fixes #28550

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28634)

(cherry picked from commit bea53924ce729353df41129c58bd3349df7d7a82)

x509: fix mem leak on error path

The x509_store_add() creates X509_OBJECT wrapping either X509 or
X509_CRL. However, if you set the type to X509_LU_NONE before
X509_OBJECT_free then it skips the free on the wrapped type and just
calls OPENSSL_free on the object itself. Hence, leaking wrapped
object.

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28631)

(cherry picked from commit 8a4ef31f3ab9c8e512d29600ccc833cf03533b9e)

Re-enable the ssl_trace_test()

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28627)

(cherry picked from commit 0a6b53ac87b54de2f467165c3d25e1af6400280a)

sslapitest.c: Skip test_ssl_trace() with FIPS providers older than 3.5

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28627)

(cherry picked from commit bb8bbdcfaa89741321a00dc9a97e9d513eb037ff)

tls_common.c: Handle inner content type properly on Big Endian

When passing the inner content type to msg_callback,
the lowest byte of rec->type needs to be passed instead
of directly passing the rec->type otherwise the value is
incorrect on Big Endian platforms.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28627)

(cherry picked from commit 2edf021463518d9af905b1b03f952ea643b3fb9b)