git.ipfire.org Git - thirdparty/openssl.git/log

Add static_ASN1_SEQUENCE_END to the list of statment macros

This one is pretty special, we should ponder simplifying some of
the clever preprocessor stuff here, but for now..

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29359)

(cherry picked from commit ba4970afb5b60f022126b7fb3ee3c44cb9ceac8c)

Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR.

AIX doesn't support this implementation for local addresses. The AF_INET
case is unimplemented when sending. The AF_INET6 case is limited to 110
messages. The limiting factor is currently unclear.

Fixes #29292

Signed-off-by: Matthias Kraft <Matthias.Kraft@ibm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29334)

(cherry picked from commit 52cd2a49c53ee6b08a8a76624f2a80f00248d679)

Fix memory leak in error path of ec_gen_init()

ec_gen_set_params() can fail after some big numbers have already been
copied over. Those need to be cleaned to avoid a memory leak on failure.
This can be done with ec_gen_cleanup(), which is also consistent in how
the ecx_gen code does it.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29335)

(cherry picked from commit 26d138af724961c5f30263c15ae8137d4f86645b)

The return value of RSA_*_{en,de}crypt() is signed

The functions RSA_(public|private)_(en|de)crypt() return a signed
result, in particular `-1` may be returned on error, so the caller
MUST treat the value as signed.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29323)

(cherry picked from commit f247d36074353f44596cb941c0a5f929c2e46e67)

Fix memory leak in abnormal branch of mlx_kem_dup function

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29318)

(cherry picked from commit 013e1174df1b3f8a51b393aaa22309dab66d371f)

doc/man3: Add OPENSSL_ppccap.pod

This patch adds a man page documenting the OPENSSL_ppccap environment
variable that is analogous to capability environment variable man pages
for other architectures.

Fixes #17046

Signed-off-by: George Wilson <gcwilson@linux.ibm.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29230)

(cherry picked from commit ba26e3f46b075d44ba673e57d9c81c08f92ef7f0)

Fix regression when X509_V_FLAG_CRL_CHECK_ALL is set, while X509_V_FLAG_CRL_CHECK is clear

Fixes #28758

When X509_V_FLAG_CRL_CHECK is not set, the man pages document that X509_V_FLAG_CRL_CHECK_ALL is ignored.
Prior to 3.6.0, this was indeed the case.

In 3.6.0, the behavior changed, and setting X509_V_FLAG_CRL_CHECK_ALL began to imply X509_V_FLAG_CRL_CHECK.
This unfortunately breaks the majority of ruby installations, which relied on the documented behavior.

For consistency, this commit applies the same logic to the new X509_V_FLAG_OCSP_RESP_CHECK and X509_V_FLAG_OCSP_RESP_CHECK_ALL flags,
which are still undocumented as of 3.6.0.

All existing tests continue to pass. They also make the assumption that the xxx_CHECK_ALL flags are irrelevant unless xxx_CHECK is set.
We could add a new test for this regression. I'll leave that to another commit.

CLA: trivial

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28797)

run codespell pre-commit hook on staged files only

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29360)

(cherry picked from commit d70b22bf2df27e02db5b209d2bc42cd97d6a928c)

add clang-format as a pre-commit hook

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29282)

(cherry picked from commit d6f3733f94fe6414571b080ee22813bba3621dab)

Fix array formatting in evp_extra_test.c

The reformat did something silly with some of the arrays in evp_extra_test.c
Fix the arrays such that clang-format is still happy.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29349)

(cherry picked from commit d54932c9fa4b59e0db8296b91a9392efb9cd897e)

Disable clang-format around this macro

clang-format sensibly thinks this is an arithmatic operation,
and formats the math. Sadly it does not know we eventually
stringify this behind several other layers of nested macros
and so putting spaces in here is bad.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29350)

(cherry picked from commit 5b0dffa8610a085e937f692754281634aca7b7b8)

ignore our reformat commit in git-blame

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29344)

3.6-POST-CLANG-FORMAT-WEBKIT

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29245)

3.6-PRE-CLANG-FORMAT-WEBKIT

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29245)

CMP check_cert_path_3gpp(): add missing checks trying to retrieve newly enrolled cert

Fixes #29285

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29302)

(cherry picked from commit 8482cb8232444dde70c4b2b0a853fca050bea01a)

seed_src_jitter: prevent hypothetical getrandom fallback

In a hypothetical scenario that jent_entropy_init_ex fails, or if
get_jitter_random-value fails, there are a few unexpected
posibilities.

If jent_entropy_init_ex fails, the seed initialisation may return NULL
and then DRBG will be initiated with NULL seed, which will
automatically fallback to os-seed, which will escape module boundary
(if this jitter rng is from the fips module), and call getrandom
syscall.

And separately if get_jitter_random_value fails, it may put DRBG in an
error state, but it might not put the FIPS module in error state, like
it should as per the ISO standard.

To instrument these things, I had to create tampered
jitterentropy-library that always returns errors for init_ex and
read_entropy apis, and then use gdb tracing on both libcrypto.so and
fips.so.

The most minimal solution to above hypothetical error code paths, is
to simply call ossl_set_error_state. It is either harmless, or in case
of fips-jitter will correctly put the FIPS module into error state and
prevent any further operation; and cruitially prevent silent fallback
to getrandom syscall.

Note it is unlikely that this ever was out of compliance, as often
enough getrandom syscall goes to a kernel with validated entropy
source; and openssl fips module still did reject sampling which is too
entropy source compliant.

Nonetheless it is good to fix this hypothetical error path, and
backport this to 3.5 and up.

This is similar / additional fixes, to this previous change:
- https://github.com/openssl/openssl/pull/25957
- https://github.com/openssl/openssl/commit/b9886a6f3483e0525596d3b3956416282038da82

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29226)

(cherry picked from commit 21069c983bc385f46c522e0bf7edbefabc6d4d19)

nits in progs.pl

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Disable clang format around .c includes

we assume these to be order sensitive and not self contained, so
as per our new style we disable clang format around them.

we should consider renaming to .inc, or doing away with some
of these and just putting the code inline, but that's for
later consideration.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Disable clang-format around line-wrap sensitive lines in malloc_test.c

If OPENSSL_LINE ends up on a different line than the following call here,
this test breaks.

We should perhaps reconsider if testing the reporting of OPENSSL_LINE
is what we want in a malloc test, but that's for another time than now.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Disable clang format around multi-line macros of sparc assembly

They are not asm, but spit out stuff that is not C

Clang-format gets confused and does bad things with them.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Fix cmp_ctx_test.c to be less sensitive to line wrapping.

Similar to the previous errtest.c fix this also is not broken
by any reformatting today, but this change makes this follow
the same pattern as the other things that test OPENSSL_LINE
after the fact so we maintain the same paradigm everywhere.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

fix errtest to be less sensitive to line wrapping changes

(in it's final form it will work with either compiler
because it's currently one line, but was tripped up before
by the #ifdef, so redid it to be consistent with the
other changes previously in this stack)

While I am here correct the test to test for all possible
return values of ERR_get_error_all, without the #ifdefs

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Fix apps/progs.pl to be slightly less fragile

In particular fix the regex magic to be tolerant of different ways
of formatting a main program.

My past life had forgotten this magic 14 years ago when we converted
it to just a table of commands in the forks.

https://www.youtube.com/watch?v=mWbbjvYmN8A

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

Add a WebKit clang-format file

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29243)

check_cert_crl(): Set CRL score for CRLs returned by get_crl callback

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29199)

(cherry picked from commit c7a657d8007853791f27235a176131ad1daf358a)

mlx_kem_dup(): Set key state to MLX_HAVE_NOKEYS when not copying keypair

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29280)

(cherry picked from commit bc06a6c96c8707503b6fb0dd2e8f12d08c43d1a8)

Skip symbol_presence test on AIX

AIX `nm` reports symbols in a different way.

Fix for: #29247

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29276)

(cherry picked from commit ad29e4b134d533a57ef632aac86017edee65a178)

tls_process_cert_status_body(): Reject invalid cert status

When a CertStatus message is received and the length of the
OCSP response is zero error out.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29207)

(cherry picked from commit ccd8451428814ddbbed486f957a507b3cd7aa251)

add release notes from NEWS.md when making a release

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29271)

remove potentially not secure template expansions

https://docs.zizmor.sh/audits/#template-injection

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(cherry picked from commit 33ec173876c409c3be4c3a7aef0f13b5d0c133b6)

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29271)

dtls_get_reassembled_message(): Fix potential use-after-realloc

Fortunately due to the initial size of the allocated
buffer and the limit for unfragmented DTLS record size
the use-after-realloc cannot be triggered.

But we fix the potentially problematic code anyway.

Reported Joshua Rogers. It was found with the ZeroPath security
tooling.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29278)

(cherry picked from commit 6d1d85c31b4840d08b48e57b1812a37cb9aa89ec)

windows.yml: Clean up duplicate --strict-warnings option

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29300)

(cherry picked from commit af05eeb59c6a83a9397aa99214991f9077bfae2e)

Avoid warning about zero extending unsigned int on Windows

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29300)

(cherry picked from commit 209c91c320460b676869427ea463b330aed119eb)

s390x: Check and fail on invalid malformed ECDSA signatures

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29214)

(cherry picked from commit 8e28ea9e6244fb425b948780903a37cde338c2b4)

s390x: Return condition code of kdsa instruction

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29214)

(cherry picked from commit bcaa2a3af60c3c1f282b621522bbc316341bf692)

Improve provider-signature documentation clarity

- Add explicit links to related EVP_* functions for each signature method
- Clarify the differences between sign/verify, message sign/verify, and digest sign/verify functions
- Document TLS 1.3 requirements: digest_sign/verify functions are mandatory for libssl usage
- Provide guidance for provider developers on which functions to implement for different use cases

Fixes #27127

Signed-off-by: Samaresh Kumar Singh <ssam3003@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29166)

(cherry picked from commit 47418dd8de635448fd1f5dfb583070e1f5fcf559)

CIFuzz: Remove some unnecessary files to free up space

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29061)

(cherry picked from commit 0857839af1e3d95933402ad51e20134b65f28937)

ensure destructor key is created prior to any other thread specific key

https://github.com/openssl/openssl/issues/29077 found that, in the event
that a pthread key is created prior to the destructor_key, glibc will
NULL-ify any thread specific data before the init_thread_destructor
runs, leading to leaks.

Ensure that we always create the destructor key prior to any other
thread local storage keys

Fixes #29907

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29182)

(cherry picked from commit 66f92cfb925e5c4c830ab65cf738ab49c5e553a4)

fix(x509.c): Fixed regression of openssl x509 -checkend return values

Fixes #28928

Also adds functionality to -checkend to account for -multi behaviour.
Man page and unit tests updated accordingly.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29155)

(cherry picked from commit 679a10110e4e60dbfe8acc87f5c697cebd501876)

Fix change of behavior of the single stapled OCSP response API

Fixes #28888

Fixes b1b4b154

Instead of transferring the ownership of the single OCSP response
to the SSL object, the multi-stapling PR modified the semantics
of SSL_set_tlsext_status_ocsp_resp() to copying semantics.

This change reverts the behavior to the previous one.

Partially based on fix by Remi Gacogne:
https://github.com/openssl/openssl/pull/28894

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29251)

(cherry picked from commit 7e50e034b0ca20dc492cfcffb41f974451da8ea9)

Branch 3.2 was removed from and branch 3.6 was added to the
"Provider compatibility for PRs" test.
Do not test the provider from the PR against modified branches.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29236)

(cherry picked from commit 20991f30006d20d2dac270077de7b20e78300b82)

Branch 3.2 was removed from the "Provider compatibility across versions"
test and "skip the same version" logic was changed.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29236)

(cherry picked from commit 7e430d9dc1857da2e9fd173a6060737be5d4a06a)

DOC: fix typo in openssl-cmp

RAVERIFED -> RAVERIFIED

CLA: trivial

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29202)

(cherry picked from commit 0db815332d44f1df663d270a580f2bdaf8cced9e)

DOC: put an empty line before '=for' directive

CLA: trivial

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29201)

(cherry picked from commit 8b3b08f4edc65ab302d17282c47d0f3925ed6333)

test: Add test for #29196

Add a test that will cause one of the problems reported in
https://github.com/openssl/openssl/issues/29196 and skip it on 32-bit
systems.

Signed-off-by: Clemens Lang <cllang@redhat.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29192)

(cherry picked from commit 476877a2ff9c2cb9e4601ce388370ce0a9f74f8b)

Do not make key share choice in tls1_set_groups()

tls1_set_groups(), which is used by SSL_CTX_set1_groups() does not check
whether the NIDs passed as argument actually have an implementation
available in any of the currently loaded providers. It is not simple to
add this check, either, because it would require access to the SSL_CTX,
which this function does not receive. There are legacy callers that do
not have an SSL_CTX pointer and are public API.

This becomes a problem, when an application sets the first group to one
that is not supported by the current configuration, and can trigger
sending of an empty key share.

Set the first entry of the key share list to 0 (and the key share list
length to 1) to signal to tls1_construct_ctos_key_share that it should
pick the first supported group and generate a key share for that. See
also tls1_get_requested_keyshare_groups, which documents this special
case.

See: https://issues.redhat.com/browse/RHEL-128018
Signed-off-by: Clemens Lang <cllang@redhat.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29192)

(cherry picked from commit 5375e940e22de80ad8c6e865a08db13762242eee)

Move CRL extensions from v3_ocsp.c to v3_crldp.c

Otherwise they will not be handled by no-ocsp build.

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29234)

(cherry picked from commit ed04580650907bcd5c11ba09996a9fb6fb9b4972)

Fixed non-compliant handling of missing stapled OCSP responses

If the OCSP response was not present for a certificate the server
created a non-conforming empty CertificateStatus extension
instead of not sending the extension at all.

Fixes #28902

Fixes b1b4b154

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28955)

(cherry picked from commit c5c8b44f0f66f8edf5d6035705f15f3e55265798)

Document CVE-2021-4160

This was fixed in openssl 3.0.1 by #17258 and assigned
CVE-2021-4160 but unfortunately forgotten to mention
in the CHANGES and/or NEWS.

Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29051)

(cherry picked from commit 134f17d526a5d0a9fbd66adf85e53df8a764a2ff)

Remove Ed25519ctx from the FIPS provider

This variant of Ed25519 algorithm is not FIPS approved.

Fixes #27502

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29091)

(cherry picked from commit f95dfe09504f5cd9d054ee3b75d9dde4d6e24636)

Add test for recordpadding

Just run the quicapitest (which attempts to create quic connections)
while using a config that specifies recordpadding, which quic should
ignore

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29193)

Ignore RecordPadding option in config file for QUIC objects

QUIC connections always pad data at the packet level during packet
encryption, and so have no ability to do padding at the record level.

We want to be able to inform the user of this condition when
applications call SSL_set_block_padding_ex directly by returning an
error, we have no idea of what kind of SSL objects are created when the
config file is written.

As such, silently ignore this config file option when QUIC objects are created.

Fixes #28953

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29193)

Add SSL_CTX_is_quic API

Like SSL_is_quic, it would be helpful to know if SSL_CTX objects create
QUIC SSL's or not.

Note, this is a public function in the master branch, but is made
private for older stable branches, so as not to introduce new public
API's there (3.6-3.0)

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29193)

doc: Discuss calling X509_verify_cert in cert_verify_callback

Using SSL_CTX_set_cert_verify_callback but still calling
X509_verify_cert is useful if applications want to dynamically
configure the X509_STORE_CTX, or postprocess the result, in a way that
does not quite fit the somewhat unpredictable behavior of the
SSL_CTX_set_verify callback. (In my experience, applications rarely
realize it is called multiple times. It's also too late at that point to
reconfigure the X509_STORE_CTX as verification has already started.)

There is one note in the docs that the callback needs to stash the
verify result with X509_STORE_CTX_set_error, but it is not immediately
obvious that X509_verify_cert will do so, or that it is the built-in
behavior. Add a paragraph discussing this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28960)

(cherry picked from commit 069181d7f39beaae22bfa67bcba3c5fe93acafd4)

asn1: clear error mark on success in asn1_d2i_read_bio

Balance ERR_set_mark by calling ERR_clear_last_mark on the success path.
Prevents a stale mark from skewing later error handling.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28882)

(cherry picked from commit 7f015c909ee3480a59d4fe828c3da22c7a55a2f4)

crypto/bio/bss_acpt: reset accept_sock and b->num after close in ACPT_S_LISTEN failures

On BIO_listen or BIO_sock_info failure we close the socket but leave
accept_sock and b->num pointing at the old fd. Later cleanup can double
close.

Set both to INVALID_SOCKET immediately after BIO_closesocket.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28904)

(cherry picked from commit 1c4f7b10358b79a0b33619187caa2b7e3bdb6e7a)

Correct information about the default value of the -md parameter
of the openssl cms command.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29175)

(cherry picked from commit 2a7b058429938e40e20882a80bc5d2f426b145b8)

doc/man3/OPENSSL_malloc.pod: mention rationale for OPENSSL_cleanse()

It was not entirely clear from the sole description, what is the reason
for preferring OPENSSL_cleanse() over memset(). Add a note about situations
in which OPENSSL_cleanse() should be chosen.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29174)

(cherry picked from commit 768468f40e810ceef00b1c3b7cac05beaa1d8f8c)

DOC: fix description of '-self_test_oninstall'

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29168)

(cherry picked from commit 978cb1f9d1fb895f51feeee4cf700cf07a063e01)

rand_lib.c: Use ERR_LIB_RAND with RAND_R errors

Use ERR_LIB_RAND when reporting RAND_R_ALREADY_INSTANTIATED from
RAND_set_DRBG_type() and RAND_set_seed_source_type() so the error
message references the RAND subsystem instead of CRYPTO.

Fixes #29039

CLA: trivial

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29109)

(cherry picked from commit e7251fa1a92bcb1fda1dad7f7e2e3ed2c0056e27)

doc: Add HISTORY entry for message signing functions in provider-signature(7)

The OSSL_FUNC_signature_{sign,verify}_message_* functions were added
in OpenSSL 3.4 but weren't documented in the HISTORY section of
provider-signature(7), while the corresponding EVP_PKEY_sign_message_*
functions are properly documented in EVP_PKEY_sign(3).

This adds the missing HISTORY entry to document when these provider
functions were introduced.

Fixes #29088

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29130)

(cherry picked from commit 6b4ad7f8d8f40564621495f0f6183f9e7639d768)

bio_ok.c: Fixed undefined identifier 'SIZE_MAX'

This fixes the following compilation error on HP-UX:
```
11:07:19 crypto/evp/bio_ok.c: In function 'block_in':
11:07:19 crypto/evp/bio_ok.c:579: error: 'SIZE_MAX' undeclared (first use in this function)
11:07:19 crypto/evp/bio_ok.c:579: error: (Each undeclared identifier is reported only once
11:07:19 crypto/evp/bio_ok.c:579: error: for each function it appears in.)
```

Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech>
CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28793)

(cherry picked from commit 695a5aaf0bb04bc2f2d395987f121c1ec41d3b3e)

CMP doc: update RFC 4210 -> 9810, RFC 6712 -> 9811

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Alicja Kario <hkario@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/28017)

(cherry picked from commit d46fca326325789743c9baff98a48234b78acaa9)

Allow get_params to return length of the AES-GCM tag parameter

Previously, EVP_CIPHER_CTX_get_params would not report the length of the
tag parameter when called with a NULL data pointer. This change makes the
function behave as documented.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28232)

(cherry picked from commit fc563b4d48e2229f6d52a95ff32a527fa983ef68)

Allow get_params to return length of AES-GCM IV parameters

Previously, EVP_CIPHER_CTX_get_params would not report the length of the
IV parameters when called with a NULL data pointer. This change makes the
function behave as documented.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28232)

(cherry picked from commit ab60626253853eaefb2f786779bc9aefc1de8395)

Prevent NULL deref in BN_is_zero when cofactor is missing

In ossl_ec_curve_nid_from_params, EC_GROUP_get0_cofactor may return NULL,
but BN_is_zero was called on it unconditionally, leading to a potential
segmentation fault.

Now check that cofactor != NULL before calling BN_is_zero or BN_is_word,
aligning with safe practices used elsewhere in the codebase.

This fixes a critical NULL pointer dereference vulnerability that could
be triggered by EC groups with unset cofactor, preventing DoS via segfault.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29069)

(cherry picked from commit 87a4607668e959188aa5b3c5482d5cf7d18adf63)

asn1_gen: add ASN1_object_size() return check and fix else braces

Fixes: #6570
CLA: trivial

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29022)

(cherry picked from commit ecf3ac3b109154fa86d897d88c0c491134429c88)

CRYPTO_R_ cannot be used with ERR_LIB_OSSL_STORE

Use ERR_R_PASSED_NULL_PARAMETER instead.

Fixes e9e643bc580e4ba0c6f8f9b4dd2ce59397b1b786

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29006)

(cherry picked from commit 376f7ee4d123f3842d85ef3c03fd070fb411ec0f)

apps/s_socket: fix FD and addrinfo leak on SCTP failure in init_client

If BIO_new_dgram_sctp(*sock, BIO_NOCLOSE) fails we returned 0 directly,
skipping the out: cleanup and leaking the just created socket plus the
addrinfo lists.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/28917)

(cherry picked from commit 3005b9bc8691c570f3f51c25219b7ba79a064d83)

crypto/bio/bss_acpt: set b->init only on successful BIO_parse_hostserv

BIO_C_SET_ACCEPT with num == 0 unconditionally set b->init = 1 even if
BIO_parse_hostserv failed. Only mark the BIO initialized when parsing
succeeds to avoid inconsistent state.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28912)

(cherry picked from commit bc8a449ef7409ffe1e859d3e526e8d2a9f693d3d)

quic/quic_demux: Mirror int overflow check from demux_alloc_urxe into demux_resize_urxe

Simple hardening. In practice new_alloc_len usually comes from demux->mtu or test injection length, but adding the same check here quiets analyzers.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28918)

(cherry picked from commit 965d6279e8fe2ffa5d0a06d11077cd9b721813cd)

Rollup fixes for NonStop builds.

This change includes bss_sock.c to deal with introduction of EPROTO use.
Reroll of rsa_ossl.c changes made at 3.5 downward.
Build a workaround in timing_load_creds.c on NonStop for lack of rusage.
This simulates getrusage() that is not available on NonStop.
Update bioprinttest.c to handle missing PTRxPRT definitions from inttypes.h.

Fixes: #29023
Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29090)

Add negative test for PKCS12_SAFEBAG_get0_bag*() functions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29128)

(cherry picked from commit 930a9502d15aabde8c774ebf45834c2c135047c0)

Add safety checks to PKCS12_SAFEBAG_get0_bag*() functions

Fixes #26655

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29128)

(cherry picked from commit 7776744a5912ac9346bf04bf60570b149243eb33)

UTF8_getc(): Fail with UTF8 values outside UNICODE_LIMIT

Reported by Aniruddhan Murali

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29119)

(cherry picked from commit 7deeeb950be7b32a2407fdc37864b23b5b8797bd)

Test invalid out of range character handling in UTF8_getc()

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29119)

(cherry picked from commit 3595339b6901d9880282168eca75773080969c38)

TLS 1.3 session resumption convert nonce_label to ASCII hex

Fixes #27815
CLA: trivial

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29127)

(cherry picked from commit 105c5807ce34144b123dbaf939301fa13a6918bc)

Dependabot update

CLA: trivial

(deps): Bump cross-platform-actions/action

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.27.0 to 0.30.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/fe0167d8082ac584754ef3ffb567fded22642c7d...46e8d7fb25520a8d6c64fd2b7a1192611da98eda)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29129)

(cherry picked from commit af50059508773c946c79cdfe4927e4028f994cbc)

Dependabot update

CLA: trivial

(deps): Bump dtolnay/rust-toolchain

Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6d653acede28d24f02e3cd41383119e8b1b35921 to 0f44b27771c32bda9f458f75a1e241b09791b331.
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](https://github.com/dtolnay/rust-toolchain/compare/6d653acede28d24f02e3cd41383119e8b1b35921...0f44b27771c32bda9f458f75a1e241b09791b331)

---
updated-dependencies:
- dependency-name: dtolnay/rust-toolchain
dependency-version: 0f44b27771c32bda9f458f75a1e241b09791b331
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29125)

(cherry picked from commit 3bd52f8243ffcccb4bbaaf62558caa469dc83951)

Dependabot update

CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.3.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.3.0...v6.0.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29105)

(cherry picked from commit 92261e77a62b048fc18d39873cc79f488a4bc578)

Document when OSSL_ENC/DECODER_CTX_set* functions shouldn't be used

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29122)

Note about different exclusion of GREASE extensions

Different SSL_client_hello_* functions have different behavior
in regards to GREASE extensions.

Fixes #27580

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29066)

(cherry picked from commit 657b01241feeb23a53378920bf33d59505532ba8)

doc/man3/X509_STORE_get0_param.pod: mention how to free the returned objects

It is not entirely obvious from the description how the objects returned
by X509_STORE_get1_objects() and X509_STORE_get1_all_certs() are
supposed to be freed, explicitly mention the relevant calls, and provide
a reference to DEFINE_STACK_OF(3).

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/29002)

(cherry picked from commit de1abbed1cd75fcb8a6becadbc2854aa124f9bcf)

Clarify processing of CRYPTO frame in SSL_set_quic_tls_cbs(3ossl)

We should remind 3rd-party QUIC stack implementors their QUIC stack
must ensure to provide all CRYPTO frames to OpeNSSL/TLS for processing.
The CRYPTO frames keeping coming even after confirmation of TLS
hanndshake.

Fixes #28963

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29070)

(cherry picked from commit ca24748b80987ee49073bb07a4dda73f6eb12c8c)

slh_dsa: fix leak in early return of slh_sign_internal()

In slh_sign_internal(), if calling PACKET_buf_init() failed, this
function return without free wpkt. Replace `return 0` with `goto err`
to free wpkt before return.

CLA: trivial
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29041)

(cherry picked from commit 066bfdc946e9d89b6b966587d02619b8329fdeee)

Correction of grammar error in doc/man1/openssl-req.pod.in

I changed the word "most" with the correct word "must" at the line 406.

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29009)

(cherry picked from commit 90e6afa4cb795cc60cc2b89a89923d011e18b8a6)

kdf: Fix PVK KDF provider build.info typo

Fix the pvkkdf.c build when using PVKKDF_GOAL

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28971)

(cherry picked from commit 63f7d42d4eed924ed140497bb51f8bc26a068468)

Update external test to use rpki-client 9.6

rpki-client 9.6 was released ten days ago:
https://marc.info/?l=openbsd-announce&m=175847509514928&w=2

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28718)

(cherry picked from commit 96c05d2441d592d156e0468210149434fde319f6)

Properly error out when AEAD Algorithms are used with Encrypted Data

Encrypted Data does not support AEAD algorithms. If you wish to
use AEAD algorithms you will have to use a CMS_AuthEnvelopedData
structure. Therefore, when AEAD algorithms are used with
CMS_EncryptedData_set1_key will now return an error.

Fixes: #28607
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28711)

(cherry picked from commit 86344acb02eb3718b0491b9915846667c55c95ff)

Improve the CPUINFO display for RISC-V

Prefix the base architecture to the displayed RISC-V
architecture string, so the displayed OPENSSL_riscvcap
environment value can be used as is, since otherwise
the OPENSSL_cpuid_setup would ignore the first extension,
as it is expected to be the base architecture, usually
"RV64GC" or similar.
See the comment at parse_env in crypto/riscvcap.c
Furthermore also print the VLEN value, if the V-extension
is given, since that makes a significant difference
which assembler modules are activated by the V-extension.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28760)

(cherry picked from commit c05ea2fdb7f7687c2df1b611ece37be1bd03b011)

print CPUINFO in QEMU cross-compile jobs

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28760)

(cherry picked from commit 70b3250ed84ddaaaa29902398730cc3026b47abb)

Dependabot update

CLA: trivial

(deps): Bump actions/download-artifact

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.8 to 6.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4.1.8...v6.0.0)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29100)

(cherry picked from commit 1b2e3bd2339ecb7912097cf3c8ddec860010be43)

Dependabot update

CLA: trivial

(deps): Bump actions/checkout

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29098)

(cherry picked from commit 3066e59dfefd5967f46ebd699071084895c55ca3)

Dependabot update

CLA: trivial

(deps): Bump cygwin/cygwin-install-action

Bumps [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) from 5 to 6.
- [Release notes](https://github.com/cygwin/cygwin-install-action/releases)
- [Commits](https://github.com/cygwin/cygwin-install-action/compare/f61179d72284ceddc397ed07ddb444d82bf9e559...f2009323764960f80959895c7bc3bb30210afe4d)

---
updated-dependencies:
- dependency-name: cygwin/cygwin-install-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29097)

(cherry picked from commit 87afb84c39fe64a346632869966218ec394ec4a4)

Dependabot update

CLA: trivial

(deps): Bump actions/upload-artifact

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29096)

(cherry picked from commit 2ffd40ec50667e7e457a88702ebc948094d2a554)

c_rehash: Strip \r from hash filename on msys2

Sample output for c_rehash -v on ucrt64 env:
Doing .
.0nk my.pem -> 472bcb3c
.0nk ca-bundle.crt -> cd8c0d63
WARNING: Skipping duplicate certificate ca-bundle.trust.crt

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28996)

(cherry picked from commit 331c2c71c97b8923f186f6661c6e03572fb34063)

Add a test for mismatch between the pkey and sigalg

We add a test for sending an mldsa65 sigalg while using an mldsa44 key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29019)

(cherry picked from commit 236bc0d2f919bcd6a91c7dc8a0a3a1088089d1c8)

Use the actual NID for provided signature algorithms

Prior to this change we could confuse the nid used in the pkey with the
nid in the sigalg and mistakenly accept signatures by the wrong algorithm.

Fixes #28762

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29019)

(cherry picked from commit cbfc8cc3dc4f2b437f4dd65a266c9f8ff4cd5781)