[1.1.1][EC][ASN1] Detect missing OID when serializing EC parameters and keys - #12312

The following built-in curves do not have an assigned OID:

- Oakley-EC2N-3
- Oakley-EC2N-4

In general we shouldn't assume that an OID is always available.

This commit detects such cases, raises an error and returns appropriate
return values so that the condition can be detected and correctly
handled by the callers, when serializing EC parameters or EC keys with
the default `ec_param_enc:named_curve`.

Fixes openssl#12306

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#12312)

* Update external/openssl from branch 'build-tools'
  to 8c346234bb495fdae254bfdd46e6e267624d404c
  - Merge "Merge tag 'OpenSSL_1_1_1i' for Python and cmdline tool" into build-tools
  - Merge tag 'OpenSSL_1_1_1i' for Python and cmdline tool
    
    Upstream python does not support boringssl, so bring back openssl, but
    only for host python. See https://www.python.org/dev/peps/pep-0644/ for
    some discussion upstream.
    
    Secondarily, the build system also uses the `openssl` command line tool
    during some actions, so this will allow us to use a prebuilt for that
    rather than an arbitrary version from the host. Boringssl does not
    provide a command line tool.
    
    Actual build rules will follow in another CL.
    
    Bug: 173151817
    Change-Id: Idf1a125071c422b2f18d085eb73d01fc40ac17f2
    
  - Prepare for 1.1.1i release
    
    Reviewed-by: Richard Levitte <[email protected]>
    
  - Update copyright year
    
    Reviewed-by: Richard Levitte <[email protected]>
    
  - Update CHANGES and NEWS for new release
    
    Reviewed-by: Richard Levitte <[email protected]>
    
  - Add a test for encoding/decoding using an invalid ASN.1 Template
    
    If you have a CHOICE type that it must use explicit tagging - otherwise
    the template is invalid. We add tests for this.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - Add a test for GENERAL_NAME_cmp
    
    Based on a boringssl test contributed by David Benjamin
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - Complain if we are attempting to encode with an invalid ASN.1 template
    
    It never makes sense for multi-string or CHOICE types to have implicit
    tagging. If we have a template that uses the in this way then we
    should immediately fail.
    
    Thanks to David Benjamin from Google for reporting this issue.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - Check that multi-strings/CHOICE types don't use implicit tagging
    
    It never makes sense for multi-string or CHOICE types to use implicit
    tagging since the content would be ambiguous. It is an error in the
    template if this ever happens. If we detect it we should stop parsing.
    
    Thanks to David Benjamin from Google for reporting this issue.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - Correctly compare EdiPartyName in GENERAL_NAME_cmp()
    
    If a GENERAL_NAME field contained EdiPartyName data then it was
    incorrectly being handled as type "other". This could lead to a
    segmentation fault.
    
    Many thanks to David Benjamin from Google for reporting this issue.
    
    CVE-2020-1971
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - DirectoryString is a CHOICE type and therefore uses explicit tagging
    
    EDIPartyName has 2 fields that use a DirectoryString. However they were
    marked as implicit tagging - which is not correct for a CHOICE type.
    
    Additionally the partyName field was marked as Optional when, according to
    RFC5280 it is not.
    
    Many thanks to github user @filipnavara for reporting this issue. Also to
    David Benjamin from Google who independently identified and reported it.
    
    Fixes #6859
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
  - CHANGES: Move misplaced change item
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13605)
    
  - x509_vfy.c: Restore rejection of expired trusted (root) certificate
    
    The certificate path validation procedure specified in RFC 5280 does not
    include checking the validity period of the trusted (root) certificate.
    Still it is common good practice to perform this check.
    Also OpenSSL did this until version 1.1.1h, yet
    commit e2590c3a162eb118c36b09c2168164283aa099b4 accidentally killed it.
    
    The current commit restores the previous behavior.
    It also removes the cause of that bug, namely counter-intuitive design
    of the internal function check_issued(), which was complicated by checks
    that actually belong to some other internal function, namely find_issuer().
    
    Moreover, this commit adds a regression check and proper documentation of
    the root cert validity period check feature, which had been missing so far.
    
    Fixes #13471
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13585)
    
  - Configuration: darwin64-arm64-cc for Apple silicon
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tim Hudson <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12369)
    
  - Fix comment in do_dtls1_write()
    
    This code started off as a copy of ssl3_write_bytes(), and the comment
    was not updated with the implementation.
    
    Reported by yangyangtiantianlonglong in #13518
    
    Reviewed-by: Shane Lontis <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13566)
    
    (cherry picked from commit 70cae332a2c200087605f94cdccfee80c9380fbf)
    
  - Turn on Github CI - backport improved ci.yml to 1.1.1
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13586)
    
  - aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode
    
    ARM Cortex-A57 and Cortex-A72 cores running in 32-bit mode are affected
    by silicon errata #1742098 [0] and #1655431 [1], respectively, where the
    second instruction of a AES instruction pair may execute twice if an
    interrupt is taken right after the first instruction consumes an input
    register of which a single 32-bit lane has been updated the last time it
    was modified.
    
    This is not such a rare occurrence as it may seem: in counter mode, only
    the least significant 32-bit word is incremented in the absence of a
    carry, which makes our counter mode implementation susceptible to these
    errata.
    
    So let's shuffle the counter assignments around a bit so that the most
    recent updates when the AES instruction pair executes are 128-bit wide.
    
    [0] ARM-EPM-049219 v23 Cortex-A57 MPCore Software Developers Errata Notice
    [1] ARM-EPM-012079 v11.0 Cortex-A72 MPCore Software Developers Errata Notice
    
    Signed-off-by: Ard Biesheuvel <[email protected]>
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13571)
    
    (cherry picked from commit 26217510d21cd4d5928db8bff41c6756a7c7a636)
    
  - Update bio_ok.c
    
    CLA: trivial
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13515)
    
    (cherry picked from commit a614af95531dd9f168aa4b71bd1195b4fdfe1794)
    
  - rsa_test: add return value check
    
    Fixes #13361
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13362)
    
    (cherry picked from commit 93c87f745d5694b829d5b52d371d478b063a1fba)
    
  - Verification zero-length content in S/MIME format
    
    Fixes #13082
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13106)
    
  - Correct description of BN_mask_bits
    
    CLA: trivial
    
    Correct right shift to left shift.
    Pseudo code `a&=~((~0)>>n)` means "get higher n-bits of a", but actually crypto lib gives lower n-bits.
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12727)
    
    (cherry picked from commit b6ef3c7089e887427cde8c550e28211dc0c22dd1)
    
  - Unify ssl3_get_cipher_by_std_name() implementation
    
    The handling for the SCSVs was the same as for regular ciphers;
    just merge them into the same table-driven handler.
    
    Reviewed-by: Paul Dale <[email protected]>
    
    (cherry picked from commit 231849bc9ca69dfd3adf40821421d8e2d804d8e8)
    
    (Merged from https://github.com/openssl/openssl/pull/13280)
    
  - optimise ssl3_get_cipher_by_std_name()
    
    Return immediately on matched cipher. Without this patch the code only breaks out of the inner for loop, meaning for a matched TLS13 cipher the code will still loop through 160ish SSL3 ciphers.
    
    CLA: trivial
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    
    (cherry picked from commit d93bded6aa2852e681de2ed76fb43c415687af68)
    
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13280)
    
  - crypto/poly1305/asm: fix armv8 pointer authentication
    
    PAC pointer authentication signs the return address against the value
    of the stack pointer, to prevent stack overrun exploits from corrupting
    the control flow. However, this requires that the AUTIASP is issued with
    SP holding the same value as it held when the PAC value was generated.
    The Poly1305 armv8 code got this wrong, resulting in crashes on PAC
    capable hardware.
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13256)
    
    (cherry picked from commit fcf6e9d056162d5af64c6f7209388a5c3be2ce57)
    
  - Ensure we raise SSLfatal on error
    
    We were missing a call to SSLfatal. A comment claimed that we had already
    called it - but that is incorrect.
    
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13230)
    
  - Allow to continue on UNABLE_TO_VERIFY_LEAF_SIGNATURE
    
    This unifies the behaviour of a single certificate with
    an unknown CA certificate with a self-signed certificate.
    The user callback can mask that error to retrieve additional
    error information. So the user application can decide to
    abort the connection instead to be forced by openssl.
    
    This change in behaviour is backward compatible as user callbacks
    who don't want to ignore UNABLE_TO_VERIFY_LEAF_SIGNATURE will
    still abort the connection by default.
    
    CLA: trivial
    Fixes #11297
    
    Reviewed-by: David von Oheimb <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11359)
    
  - Fix aarch64 static linking into shared libraries (see issue #10842 and pull request #11464)
    
    Cherry-pick of https://github.com/openssl/openssl/pull/13056 for branch 1.1.1. Tested against
    the release 1.1.1h
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13218)
    
  - Fix AES-GCM bug on aarch64 BigEndian
    
    Fixes #10638
    Fixes #13188
    
    Fixes a bug for aarch64 bigendian with instructions 'st1' and 'ld1' on AES-GCM mode.
    
    CLA: trivial
    
    (cherry picked from commit bc8b648f744566031ce84d77333dbbcb9689e975)
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13193)
    
  - resolve defects: reverse_inull; row[DB_exp_date] referenced before checking
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13170)
    
    (cherry picked from commit 6a13c9c9842f54ed8d98c6f37cc4ae6c1cde8b7a)
    
  - Avoid potential doublefree on dh object assigned to EVP_PKEY
    
    Fixes regression from 7844f3c784bfc93c9b94ae5a4082f9d01e82e0af
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13194)
    
  - Add a CHANGES entry for the SSL_SECOP_TMP_DH change
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13136)
    
  - Pass an EVP_PKEY for SSL_SECOP_TMP_DH in the security callback
    
    The security operation SSL_SECOP_TMP_DH is defined to take an EVP_PKEY
    in the "other" parameter:
    
     /* Temporary DH key */
     # define SSL_SECOP_TMP_DH                (7 | SSL_SECOP_OTHER_PKEY)
    
    In most places this is what is passed. All these places occur server side.
    However there is one client side call of this security operation and it
    passes a DH object instead. This is incorrect according to the
    definition of SSL_SECOP_TMP_DH, and is inconsistent with all of the other
    locations.
    
    Our own default security callback, and the debug callback in the apps,
    never look at this value and therefore this issue was never noticed
    previously. In theory a client side application could be relying on this
    behaviour and could be broken by this change. This is probably fairly
    unlikely but can't be ruled out.
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13136)
    
  - Changing X509at_get0_data_by_OBJ to expect const stack of X509_ATTRIBUTE
    
    CLA: trivial
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13062)
    
    (cherry picked from commit 796948cd733d2bd0d8acbaf2354c718bcd4352a6)
    
  - syscall_random(): don't fail if the getentropy() function is a dummy
    
    Several embedded toolchains may provide dummy implemented getentropy()
    function which always returns -1 and sets errno to the ENOSYS.
    
    As a result the function SSL_CTX_new() fails to create a new context.
    
    Fixes #13002
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13112)
    
  - Fixed typo in ssl_lib.c
    
    orignal -> original
    
    CLA: trivial
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13111)
    
    (cherry picked from commit 9f7505ab6a1ce76497654ea8cf6a74307da78989)
    
  - Avoid memory leak of parent on allocation failure for child structure
    
    Reviewed-by: Ben Kaduk <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13055)
    
    (cherry picked from commit a21db568bf3d0ab4194fd3e0917ee982f1fc8bfd)
    
  - Use size of target buffer for allocation
    
    Reviewed-by: Ben Kaduk <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13055)
    
    (cherry picked from commit 8ad369171fc2b435c0ca427111481da4d4c3c1ce)
    
  - Ensure that _GNU_SOURCE is defined for NI_MAXHOST and NI_MAXSERV
    
    Since glibc 2.8, these defines like `NI_MAXHOST` are exposed only
    if suitable feature test macros are defined, namely: _GNU_SOURCE,
    _DEFAULT_SOURCE (since glibc 2.19), or _BSD_SOURCE or _SVID_SOURCE
    (before glibc 2.19), see GETNAMEINFO(3).
    
    CLA: trivial
    Fixes #13049
    
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13054)
    
    (cherry picked from commit 99501e817cbc4f11cc045dbaa7a81854d4349335)
    
  - Prepare for 1.1.1i-dev
    
    Reviewed-by: Matthias St. Pierre <[email protected]>
    
  - Prepare for 1.1.1h release
    
    Reviewed-by: Matthias St. Pierre <[email protected]>
    
  - Update copyright year
    
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12949)
    
  - Updates CHANGES and NEWS for the new release
    
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12949)
    
  - Add const to 'ppin' function parameter
    
    CLA: trivial
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    GH: #12205
    (cherry picked from commit 434343f896a2bb3e5857cc9831c38f8cd1cceec1)
    
  - Support keys with RSA_METHOD_FLAG_NO_CHECK with OCSP sign
    
    OCSP_basic_sign_ctx() in ocsp_srv.c , does not check for RSA_METHOD_FLAG_NO_CHECK.
    If a key has RSA_METHOD_FLAG_NO_CHECK set, OCSP sign operations can fail
    because the X509_check_private_key() can fail.
    
    The check for the RSA_METHOD_FLAG_NO_CHECK was moved to crypto/rsa/rsa_ameth.c
    as a common place to check. Checks in ssl_rsa.c were removed.
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tim Hudson <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12419)
    
  - Disallow certs with explicit curve in verification chain
    
    The check is applied only with X509_V_FLAG_X509_STRICT.
    
    Fixes #12139
    
    Reviewed-by: David von Oheimb <[email protected]>
    Reviewed-by: Nicola Tuveri <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12909)
    
  - EC_KEY: add EC_KEY_decoded_from_explicit_params()
    
    The function returns 1 when the encoding of a decoded EC key used
    explicit encoding of the curve parameters.
    
    Reviewed-by: David von Oheimb <[email protected]>
    Reviewed-by: Nicola Tuveri <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12909)
    
  - Fix: ecp_nistz256-armv4.S bad arguments
    
    Fix this error:
    
    crypto/ec/ecp_nistz256-armv4.S:3853: Error: bad arguments to instruction -- `orr r11,r10'
    crypto/ec/ecp_nistz256-armv4.S:3854: Error: bad arguments to instruction -- `orr r11,r12'
    crypto/ec/ecp_nistz256-armv4.S:3855: Error: bad arguments to instruction -- `orrs r11,r14'
    
    CLA: trivial
    
    Fixes #12848
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Kurt Roeckx <[email protected]>
    GH: #12854
    (cherry picked from commit b5f82567afa820bac55b7dd7eb9dd510c32c3ef6)
    
  - Revert two renamings backported from master
    
    The original names were more intuitive: the generate_counter counts the
    number of generate requests, and the reseed_counter counts the number
    of reseedings (of the principal DRBG).
    
        reseed_gen_counter  -> generate_counter
        reseed_prop_counter -> reseed_counter
    
    This partially reverts commit 35a34508ef4d649ace4e373e1d019192b7e38c36.
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12759)
    
  - Fix the DRBG seed propagation
    
    In a nutshell, reseed propagation is a compatibility feature with the sole
    purpose to support the traditional way of (re-)seeding manually by calling
    'RAND_add()' before 'RAND_bytes(). It ensures that the former has an immediate
    effect on the latter *within the same thread*, but it does not care about
    immediate reseed propagation to other threads. The implementation is lock-free,
    i.e., it works without taking the lock of the primary DRBG.
    
    Pull request #7399 not only fixed the data race issue #7394 but also changed
    the original implementation of the seed propagation unnecessarily.
    This commit reverts most of the changes of commit 1f98527659b8 and intends to
    fix the data race while retaining the original simplicity of the seed propagation.
    
    - use atomics with relaxed semantics to load and store the seed counter
    - add a new member drbg->enable_reseed_propagation to simplify the
      overflow treatment of the seed propagation counter
    - don't handle races between different threads
    
    This partially reverts commit 1f98527659b8290d442c4e1532452b9ba6463f1e.
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12759)
    
  - Fix memory leaks in conf_def.c
    
    Fixes #12471
    CLA: trivial
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Shane Lontis <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12533)
    
    (cherry picked from commit 4348995b0d818203f37ffa51c9bdf4488cf24bad)
    
  - Coverity Fixes
    
    x_algor.c: Explicit null dereferenced
    cms_sd.c: Resource leak
    ts_rsp_sign.c Resource Leak
    extensions_srvr.c: Resourse Leak
    v3_alt.c: Resourse Leak
    pcy_data.c: Resource Leak
    cms_lib.c: Resource Leak
    drbg_lib.c: Unchecked return code
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Shane Lontis <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12531)
    
  - Fix PEM_write_bio_PrivateKey_traditional() to not output PKCS#8
    
    PEM_write_bio_PrivateKey_traditional() uses i2d_PrivateKey() to do the
    actual encoding to DER.  However, i2d_PrivateKey() is a generic
    function that will do what it can to produce output according to what
    the associated EVP_PKEY_ASN1_METHOD offers.  If that method offers a
    function 'old_priv_encode', which is expected to produce the
    "traditional" encoded form, then i2d_PrivateKey() uses that.  If not,
    i2d_PrivateKey() will go on and used more modern methods, which are
    all expected to produce PKCS#8.
    
    To ensure that PEM_write_bio_PrivateKey_traditional() never produces
    more modern encoded forms, an extra check that 'old_priv_encode' is
    non-NULL is added.  If it is NULL, an error is returned.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12729)
    
  - Ignore vendor name in Clang version number.
    
    For example, FreeBSD prepends "FreeBSD" to version string, e.g.,
    
    FreeBSD clang version 11.0.0 ([email protected]:llvm/llvm-project.git llvmorg-11.0.0-rc2-0-g414f32a9e86)
    Target: x86_64-unknown-freebsd13.0
    Thread model: posix
    InstalledDir: /usr/bin
    
    This prevented us from properly detecting AVX support, etc.
    
    CLA: trivial
    
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12725)
    
    (cherry picked from commit cd84d8832d274357a5ba5433640d7ef76691b1ac)
    
  - sslapitest: Add test for premature call of SSL_export_keying_material
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12594)
    
    (cherry picked from commit ea9f6890eb54e4b9e8b81cc1318ca3a6fc0c8356)
    
  - Avoid segfault in SSL_export_keying_material if there is no session
    
    Fixes #12588
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12594)
    
    (cherry picked from commit dffeec1c10a874d7c7b83c221dbbce82f755edb1)
    
  - Fix a test_verify failure
    
    A recently added certificate in test/certs expired causing test_verify to fail.
    This add a replacement certificate with a long expiry date.
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12561)
    
  - Fix typos and repeated words
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12370)
    
  - Update EVP_EncodeInit.pod
    
    Fix EVP_EncodeBlock description using incorrect parameter name for encoding length
    
    CLA: trivial
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12518)
    
    (cherry picked from commit 1660c8fa6be2d7c4587e490c88a44a870e9b4298)
    
  - test/drbgtest.c: Fix error check test
    
    The condition in test_error_checks() was inverted, so the test succeeded
    as long as error_check() failed. Incidently, error_check() contained
    several bugs that assured it always failed, thus giving overall drbg
    test success.
    
    Remove the broken explicit zero check.
    RAND_DRBG_uninstantiate() cleanses the data via drbg_ctr_uninstantiate(),
    but right after that it resets drbg->data.ctr using RAND_DRBG_set(),
    so TEST_mem_eq(zero, sizeof(drbg->data)) always failed.
    
    (backport from https://github.com/openssl/openssl/pull/11195)
    
    Signed-off-by: Vitezslav Cizek <[email protected]>
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Matthias St. Pierre <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12517)
    
  - fixed swapped parameters descriptions for x509
    
    CLA: trivial
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12505)
    
  - Avoid errors with a priori inapplicable protocol bounds
    
    The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
    ignore TLS protocol version bounds when configurign DTLS-based contexts,
    and conversely, silently ignore DTLS protocol version bounds when
    configuring TLS-based contexts.  The commands can be repeated to set
    bounds of both types.  The same applies with the corresponding
    "min_protocol" and "max_protocol" command-line switches, in case some
    application uses both TLS and DTLS.
    
    SSL_CTX instances that are created for a fixed protocol version (e.g.
    TLSv1_server_method()) also silently ignore version bounds.  Previously
    attempts to apply bounds to these protocol versions would result in an
    error.  Now only the "version-flexible" SSL_CTX instances are subject to
    limits in configuration files in command-line options.
    
    Expected to resolve #12394
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    
    GH: #12507
    
  - man3: Drop warning about using security levels higher than 1.
    
    Today, majority of web-browsers reject communication as allowed by the
    security level 1. Instead key sizes and algorithms from security level
    2 are required. Thus remove the now obsolete warning against using
    security levels higher than 1. For example Ubuntu, compiles OpenSSL
    with security level set to 2, and further restricts algorithm versions
    available at that security level.
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12444)
    
    (cherry picked from commit 02e14a65fd6cc63204b43a79d510e95a63bdd901)
    
  - doc: Fix documentation of EVP_EncryptUpdate().
    
    The documentation was off by one for the length this function could return.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12435)
    
    (cherry picked from commit 3fc164e8d18dcdef57d297956debf8d966e7fbef)
    
  - x509_vfy.c: Improve key usage checks in internal_verify() of cert chains
    
    If a presumably self-signed cert is last in chain we verify its signature
    only if X509_V_FLAG_CHECK_SS_SIGNATURE is set. Upon this request we do the
    signature verification, but not in case it is a (non-conforming) self-issued
    CA certificate with a key usage extension that does not include keyCertSign.
    
    Make clear when we must verify the signature of a certificate
    and when we must adhere to key usage restrictions of the 'issuing' cert.
    Add some comments for making internal_verify() easier to understand.
    Update the documentation of X509_V_FLAG_CHECK_SS_SIGNATURE accordingly.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12357)
    
  - Fix issue 1418 by moving check of KU_KEY_CERT_SIGN and weakening check_issued()
    
    Move check that cert signing is allowed from x509v3_cache_extensions() to
    where it belongs: internal_verify(), generalize it for proxy cert signing.
    Correct and simplify check_issued(), now checking self-issued (not: self-signed).
    Add test case to 25-test_verify.t that demonstrates successful fix.
    
    As prerequisites, this adds the static function check_sig_alg_match()
    and the internal functions x509_likely_issued() and x509_signing_allowed().
    
    This is a backport of the core of PR #10587.
    Fixes #1418
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12357)
    
  - Enable WinCE build without deceiving _MSC_VER.
    
    Reviewed-by: Mark J. Cox <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11526)
    
    (cherry picked from commit c35b8535768e22cd3b7743f4887a72e53a621a5f)
    
  - To generate makefile with correct parameters for WinCE.
    
    Reviewed-by: Mark J. Cox <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11526)
    
    (cherry picked from commit a1736f37aee855fecf463b9f15519e12c333ecfc)
    
  - Disable optimiization of BN_num_bits_word() for VS2005 ARM compiler due to
    its miscompilation of the function.
    https://mta.openssl.org/pipermail/openssl-users/2018-August/008465.html
    
    Reviewed-by: Mark J. Cox <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11526)
    
    (cherry picked from commit 7a09fab2b3d201062a2cc07c1a40d09d61ea31bd)
    
  - Changed uintptr_t to size_t. WinCE6 doesn't seem it have the definition.
    
    Reviewed-by: Mark J. Cox <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11526)
    
    (cherry picked from commit 6c2a56beec847da18e5ac60a30219f0dea39baf9)
    
  - [1.1.1][test] Avoid missing EC_GROUP wrappers
    
    Backport of https://github.com/openssl/openssl/pull/12096 to 1.1.1 broke
    the build as the following functions are missing:
    
        const BIGNUM *EC_GROUP_get0_field(const EC_GROUP *group);
        int EC_GROUP_get_field_type(const EC_GROUP *group);
    
    Turns out that for the purposes of the test code, we don't really need
    to differentiate between prime and binary fields, and we can directly
    use the existing `EC_GROUP_get_degree()` in the same fashion as was
    being done for binary fields also for prime fields.
    
    Fixes https://github.com/openssl/openssl/issues/12432
    
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12433)
    
  - [test] ectest: check custom generators
    
    Reviewed-by: Nicola Tuveri <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12096)
    
    (cherry picked from commit a01cae99ac384cb6a74b46ccdc90736fe0754958)
    
  - improve SSL_CTX_set_tlsext_ticket_key_cb ref impl
    
    improve reference implementation code in
      SSL_CTX_set_tlsext_ticket_key_cb man page
    
    change EVP_aes_128_cbc() to EVP_aes_256_cbc(), with the implication
    of requiring longer keys.  Updating this code brings the reference
    implementation in line with implementation in openssl committed in 2016:
    commit 05df5c20
    Use AES256 for the default encryption algorithm for TLS session tickets
    
    add comments where user-implementation is needed to complete code
    
    (backport from https://github.com/openssl/openssl/pull/12063)
    
    Reviewed-by: Ben Kaduk <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12391)
    
  - [test][15-test_genec] Improve EC tests with genpkey
    
    Test separately EC parameters and EC key generation.
    
    Some curves only support explicit params encoding.
    
    For some curves we have had cases in which generating the parameters
    under certain conditions failed, while generating and serializing a key
    under the same conditions did not.
    See <https://github.com/openssl/openssl/issues/12306> for more details.
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12308)
    
  - [apps/genpkey] exit status should not be 0 on output errors
    
    If the key is to be serialized or printed as text and the framework
    returns an error, the app should signal the failure to the user using
    a non-zero exit status.
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12305)
    
    (cherry picked from commit 466d30c0d7fa861a5fcbaebd2e2010a8c2aea322)
    
  - [EC][ASN1] Detect missing OID when serializing EC parameters and keys
    
    The following built-in curves do not have an assigned OID:
    
    - Oakley-EC2N-3
    - Oakley-EC2N-4
    
    In general we shouldn't assume that an OID is always available.
    
    This commit detects such cases, raises an error and returns appropriate
    return values so that the condition can be detected and correctly
    handled by the callers, when serializing EC parameters or EC keys with
    the default `ec_param_enc:named_curve`.
    
    Fixes #12306
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12312)
    
  - Configure: Check source and build dir equality a little more thoroughly
    
    'absolutedir' does a thorough job ensuring that we have a "real" path
    to both source and build directory, unencumbered by symbolic links.
    However, that isn't enough on case insensitive file systems on Unix
    flavored platforms, where it's possible to stand in, for example,
    /PATH/TO/Work/openssl, and then do this:
    
        perl ../../work/openssl/Configure
    
    ... and thereby having it look like the source directory and the build
    directory aren't the same.
    
    We solve this by having a closer look at the computed source and build
    directories, and making sure they are exactly the same strings if they
    are in fact the same directory.
    
    This is especially important when making symbolic links based on this
    directories, but may have other ramifications as well.
    
    Fixes #12323
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12337)
    
    (cherry picked from commit 610e2b3b7019b11d97f1dcda13575254a2c65c3d)
    
  - Free pre_proc_exts in SSL_free()
    
    Usually it will be freed in tls_early_post_process_client_hello().
    However if a ClientHello callback will be used and will return
    SSL_CLIENT_HELLO_RETRY then tls_early_post_process_client_hello()
    may never come to the point where pre_proc_exts is freed.
    
    Fixes #12194
    
    CLA: trivial
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12330)
    
    (cherry picked from commit 94941cada25433a7dca35b5b9f8cbb751ab65ab3)
    
  - doc: remove reference to the predecessor of SHA-1.
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12322)
    
    (cherry picked from commit 69f982679ec0c8887a4324d8518a33808fee1cd7)
    
  - Fix a typo on the SSL_dup page
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12245)
    
  - Add an SSL_dup test
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12245)
    
  - Don't attempt to duplicate the BIO state in SSL_dup
    
    SSL_dup attempted to duplicate the BIO state if the source SSL had BIOs
    configured for it. This did not work.
    
    Firstly the SSL_dup code was passing a BIO ** as the destination
    argument for BIO_dup_state. However BIO_dup_state expects a BIO * for that
    parameter. Any attempt to use this will either (1) fail silently, (2) crash
    or fail in some other strange way.
    
    Secondly many BIOs do not implement the BIO_CTRL_DUP ctrl required to make
    this work.
    
    Thirdly, if rbio == wbio in the original SSL object, then an attempt is made
    to up-ref the BIO in the new SSL object - even though it hasn't been set
    yet and is NULL. This results in a crash.
    
    This appears to have been broken for a very long time with at least some of
    the problems described above coming from SSLeay. The simplest approach is
    to just remove this capability from the function.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12245)
    
  - Update the SSL_dup documentation to match reality
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12245)
    
  - Ensure that SSL_dup copies the min/max protocol version
    
    With thanks to Rebekah Johnson for reporting this issue.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12245)
    
  - Force ssl/tls protocol flags to use stream sockets
    
    Prior to this patch doing something like
      openssl s_client -dtls1 -tls1 ...
    could cause s_client to speak TLS on a UDP socket
    which does not normally make much sense.
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12266)
    
    (cherry picked from commit 2c9ba46c90e9d25040260bbdc43e87921f08c788)
    
  - Configuration: do not overwrite BASE_unix ex_libs in AIX
    
    BASE_unix sets ex_libs to `-lz` based the on zlib linking.
    AIX platforms overwrote this instead of adding to it.
    
    CLA: Trivial
    
    Signed-off-by: Attila Szakacs <[email protected]>
    
    Reviewed-by: Shane Lontis <[email protected]>
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12271)
    
    (cherry picked from commit b1f9db698011e5a178d53483eccfd0a44f132baf)
    
  - doc/man3: fix types taken by HMAC(), HMAC_Update()
    
    HMAC() and HMAC_Update() take size_t for 'n' and 'len' respectively.
    
    CLA: trivial
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12264)
    
    (cherry picked from commit cc63865f336e0144f8501aa0a862ba0247a50622)
    
  - Fix wrong return value check of mmap function
    
    The mmap function never returns NULL. If an error occurs, the function returns MAP_FAILED.
    
    CLA: trivial
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12187)
    
    (cherry picked from commit 1d78129dd205e3e85083a91c33540a70c51b0a23)
    
  - Refactor BN_R_NO_INVERSE logic in internal functions
    
    Closes #12129
    
    As described in https://github.com/openssl/openssl/issues/12129 the
    readability of the internal functions providing the two alternative
    implementations for `BN_mod_inverse()` is a bit lacking.
    
    Both these functions are now completely internal, so we have the
    flexibility needed to slightly improve readability and remove
    unnecessary NULL checks.
    
    The main changes here are:
    - rename `BN_mod_inverse_no_branch()` as `bn_mod_inverse_no_branch()`:
      this function is `static` so it is not even visible within the rest of
      libcrypto. By convention upcase prefixes are reserved for public
      functions.
    - remove `if (pnoinv == NULL)` checks in `int_bn_mod_inverse()`: this
      function is internal to the BN module and we can guarantee that all
      callers pass non-NULL arguments.
    - `bn_mod_inverse_no_branch()` takes an extra `int *pnoinv` argument, so
      that it can signal if no inverse exists for the given inputs: in this
      way the caller is in charge of raising `BN_R_NO_INVERSE` as it is the
      case for the non-consttime implementation of `int_bn_mod_inverse()`.
    - `BN_mod_inverse()` is a public function and must guarantee that the
      internal functions providing the actual implementation receive valid
      arguments. If the caller passes a NULL `BN_CTX` we create a temporary
      one for internal use.
    - reorder function definitions in `crypto/bn/bn_gcd.c` to avoid forward
      declaration of `static` functions (in preparation for inlining)
    - inline `bn_mod_inverse_no_branch()`.
    
    (Backport to 1.1.1 from https://github.com/openssl/openssl/pull/12142)
    (cherry picked from commit 5d8b3a3ef2941b8822523742a0408ca6896aa65d)
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12169)
    
  - Make it clear that you can't use all ciphers for CMAC
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12107)
    
  - Add a CMAC test
    
    We did not have a test of the low level CMAC APIs so we add one. This is
    heavily based on the HMAC test.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12107)
    
  - Correctly handle the return value from EVP_Cipher() in the CMAC code
    
    EVP_Cipher() is a very low level routine that directly calls the
    underlying cipher function. It's return value semantics are very odd.
    Depending on the type of cipher 0 or -1 is returned on error. We should
    just check for <=0 for a failure.
    
    Fixes #11957
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12107)
    
  - Ensure we never use a partially initialised CMAC_CTX
    
    If the CMAC_CTX is partially initialised then we make a note of this so
    that future operations will fail if the initialisation has not been
    completed.
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12107)
    
  - use safe primes in ssl_get_auto_dh()
    
    DH_get_1024_160() and DH_get_2048_224() return parameters from
    RFC5114. Those parameters include primes with known small subgroups,
    making them unsafe. Change the code to use parameters from
    RFC 2409 and RFC 3526 instead (group 2 and 14 respectively).
    
    This patch also adds automatic selection of 4096 bit params for 4096 bit
    RSA keys
    
    backport of 7646610
    
    Signed-off-by: Hubert Kario <[email protected]>
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12160)
    
  - CMS_get0_signers() description
    
    CLA: trivial
    
    Reviewed-by: Shane Lontis <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12055)
    
    (cherry picked from commit 9ac916c7529a21cd01d1b539362abf8402719e30)
    
  - EVP: allow empty strings to EVP_Decode* functions
    
    This is a simple check order correction.
    
    Fixes #12143
    
    Reviewed-by: Ben Kaduk <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12144)
    
    (cherry picked from commit 0800288e6e1d9f44d471043a970ba57743ca8f4c)
    
  - doc: Random spellchecking
    
    A little spell checking.
    
    Backport of commit
      af0d413654d19 ("doc: Random spellchecking")
    
    Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Paul Dale <[email protected]>
    GH: #12075
    
  - Do not allow dropping Extended Master Secret extension on renegotiaton
    
    Abort renegotiation if server receives client hello with Extended Master
    Secret extension dropped in comparison to the initial session.
    
    Fixes #9754
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12099)
    
  - Test genpkey app for EC keygen with various args
    
    This commit adds a new recipe to test EC key generation with the
    `genpkey` CLI app.
    
    For each built-in curve, it tests key generation with text output, in
    PEM and in DER format, using `explicit` and `named_curve` for parameters
    encoding.
    
    The list of built-in curves is static at the moment, as this allows to
    differentiate between prime curves and binary curves to avoid failing
    when ec2m is disabled.
    
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12085)
    
  - Silence gcc false positive warning on alpn_protos_len in test/handshake_helper.c
    
    Fixes #12033
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12041)
    
  - Silence gcc false positive warning on refdatalen in test/tls13encryptiontest.c
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12041)
    
  - Fix err checking and mem leaks of BIO_set_conn_port and BIO_set_conn_address
    
    Reviewed-by: Bernd Edlinger <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12036)
    
  - Replace BUF_strdup() call by OPENSSL_strdup() adding failure check in bss_acpt.c
    
    Add OPENSSL_strdup failure check to cpt_ctrl() in bss_acpt.c
    
    Reviewed-by: Bernd Edlinger <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12036)
    
  - [crypto/ec] Remove unreachable AVX2 code in NISTZ256 implementation
    
    `crypto/ec/ecp_nistz256.c` contained code sections guarded by a
    `ECP_NISTZ256_AVX2` define.
    
    The relevant comment read:
    
    > /*
    >  * Note that by default ECP_NISTZ256_AVX2 is undefined. While it's great
    >  * code processing 4 points in parallel, corresponding serial operation
    >  * is several times slower, because it uses 29x29=58-bit multiplication
    >  * as opposite to 64x64=128-bit in integer-only scalar case. As result
    >  * it doesn't provide *significant* performance improvement. Note that
    >  * just defining ECP_NISTZ256_AVX2 is not sufficient to make it work,
    >  * you'd need to compile even asm/ecp_nistz256-avx.pl module.
    >  */
    
    Without diminishing the quality of the original submission, it's evident
    that this code has been basically unreachable without modifications to
    the library source code and is under-tested.
    
    This commit removes these sections from the codebase.
    
    (cherry picked from commit 00da0f69890874feaa555fafb99b967b861e9118 ,
     backported from https://github.com/openssl/openssl/pull/12019 )
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12046)
    
  - Fix a typo in SSL_CTX_set_session_ticket_cb.pod
    
    "SSL" takes two esses, not three.
    
    [skip ci]
    
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12038)
    
    (cherry picked from commit 09527c493596060544bda92ecd0d8ef40a366c5e)
    
  - enable DECLARE_DEPRECATED macro for Oracle Developer Studio compiler
    
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/9575)
    
  - Fix a buffer overflow in drbg_ctr_generate
    
    This can happen if the 32-bit counter overflows
    and the last block is not a multiple of 16 bytes.
    
    Fixes #12012
    
    [extended tests]
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Patrick Steuer <[email protected]>
    Reviewed-by: Kurt Roeckx <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12016)
    
    (cherry picked from commit 42fa3e66697baa121220b4eacf03607280e4ff89)
    
  - fix a docs typo
    
    Correct "EC_KEY_point2buf" to "EC_POINT_point2buf". The former does not exist.
    
    CLA: trivial
    
    Reviewed-by: Ben Kaduk <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11988)
    
    (cherry picked from commit a5a87011baeef71c86938a2bae54f89fbe99e5dc)
    
  - Prevent extended tests run unexpectedly in appveyor
    
    Reason turns out that "git log -2" is picking up a merge
    commit and a random commit message from the master branch.
    
    Restore the expected behavior by using
    git log -1 $env:APPVEYOR_PULL_REQUEST_HEAD_COMMIT
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11981)
    
    (cherry picked from commit d805b83166538907535862372c16ff6ceb648b21)
    
  - Revert the check for NaN in %f format
    
    Unfortunately -Ofast seems to break that check.
    
    Fixes #11994
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/12003)
    
    (cherry picked from commit 41dccd68b9b9b7622b26d264c5fa190aa5bd4201)
    
  - Make BIO_do_connect() and friends handle multiple IP addresses
    
    Backport of #11971
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11989)
    
  - bio printf: Avoid using rounding errors in range check
    
    There is a problem casting ULONG_MAX to double which clang-10 is warning about.
    ULONG_MAX typically cannot be exactly represented as a double.  ULONG_MAX + 1
    can be and this fix uses the latter, however since ULONG_MAX cannot be
    represented exactly as a double number we subtract 65535 from this number,
    and the result has at most 48 leading one bits, and can therefore be
    represented as a double integer without rounding error.  By adding
    65536.0 to this number we achive the correct result, which should avoid the
    warning.
    
    The addresses a symptom of the underlying problem: we print doubles via an
    unsigned long integer.  Doubles have a far greater range and should be printed
    better.
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11955)
    
    (cherry picked from commit 082c041b4233b17b80129d4ac6b33a28014442b0)
    
  - EVP_EncryptInit.pod: fix example
    
    Signed-off-by: Patrick Steuer <[email protected]>
    
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11976)
    
    (cherry picked from commit d561b84143f5e7956454090e15de0c5e1425ceac)
    
  - AES CTR-DRGB: performance improvement
    
    Optimize the the AES-based implementation of the CTR_DRBG
    construction, see 10.2.1 in [1].
    Due to the optimizations, the code may deviate (more) from the
    pseudocode in [1], but it is functional equivalence being decisive
    for compliance:
    
    "All DRBG mechanisms and algorithms are described in this document
    in pseudocode, which is intended to explain functionality.
    The pseudocode is not intended to constrain real-world
    implementations." [9 in [1]].
    
    The following optimizations are done:
    
    - Replace multiple plain AES encryptions by a single AES-ECB
      encryption of a corresponding pre-initialized buffer, where
      possible.
      This allows platform-specific AES-ECB support to
      be used and reduces the overhead of multiple EVP calls.
    
    - Replace the generate operation loop (which is a counter
      increment followed by a plain AES encryption) by a
      loop which does a plain AES encryption followed by
      a counter increment. The latter loop is just a description
      of AES-CTR, so we replace it by a single AES-CTR
      encryption.
      This allows for platform-specific AES-CTR support to be used
      and reduces the overhead of multiple EVP calls.
      This change, that is, going from a pre- to a post- counter
      increment, requires the counter in the internal state
      to be kept at "+1" (compared to the pseudocode in [1])
      such that it is in the correct state, when a generate
      operation is called.
      That in turn also requires all other operations to be
      changed from pre- to post-increment to keep functional
      equivalence.
    
    [1] NIST SP 800-90A Revision 1
    
    Signed-off-by: Patrick Steuer <[email protected]>
    
    Reviewed-by: Tomas Mraz <[email protected]>
    
    (cherry picked from commit 28bdbe1aaa474ae8cd83e520d02e463e46ce89d9)
    
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11968)
    
  - Avoid undefined behavior with unaligned accesses
    
    Fixes: #4983
    
    [extended tests]
    
    Reviewed-by: Nicola Tuveri <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11781)
    
  - More testing for CLI usage of Ed25519 and Ed448 keys
    
    Add testing for the `req` app and explicit conversion tests similar to
    what is done for ECDSA keys.
    
    The included test keys for Ed25519 are from the examples in RFC 8410
    (Sec. 10)
    
    The key for Ed448 is derived from the first of the test vectors in
    RFC 8032 (Sec. 7.4) using OpenSSL to encode it into PEM format.
    
    (cherry picked from commit 81722fdf2e01cfa71c46abbcc19e65aa003e083f)
    
    This is originally a cherry-pick from
    https://github.com/openssl/openssl/pull/10410, with trivial changes from
    the original commit to account for the differences in 1.1.1.
    
    Fixes #10687
    
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11939)
    
  - More testing for sign/verify through `dgst`
    
    Add tests for signature generation and verification with `dgst` CLI for
    common key types:
    - RSA
    - DSA
    - ECDSA
    
    (cherry picked from commit ef1e59ed833e8ed1d5f4de5b0c734da8561890e3)
    
    This is a backport from https://github.com/openssl/openssl/pull/10410.
    Support for testing EdDSA through `pkeyutl` was dropped as the required
    `-rawin` option is not supported in 1.1.1.
    
    Fixes #10687
    
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11939)
    
  - Coverity 1463830: Resource leaks (RESOURCE_LEAK)
    
    Reviewed-by: Tim Hudson <[email protected]>
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11941)
    
    (cherry picked from commit bbc3c22c0e2b3b4b6f069712dc8322a48506b775)
    
  - Fix B<..> vs. I<..> and add two remarks in OSSL_STORE_open.pod
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11912)
    
  - Allow NULL arg to OSSL_STORE_close()
    
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11912)
    
  - There is no -signreq option in CA.pl
    
    CLA: trivial
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11897)
    
  - Prevent use after free of global_engine_lock
    
    If buggy application calls engine functions after cleanup of engines
    already happened the global_engine_lock will be used although
    already freed.
    
    See for example:
    https://bugzilla.redhat.com/show_bug.cgi?id=1831086
    
    Reviewed-by: Bernd Edlinger <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11896)
    
    (cherry picked from commit e12813d0d31f4f7be2ccc592d382ef3e94bdb842)
    
  - STORE: Make try_decode_PrivateKey() ENGINE aware
    
    This function only considered the built-in and application
    EVP_PKEY_ASN1_METHODs, and is now amended with a loop that goes
    through all loaded engines, using whatever table of methods they each
    have.
    
    Fixes #11861
    
    (cherry picked from commit b84439b06a1b9a7bfb47e230b70a6d3ee46e8a19)
    
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11887)
    
  - Fix d2i_PrivateKey() to work as documented
    
    d2i_PrivateKey() is documented to return keys of the type given as
    first argument |type|, unconditionally.  Most specifically, the manual
    says this:
    
    > An error occurs if the decoded key does not match type.
    
    However, when faced of a PKCS#8 wrapped key, |type| was ignored, which
    may lead to unexpected results.
    
    (cherry picked from commit b2952366dd0248bf35c83e1736cd203033a22378)
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Dmitry Belyavskiy <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11888)
    
  - t1_trce: Fix remaining places where the 24 bit shift overflow happens
    
    [extended tests]
    
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11857)
    
    (cherry picked from commit 7486c718e54cc762edc5f1c7c526ab83d0f97ef7)
    
  - Avoid potential overflow to the sign bit when shifting left 24 places
    
    Although there are platforms where int is 64 bit, 2GiB large BIGNUMs
    instead of 4GiB should be "big enough for everybody".
    
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11857)
    
    (cherry picked from commit 1d05eb55caa8965a151360c2469c463ecd990987)
    
  - Cast the unsigned char to unsigned int before shifting left
    
    This is needed to avoid automatic promotion to signed int.
    
    Fixes #11853
    
    [extended tests]
    
    Reviewed-by: Richard Levitte <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11857)
    
    (cherry picked from commit cbeb0bfa961412eebfbdf1e72900f05527e81e15)
    
  - Fix egd and devrandom source configs
    
    ./config --with-rand-seed=egd
    
    need to defines OPENSSL_RAND_SEED_EGD and OPENSSL_NO_EGD
    so get rid of OPENSSL_NO_EGD (compiles but I did not really test EGD)
    
    ./config --with-rand-seed=devrandom
    
    does not work since wait_random_seeded works under the assumption
    that OPENSSL_RAND_SEED_GETRANDOM is supposed to be enabled as well,
    that is usually the case, but not when only devrandom is enabled.
    Skip the wait code in this special case.
    
    Reviewed-by: Paul Dale <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11848)
    
    (cherry picked from commit ddec332f329a432a45c0131d83f3bfb46114532b)
    
  - Update early data exchange scenarios in doc
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11816)
    
    (cherry picked from commit b2a5001d954e81e2a582f2a935212ab554a3cbbe)
    
  - Update limitation of psk_client_cb and psk_server_cb in usage with TLSv1.3
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11816)
    
    (cherry picked from commit e0bcb4f97f7496af032013ead15b7472b60e85fa)
    
  - Fix some places where X509_up_ref is used
    without error handling.
    
    This takes up the ball from #11278
    without trying to solve everything at once.
    
    [extended tests]
    
    Reviewed-by: Kurt Roeckx <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11852)
    
  - TTY_get() in crypto/ui/ui_openssl.c open_console() can also return errno 1 (EPERM, Linux)
    
    Signed-off-by: Maxim Zakharov <[email protected]>
    
    Reviewed-by: Tomas Mraz <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11767)
    
    (cherry picked from commit 082394839ea32386abc7ee33aaa9da864287064c)
    
  - Test TLSv1.3 out-of-band PSK with all 5 ciphersuites
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11809)
    
  - Fix crash in early data send with out-of-band PSK using AES CCM
    
    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11809)
    
  - If SOURCE_DATE_EPOCH is defined, use it for copyright year
    
    Using the date from SOURCE_DATE_EPOCH instead of the current date makes
    it possible to reproduce a build that was built on a different year:
    https://reproducible-builds.org/specs/source-date-epoch/
    
    This is fixing an issue we had while building Tor Browser:
    https://trac.torproject.org/projects/tor/ticket/33535
    
    CLA: trivial
    
    Reviewed-by: Paul Dale <[email protected]>
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11296)
    
    (cherry picked from commit 11d7d903447ab866d037fb8bba4ceb49c7d89191)
    
  - Correct alignment calculation in ssl3_setup_write
    
    The alignment calculation in ssl3_setup_write incorrectly results in an
    alignment allowance of
    (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1) bytes. This equals 3
    in almost all cases. The maximum alignment actually used in do_ssl3_write
    is (SSL3_ALIGN_PAYLOAD - 1). This equals 7 bytes in almost all cases. So
    there is a potential to overrun the buffer by up to 4 bytes.
    
    Fortunately, the encryption overhead allowed for is 80 bytes which
    consists of 16 bytes for the cipher block size and 64 bytes for the MAC
    output. However the biggest MAC that we ever produce is HMAC-384 which is
    48 bytes - so we have a headroom of 16 bytes (i.e. more than the 4 bytes
    of potential overrun).
    
    Thanks to Nagesh Hegde for reporting this.
    
    Fixes #11766
    
    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11768)
    
    (cherry picked from commit d30ef639647ad263d09740c931a5bfb5a8b6a5f6)
    
  - Configure: Avoid SIXTY_FOUR_BIT for linux-mips64
    
    This is a 32-bit ABI build (as opposed to linux64-mips64).
    Setting SIXTY_FOUR_BIT breaks hardware optimizations, at least on
    octeon processors.
    
    Reviewed-by: Richard Levitte <[email protected]>
    Reviewed-by: Matt Caswell <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/11154)
    
  - Fix rsa8192.pem
    
    Q: How did I do that?
    
    A: That's a long story.
    
    Precondition: I used sage 8.1 for the math, it could probably
    done with simple python as well…

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to openssl#12312

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to openssl#12312

(cherry picked from commit b0527a5)

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to #12312

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #16355)

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to openssl#12312

(cherry picked from commit 7aa3dfc)

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to openssl#12312

(cherry picked from commit 7aa3dfc)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#12457)

* ASN1: Reset the content dump flag after dumping

When encountering a badly coded item, the DER printer (ASN1_print_dump())
sets a flag to ensure that an additional hex dump of the offending content
is printed as part of the output.  Unfortunately, this flag is never reset,
which means that all following items are printed with the extra hex dump,
whether they are faulty or not.

Resetting the flag after hex dumping ensures that only the faulty contents
are printed with the additional hex dump.

Fixes #14626

Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14627)

(cherry picked from commit 6e34a1048ce4871371eac224b995c3b4338f6166)

* Fix missing INVALID_EXTENSION

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14639)

* check_chain_extensions: Do not override error return value by check_curve

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the
certificates present in a certificate chain. It is not set by default.

Starting from OpenSSL version 1.1.1h a check to disallow certificates with
explicitly encoded elliptic curve parameters in the chain was added to the
strict checks.

An error in the implementation of this check meant that the result of a
previous check to confirm that certificates in the chain are valid CA
certificates was overwritten. This effectively bypasses the check
that non-CA certificates must not be able to issue other certificates.

If a "purpose" has been configured then a subsequent check that the
certificate is consistent with that purpose also checks that it is a
valid CA. Therefore where a purpose is set the certificate chain will
still be rejected even when the strict flag has been used. A purpose is
set by default in libssl client and server certificate verification
routines, but it can be overriden by an application.

Affected applications explicitly set the X509_V_FLAG_X509_STRICT
verification flag and either do not set a purpose for the certificate
verification or, in the case of TLS client or server applications,
override the default purpose to make it not set.

CVE-2021-3450

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Teach TLSProxy how to encrypt <= TLSv1.2 ETM records

Previously TLSProxy only knew how to "repack" messages for TLSv1.3.
Most of the handshake in <= TLSv1.2 is unencrypted so this hasn't been
too much of restriction. However we now want to modify reneg handshakes
which are encrypted so we need to add that capability.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Add a test for CVE-2021-3449

We perform a reneg handshake, where the second ClientHello drops the
sig_algs extension. It must also contain cert_sig_algs for the test to
work.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* ssl sigalg extension: fix NULL pointer dereference

As the variable peer_sigalgslen is not cleared on ssl rehandshake, it's
possible to crash an openssl tls secured server remotely by sending a
manipulated hello message in a rehandshake.

On such a manipulated rehandshake, tls1_set_shared_sigalgs() calls
tls12_shared_sigalgs() with the peer_sigalgslen of the previous
handshake, while the peer_sigalgs has been freed.
As a result tls12_shared_sigalgs() walks over the available
peer_sigalgs and tries to access data of a NULL pointer.

This issue was introduced by c589c34e61 (Add support for the TLS 1.3
signature_algorithms_cert extension, 2018-01-11).

Signed-off-by: Peter Kästle <[email protected]>
Signed-off-by: Samuel Sapalski <[email protected]>

CVE-2021-3449

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Ensure buffer/length pairs are always in sync

Following on from CVE-2021-3449 which was caused by a non-zero length
associated with a NULL buffer, other buffer/length pairs are updated to
ensure that they too are always in sync.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Update CHANGES and NEWS for new release

Reviewed-by: Tomas Mraz <[email protected]>

* Update copyright year

Reviewed-by: Tomas Mraz <[email protected]>

* Prepare for 1.1.1k release

Reviewed-by: Tomas Mraz <[email protected]>

* Prepare for 1.1.1l-dev

Reviewed-by: Tomas Mraz <[email protected]>

* Fix BIO_new_ssl_connect() to not leak memory

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14719)

(cherry picked from commit 7947a1eb13c221bbc034796bd394ba00b0e2387d)

* Fix typo in BIO_push.pod

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14718)

(cherry picked from commit 2db9bef264ba39e173d6b6a3a800595e15eef31b)

* Print correct error message in utils/mkdir-p.pl

Commit 70a56b914772e6b21cda2a5742817ae4bb7290f1 introduced a regression.

If utils/mkdir-p.pl fails to create a target dir because of insufficient file system
permissions, the subsequent test for dir existence always fails and overwrites
the system error. As a result, a user is presented with a misleading error message.

E.g. if a user tries to create a dir under /usr/local and does not have permissions
for it, the reported error message is "Cannot create directory /usr/local/lib: No such file or directory",
whereas the expected error message is "Cannot create directory /usr/local/lib: Permission denied".

This commit introduces a fix by declaring an additional local variable to cache
the original error message from mkdir. If -d check fails and overwrites the system
error, the user is still presented with the original error from mkdir.

CLA: Trivial

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14487)

(cherry picked from commit af2e1e9c81110ca1a156430686e2f171e80ebfa0)

* doc: fix enc -z option documentation

CLA: trivial

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14499)

(cherry picked from commit 6635ea531e9f7709e5880dd77fd4c3403a5c3db7)

* Remove unnecessary BIO_do_handshake()s

Since BIO_do_connect() and BIO_do_handshake() are same, no
need to invoke BIO_do_handshake() once more after BIO_do_connect().

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14725)

(cherry picked from commit 975e37cd016f86985d16f1ee646e88213494854a)

* Fix potential double free in sslapitest.c

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14758)

(cherry picked from commit 493e78986f9677c2b321273da51c276b9a8182d8)

* Fix typos in x509.pod

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14783)

(cherry picked from commit 4c979cbeeb9792b170670fa15e29d077597e7ee0)

* crl2pkcs7 shouldn't include empty optional sets

If using crl2pkcs7 -nocrl and with no -certfiles, we shouldn't include
the implicitly tagged [0] certs and [1] crls sets as they are marked
optional and would be empty.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14781)

(cherry picked from commit d3a5898a7f4980bc0fa6345c408f88007573c405)

* Handle set_alpn_protos inputs better.

It's possible to set an invalid protocol list that will be sent in a
ClientHello. This validates the inputs to make sure this does not
happen.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14679)

* srp: fix double free,

In function SRP_create_verifier_ex, it calls SRP_create_verifier_BN_ex(..., &v, ..) at line 653.
In the implementation of SRP_create_verifier_BN_ex(), *verify (which is the paremeter of v) is allocated a pointer via BN_new() at line 738.
And *verify is freed via BN_clear_free() at line 743, and return 0.
Then the execution continues up to goto err at line 655, and the freed v is freed again at line 687.

Bug reported by @Yunlongs

Fixes #14913

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14921)

(cherry picked from commit b06450bcf763735a89b65ca3ec176600fe7fceed)

* ts: fix double free on error path.

In function int_ts_RESP_verify_token, if (flags & TS_VFY_DATA) is true, function ts_compute_imprint() will be called at line 299.
In the implementation of ts_compute_imprint, it allocates md_alg at line 406.
But after the allocation, if the execution goto err, then md_alg will be freed in the first time by X509_ALGOR_free at line 439.

After that, ts_compute_imprint returns 0 and the execution goto err branch of int_ts_RESP_verify_token.
In the err branch, md_alg will be freed in the second time at line 320.

Bug reported by @Yunlongs

Fixes #14914

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14921)

(cherry picked from commit db78c84eb2fa9c41124690bcc2ea50e05f5fc7b7)

* engine: fix double free on error path.

In function try_decode_PKCS8Encrypted, p8 is freed via X509_SIG_free() at line 481.
If function new_EMBEDDED() returns a null pointer at line 483, the execution will goto nop8.
In the nop8 branch, p8 is freed again at line 491.

Bug reported by @Yunlongs

Fixes #14915

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14921)

(cherry picked from commit efe8d69daa1a68be0a7f0f73220947c848e7ed1d)

* Some compilers define __STDC_VERSION__ in c++

Some compilers(g++ on Solaris/Illumos) define __STDC__VERSION__ in c++ .
This causes c++ code that uses openssl to break on these compilers since
_Noreturn is not a keyword in c++ .

CLA: trivial

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14944)

(cherry picked from commit 1f3b58d8413cfa3824e9c0a146dee6ceedbc367e)

* Test that EVP_PKEY_cmp() returns 1 when comparing a key to itself

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14982)

* Correct the return value on match and mismatch for MAC pkeys

Fixes #14147

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14982)

* Don't remove $(TARFILE) when cleaning

This file is outside the source tree, so we have no business removing
it.  This is especially concerning if that was the tarball the user
had to create the source tree.

Fixes #14981

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14985)

(cherry picked from commit f58f7ec9397de7b752aa547e2677933559a657db)

* ASN1: Ensure that d2i_ASN1_OBJECT() frees the strings on ASN1_OBJECT reuse

The 'sn' and 'ln' strings may be dynamically allocated, and the
ASN1_OBJECT flags have a bit set to say this.  If an ASN1_OBJECT with
such strings is passed to d2i_ASN1_OBJECT() for reuse, the strings
must be freed, or there is a memory leak.

Fixes #14667

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14938)

* Test that we don't have a memory leak in d2i_ASN1_OBJECT.

Fixes #14667

Reworked test supplied by @smcpeak into a unit test.

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14938)

* man: s_server: fix typo in -alpn option description

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15098)

* Use OCSP-specific error code for clarity

Fixes #12735 for 1.1.1

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15109)

* Support for Android NDK r22

This is a backport of #13434, Fixes #13685.

I think builds using standalone toolchain are fine so I left them alone,
but `Configure` will fail if using the NDK directly because the
`platforms` and `sysroot` directories were removed.

If `sysroot` is missing, omit the `--sysroot` and `-gcc-toolchain`
arguments and use the triplet form clang command.

Also since `platforms` was being used for the default API level, use
`meta/platforms.json` instead if needed.

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/13694)

* Avoid sending alerts after shutdown

Fixes #11388

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15159)

(cherry picked from commit 22d1138fe2fde9a16e80b81de1d848ae6fa879ef)

* BIO_listen: disable setting ipv6_v6only on OpenBSD as it is a read only data and true

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15015)

(cherry picked from commit f7f0632b01cf16efccb133e395cf115c194bd003)

* Try to parse private key as PKCS#8 first, fallback afterwards

Fixes #15022

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15075)

* Testing private keys with extra attributes

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15075)

* check i2d_ASN1_TYPE return value

add a length check to the return value of function i2d_ASN1_TYPE. Return an error instead of trying to malloc a negative number.

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14828)

(cherry picked from commit c65abf2213117eb5348a46fbc18f706aca052e85)

* Improve RFC 8446 PSK key exchange mode compliance

It's a MUST-level requirement that if the client sends a pre_shared_key
extension not accompanied by a psk_key_exchange_modes extension, the
server must abort the handshake.  Prior to this commit the server
would continue on.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit efe0f315354b020213097885c79ce856a2f5ac68)

(Merged from https://github.com/openssl/openssl/pull/15255)

* make update

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15255)

* Don't send key_share for PSK-only key exchange

TLS 1.3 allows for the "psk_ke" and "psk_dhe_ke" key-exchange modes.
Only the latter mode introduces a new ephemeral (Diffie-Hellman)
key exchange, with the PSK being the only key material used in the
former case.

It's a compliance requirement of RFC 8446 that the server MUST NOT
send a KeyShareEntry when using the "psk_ke" mode, but prior to
this commit we would send a key-share based solely on whether the
client sent one.  This bug goes unnoticed in our internal test suite
since openssl communicating with openssl can never negotiate the
PSK-only key-exchange mode.  However, we should still be compliant
with the spec, so check whether the DHE mode was offered and don't
send a key-share if it wasn't.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit e776858bce32d473bd7a69c616ad7f6c2f979dfc)

(Merged from https://github.com/openssl/openssl/pull/15255)

* Update expected results for tls13kexmodes tests

One of the scenarios constructed in these tests was erroneously
producing successful handshakes until the previous commits, but should
have been failing.  Update our expected behavior to match the
specification requirements, and adjust the commentary slightly for
a test case relevant for the other preceding commit.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit 80c25611abd7067815943187f36f5e1879201678)

(Merged from https://github.com/openssl/openssl/pull/15255)

* Avoid division by zero in hybrid point encoding

In hybrid and compressed point encodings, the form octet contains a bit
of information allowing to calculate y from x.  For a point on a binary
curve, this bit is zero if x is zero, otherwise it must match the
rightmost bit of of the field element y / x.  The existing code only
considers the second possibility. It could thus incorrecly fail with a
division by zero error as found by Guido Vranken's cryptofuzz.

This commit adds a few explanatory comments to oct2point. The only
actual code change is in the last hunk which adds a BN_is_zero(x)
check to avoid the division by zero.

Fixes #15021

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15112)

* Test oct2point for hybrid point encoding of (0, y)

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15112)

* Inherit hostflags verify params even without hosts

X509_VERIFY_PARAM_inherit() now copies hostflags independently of hosts.

Previously hostflags were only copied when at least one host was set.
Typically applications don't configure hosts on SSL_CTX. The change
enables applications to configure hostflags on SSL_CTX and have OpenSSL
copy the flags from SSL_CTX to SSL.

Fixes: https://github.com/openssl/openssl/issues/14579
Signed-off-by: Christian Heimes <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14856)

* Properly restore XMM registers in ChaCha20's AVX-512(VL) assembly

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15315)

(cherry picked from commit 6d3f798cba8075e700003aaf34f1e72bb930086c)

* Cleanup the peer point formats on regotiation

Fixes #14875

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15383)

(cherry picked from commit 3f987381929ee725daf4746591144dde18f313e1)

* s_client.pod: Fix grammar in NOTES section.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12907)

* Call SSLfatal when the generate_ticket_cb returns 0

Otherwise, the state machine ends up being in a bad state:
```
SSL routines:write_state_machine:missing fatal:ssl/statem/statem.c:850:
```

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15485)

* Put init_ec_point_formats() inside #ifndef OPENSSL_NO_EC

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15518)

* Modify ssl_handshake_hash to call SSLfatal

When EVP_MD_CTX_new fails call SSLfatal before the goto err.
This resolves a state machine issue on the out of memory condition:
ssl/statem/statem.c:643: OpenSSL internal error: Assertion failed:
(s)->statem.in_init && (s)->statem.state == MSG_FLOW_ERROR

Fixes #15491.
CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15511)

* ee-self-signed.pem: Restore original version, adding -attime to 25-test_verify.t

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15505)

* Check the return value of ASN1_STRING_length

ASN1_STRING_length gets the field 'length' of msg, which
can be manipulated through a crafted input.
Add a check to avoid error execution of OPENSSL_malloc().

CLA: trivial

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15583)

(cherry picked from commit effb0dcf864110a4595f1a243adb9c1dd09eb516)

* Only call dtls1_start_timer() once

The function dtls1_handle_timeout() calls dtls1_double_timeout() which
was calling dtls1_start_timer(). However dtls1_start_timer() is also
called directly by dtls1_handle_timeout(). We only need to start the timer
once.

Fixes #15561

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15595)

(cherry picked from commit f570d33b02d824e2a3f676f718c4692572f45333)

* s390x: cipher must set EVP_CIPH_ALWAYS_CALL_INIT flag

The s390x cipher implementations must call their init function
even if the key argument is NULL to allow initializing the
cipher operation's context in any order.

Signed-off-by: Patrick Steuer <[email protected]>

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14900)

* Test EVP_CipherInit sequences and resets

Various EVP_CipherInit sequences including partial inits and initializations
with different "enc" flags caused problems on s390x. Similarly, cipher
reinitialization and especially GCM reinitialization with different tag length
led to wrong results. Add some unit tests to cover these rather exotic use
cases.

Signed-off-by: Patrick Steuer <[email protected]>

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14900)

* Clean away remaining Travis related files

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15693)

* enable getauxval on android 10

Fixes #9498

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15870)

* Use getauxval on Android with API level > 18

We received analytics that devices of the device family Oppo A37x
are crashing with SIGILL when trying to load libcrypto.so.
These crashes were fixed by using the system-supplied getauxval function.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15763)

* Add riscv64 target

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14724)

* apple getentropy removal

backport of #15924

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15935)

* Fix use of uninitialized memory in test_rsa_oaep

48f1739600f33c92387debce2002acec6e365f1d did not convert the RSA OAEP
tests correctly. The corrupted ciphertext and truncation tests were
really decrypting uninitialized memory, rather than the sample
ciphertext. This results in an error in tools like MSan.

The test is somewhat roundabout. In the original version, before the
conversion, ctext_ex was an OAEP test vector from key1(), etc.,
functions. The test would:

1. Encrypt ptext_ex as ctext.
2. Decrypt ctext and check it gives ptext_ex.
3. Decrypt ctext_ex and check it gives ptext_ex.
4. Try corrupted and truncated versions of ctext.

48f1739600f33c92387debce2002acec6e365f1d then moved steps 1 and 2 into
test_rsa_simple, which meant ctext is no longer available for step 4. It
then mistakenly left the variable around, but uninitialized, so the test
wasn't testing anything. (Confusingly, test_rsa_simple outputs ctext_ex
to the caller, but doesn't do anything with it. The ctext_ex output is
also only usable for OAEP, not PKCS#1 v1.5.)

It doesn't really matter whether we use ctext or ctext_ex for step 4, so
this PR fixes it by using ctext_ex instead.

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15950)

(cherry picked from commit 36a4637e158508f5d2fb7750e4870888072a56f9)

* doc: Mention the update of der data pointers in d2i/i2d

Fixes #15958

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15973)

* bn: procduce correct sign for result of BN_mod()

There is a problem that appears when calling BN_div(a, c, a, b) with negative b.
In this case, the sign of the remainder c is incorrect.  The problem only
occurs if the dividend and the quotient are the same BIGNUM.

Fixes #15982

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15991)

(cherry picked from commit 105c83150f15af3f78ea0758859062842bdbe30e)

* Fix memory leak in i2d_ASN1_bio_stream

When creating a signed S/MIME message using SMIME_write_CMS()
if the reading from the bio fails, the state is therefore
still ASN1_STATE_START when BIO_flush() is called by i2d_ASN1_bio_stream().
This results in calling asn1_bio_flush_ex cleanup but will only
reset retry flags as the state is not ASN1_STATE_POST_COPY.
Therefore 48 bytes (Linux x86_64) leaked since the
ndef_prefix_free / ndef_suffix_free callbacks are not executed
and the ndef_aux structure is not freed.

By always calling free function callback in asn1_bio_free() the
memory leak is fixed.

(cherry picked from commit 3a1d2b59522163ebb83bb68e13c896188dc222c6)

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15999)

* ssl: do not choose auto DH groups that are weaker than the security level

manual merge from https://github.com/openssl/openssl/pull/15818
id d7b5c648d682b499b71320a03747602a6ba4dec3

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15832)

* test: add test for auto DH security level meets the minimum

Manual merge from https://github.com/openssl/openssl/pull/15818
Commit id d0e5230dcecc6013d351545ceb275aa2ba5baa80

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15832)

* Fix s_server PSK handling

Issue #15951 describes a scenario which causes s_server to fail when using
a PSK. In the originally described issue this only impacted master and not
1.1.1. However, in fact this issue does also impact 1.1.1 - but only if you
additionally supply the option "-no_ticket" to the s_server command line.

The difference between the behaviour in master and 1.1.1 is due to 9c13b49,
which changed PSK_MAX_IDENTITY_LEN from 128 to 256. It just so happens that
a default OpenSSL TLSv1.3 ticket length happens to fall between those 2
values. Tickets are presented in TLSv1.3 as a PSK "identity". Passing
"no_ticket" doesn't actually stop TLSv1.3 tickets completely, it just
forces the use of "session ids as a ticket" instead. This significantly
reduces the ticket size to below 128 in 1.1.1.

The problem was due to s_server setting a TLSv1.2 PSK callback and a
TLSv1.3 PSK callback. For backwards compat reasons the TLSv1.2 PSK
callbacks also work in TLSv1.3 but are not preferred. In the described
scenario we use a PSK to create the initial connection. Subsequent to that
we attempt a resumption using a TLSv1.3 ticket (psk). If the psk length is
below PSK_MAX_IDENTITY_LEN then we first call the TLSv1.2 PSK callback.
Subsequently we call the TLSv1.3 PSK callback. Unfortunately s_server's
TLSv1.2 PSK callback accepts the identity regardless, even though it is an
unexpected value, and hence the binder subsequently fails to verify.

The fix is to bail early in the TLSv1.2 callback if we detect we are being
called from a TLSv1.3 connection.

Fixes #15951

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16008)

(cherry picked from commit 0007ff257c95f5cd046799e492436f41caf4ecb2)

* TEST: Check that i2d refuses to encode non-optional items with no content

The test case creates an RSA public key and tries to pass it through
i2d_PrivateKey().  This SHOULD fail, since the private bits are missing.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* ASN.1: Refuse to encode to DER if non-optional items are missing

Fixes #16026

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Fix test/asn1_encode_test.c to not use ASN1_FBOOLEAN

ASN1_FBOOLEAN is designed to use as a default for optional ASN1 items.
This test program used it for non-optional items, which doesn't encode
well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Fix test/asn1_encode_test.c to handle encoding/decoding failure

Make it only report (and fail on) encoding/decoding failures when success
is expected.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* make update (adds a new function code)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Avoid "excessive message size" for session tickets

We received a report of an "excessive message size" for a received
session ticket. Our maximum size was significantly less than the theoretical
maximum. The server may put any data it likes in the session ticket
including (for example) the full certificate chain so we should be able to
handle longer tickets. Update the value to the maximum allowed by the spec.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15877)

(cherry picked from commit e54f0c9b2fe3dd2dcb5e8100e2c69e5b2f6eb681)

* BIO_lookup_ex: use AI_ADDRCONFIG only if explicit host name is given

The flag only affects which record types are queried via DNS (A or
AAAA, or both).  When node is NULL and AF_UNSPEC is used, it prevents
getaddrinfo returning the right address associated with the loopback
interface.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16039)

* Avoid empty lines in nmake rule bodies

nmake is tolerant of those empty lines, but jom isn't.  That tolerance
isn't standard make behaviour, so we lean towards avoiding them.

We simply use '@rem' instead.

Fixes #16014

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16047)

* apps: Use the first detected address family if IPv6 is not available

This is a follow up of 15729bef385211bc2a0497e2d53a45c45d677d2c.  Even
when the host does not support IPv6 at all, BIO_lookup_ex may now
return IN6ADDR_ANY in addition to INADDR_ANY, as the second element of
the ai_next field.

After eee8a40aa5e06841eed6fa8eb4f6109238d59aea, the do_server function
prefers the IPv6 address and fails on the BIO_socket call.  This adds
a fallback code to retry with the IPv4 address returned as the first
element to avoid the error.

The failure had been partially avoided in the previous code with
AI_ADDRCONFIG, because getaddrinfo returns only IPv4 address if no
IPv6 address is associated with external interface.  However, it would
be still a problem if the external interface has an IPv6 address
assigned, while the loopback interface doesn't.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16078)

* Don't reset the packet pointer in ssl3_setup_read_buffer

Sometimes this function gets called when the buffers have already been
set up. If there is already a partial packet in the read buffer then the
packet pointer will be set to an incorrect value. The packet pointer already
gets reset to the correct value when we first read a packet anyway, so we
don't also need to do it in ssl3_setup_read_buffer.

Fixes #13729

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Disallow SSL_key_update() if there are writes pending

If an application is halfway through writing application data it should
not be allowed to attempt an SSL_key_update() operation. Instead the
SSL_write() operation should be completed.

Fixes #12485

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Fix some minor record layer issues

Various comments referred to s->packet and s->packet_length instead of
s->rlayer.packet and s->rlayer.packet_length. Also fixed is a spot where
RECORD_LAYER_write_pending() should have been used. Based on the review
comments in #16077.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>

(cherry picked from commit ca001524971ccd595bc0e9843611e6784adfc981)

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16105)

* Fix a read buffer overrun in X509_aux_print().

The ASN1_STRING_get0_data(3) manual explitely cautions the reader
that the data is not necessarily NUL-terminated, and the function
X509_alias_set1(3) does not sanitize the data passed into it in any
way either, so we must assume the return value from X509_alias_get0(3)
is merely a byte array and not necessarily a string in the sense
of the C language.

I found this bug while writing manual pages for X509_print_ex(3)
and related functions.  Theo Buehler <[email protected]> checked my
patch to fix the same bug in LibreSSL, see

http://cvsweb.openbsd.org/src/lib/libcrypto/asn1/t_x509a.c#rev1.9

As an aside, note that the function still produces incomplete and
misleading results when the data contains a NUL byte in the middle
and that error handling is consistently absent throughout, even
though the function provides an "int" return value obviously intended
to be 1 for success and 0 for failure, and even though this function
is called by another function that also wants to return 1 for success
and 0 for failure and even does so in many of its code paths, though
not in others.  But let's stay focussed.  Many things would be nice
to have in the wide wild world, but a buffer overflow must not be
allowed to remain in our backyard.

CLA: trivial

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16108)

(cherry picked from commit c5dc9ab965f2a69bca964c709e648158f3e4cd67)

* DSA/RSA_print(): Fix potential memory leak

Fixes #10777

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16130)

(cherry picked from commit 40184c96103a388209939c1c19920971c05bb78c)

* [doc/man3] documentation: BN_cmp manpage updates

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16214)

(cherry picked from commit 3d4ca443b4778e3230ff23f17625f58f815a9142)

* Revert "make update (adds a new function code)"

This reverts commit ea26844c4f624ef515d9228d3b623761a369b049.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to handle encoding/decoding failure"

This reverts commit f1d97905bbd8679b7647c992b97f526791069040.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to not use ASN1_FBOOLEAN"

This reverts commit 5434acb6c4d56507d761b28f7e142ccab808a8fa.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "ASN.1: Refuse to encode to DER if non-optional items are missing"

This reverts commit 006906cddda37e24a66443199444ef4476697477.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "TEST: Check that i2d refuses to encode non-optional items with no content"

This reverts commit 12e9b74c513a8ed3c1c260cf25221a465ae14b84.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Fix potential double-free

The `sk` variable is assigned to `s->session->peer_chain`.
If `ssl3_digest_cached_records()` were to fail, then `sk` would still be
non-NULL, and subsequently freed on the error return. When the session
is freed, it will then attempt to free `s->session->peer_chain`,
resulting in a double-free (of `sk`).

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16309)

(cherry picked from commit 0449702abc95a3af24c049cb02c01ca6a8015cef)

* s390x: AES OFB/CFB: Maintain running IV from cipher context

Copy the current IV from the cipher context into the kmo/kmf param before
the operation, and copy the modified IV back to the context afterwards.
Without this, an application that obtains the running IV from the context
would still get the original IV, but not the updated one.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* Test EVP Cipher updating the context's IV

Ensure that an EVP_CipherUpdate operation updates the context's
IV for AES CBC, CFB, OFB, and CTR. An application can get the
updated IV via EVP_CIPHER_CTX_iv().

The s390x implementation of the CFB and OFB ciphers did not
update the IV in the context, but only within its s390x specific
context data.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* pkcs12: check for zero length digest to avoid division by zero

Fixes #16331

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Kurt Roeckx <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16333)

* [github-ci] Sync ci.yml workflow with master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import windows.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import cross-compiles.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker workflows from master

This commit does not include the daily run-checker workflow.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker daily workflow from master

The daily run-checker is scheduled to start at 6:42, instead of the
start of the hour.

The official GitHub documentation remarks the following regarding
scheduled workflows:

> Note: The schedule event can be delayed during periods of high loads
> of GitHub Actions workflow runs. High load times include the start of
> every hour. To decrease the chance of delay, schedule your workflow to
> run at a different time of the hour.

42, obviously, has been picked because it is the answer to the ultimate
question of life, the universe, and everything.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][cross-compiles.yml] Disable sparcv9

This commit temporarily disables cross-compiling tests for sparcv9, due
to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable krb5 external tests

This commit temporarily disables krb5 external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable pyca external tests

This commit temporarily disables pyca external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-ci.yml] Disable no-tls1_3 tests

This commit temporarily disables tests for no-tls1_3,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable memory sanitizer build

In 1.1.1 currently we do not support running multiple tests in parallel,
and the `--debug -O1` msan build required more than 3h to run the tests.

This commit temporarily disables this build configuration.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-merge.yml] Disable ubsan build

This commit temporarily disables the ubsan build,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Add comment about our approach to GitHub Actions CI

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* Revert "[github-ci][cross-compiles.yml] Disable sparcv9"

This reverts commit aa23aa759cf33b4f481fc719d42cb7bae8b2eaf0.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* sparc: fix cross compile build

(cherry picked from commit 64fac96de81d3dc19cc0c9045c341f0dec818075)

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* Fix i2v_GENERAL_NAME to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix POLICYINFO printing to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix printing of PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the name constraints code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix test code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix append_ia5 function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix EC_GROUP_new_from_ecparameters to check the base length

Check that there's at least one byte in params->base before trying to
read it.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Allow fuzz builds to detect string overruns

If FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined then we don't NUL
terminate ASN1_STRING datatypes. This shouldn't be necessary but we add it
any for safety in normal builds.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the error handling in i2v_AUTHORITY_KEYID

Previously if an error path is entered a leak could result.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Correctly calculate the length of SM2 plaintext given the ciphertext

Previously the length of the SM2 plaintext could be incorrectly calculated.
The plaintext length was calculated by taking the ciphertext length and
taking off an "overhead" value.

The overhead value was assumed to have a "fixed" element of 10 bytes.
This is incorrect since in some circumstances it can be more than 10 bytes.
Additionally the overhead included the length of two integers C1x and C1y,
which were assumed to be the same length as the field size (32 bytes for
the SM2 curve). However in some cases these integers can have an additional
padding byte when the msb is set, to disambiguate them from negative
integers. Additionally the integers can also be less than 32 bytes in
length in some cases.

If the calculated overhead is incorrect and larger than the actual value
this can result in the calculated plaintext length being too small.
Applications are likely to allocate buffer sizes based on this and therefore
a buffer overrun can occur.

CVE-2021-3711

Issue reported by John Ouyang.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Extend tests for SM2 decryption

Check the case where C1y < 32 bytes in length (i.e. short overhead), and
also the case with longer plaintext and C1x and C1y > 32 bytes in length
(i.e. long overhead)

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Check the plaintext buffer is large enough when decrypting SM2

Previously there was no check that the supplied buffer was large enough.
It was just assumed to be sufficient. Instead we should check and fail if
not.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Updates to CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <[email protected]>

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>

* Run make update

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1l release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1m-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the array size of dtlsseq in tls1_enc

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16385)

(cherry picked from commit 562d4cd3c35b32f2bc6ac0770b80ce394f8d76a4)

* Avoid using undefined value in generate_stateless_cookie_callback

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16381)

* Fix some strict gcc-12 warnings

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16375)

* apps/ciphers: Fix wrong return value when using -convert parameter

Command 'openssl ciphers -convert <name>' always returns failure,
this patch set the correct return value.

Signed-off-by: Tianjia Zhang <[email protected]>

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16383)

(cherry picked from commit 8b4e9c5265ffd3457ad37133502a9d8a4e8daccd)

* Check for null-pointer dereference in dh_cms_set_peerkey

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16382)

* ts: fix memleaks caused by TS_VERIFY_CTX_set_imprint

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16347)

(cherry picked from commit 62bae84d4587ec9a56d0ce830e36e4a5b2fa8a33)

* Darwin platform allows to build on releases before Yosemite/ios 8.

issue #16407 #16408

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16409)

* cms: fix memleaks in cms_env.c

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16403)

* Fix instances of pointer addition with the NULL pointer

ubsan found undefined pointer addtions in
crypto/bio/bss_mem.c (mem_ctrl),
crypto/pem/pem_lib.c (PEM_read_bio_ex),
test/testutil/format_output.c (test_fail_string_common,
test_fail_memory_common).

Mostly a straight back-port-of: a07dc81

Additionally enable the ubsan run-checker, to prevent regressions.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16423)

* Fix enable-asan with C++ buildtest

the following config:

./config no-shared enable-asan enable-buildtest-c++ enable-external-tests

fails to build with unresolved asan symbols when linking
test/ossl_shim/ossl_shim

Fixed by passing all sanitizer-flags to cxxflags.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16434)

* Fix the "Out of memory" EVP KDF scrypt test

This test did not really execute, since usually
the OPENSSL_malloc(0) will fail and prevent the
execution of the KDF.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16446)

* Ensure that _GNU_SOURCE is defined for bss_dgram.c

This fixes the following error with gcc10 under strict ANSI conditions:

.../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32'

CLA: trivial
Fixes #16449

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16451)

(cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f)

* Fix no-tls1_3 tests

This recently added test needs DH2048 to work without tls1_3.

Fixes: #16335

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16453)

* Add tests for i2d_TYPE_fp and d2i_TYPE_fp

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

@@ Note: This commit limits to ECPKParameters as a type.

(cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

This commit fixes the public headers to reflect these changes.

Fixes #12443

(cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to https://github.com/openssl/openssl/pull/12312

(cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Use applink to fix windows tests

(cherry picked from commit <https://github.com/bernd-edlinger/openssl/commit/96a463cede0070aa5c86629d683a214657a9ba9e>)

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* Openssl fails to compile on Debian with kfreebsd kernels
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler
is:

../crypto/uid.c: In function 'OPENSSL_issetugid':
../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function)
   50 |     return getauxval(AT_SECURE) != 0;
      |                      ^~~~~~~~~

This commit changes the code to use the freebsd code in this case.
This fixes the compilation.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16477)

(cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)

* doc: document the rsa_oaep_md: pkeyopt

This was missing but essential for using non-SHA1 digests with OAEP.

Fixes #15998

Manual backport of #16410

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16488)

* Prioritise DANE TLSA issuer certs over peer certs

When building the certificate chain, prioritise any Cert(0) Full(0)
certificates from TLSA records over certificates received from the peer.

This is important when the server sends a cross cert, but TLSA records include
the underlying root CA cert.  We want to construct a chain with the issuer from
the TLSA record, which can then match the TLSA records (while the associated
cross cert may not).

Reviewed-by: Tomáš Mráz <[email protected]>

* Test for DANE cross cert fix

Reviewed-by: Tomáš Mráz <[email protected]>

* test/ec_internal_test: link with libapps.a too

Whenever the source from $target{apps_init_src} is added to the source
of a test program, it needs to be linked with libapps.a as well.  Some
init sources depend on that.

Without this, builds break on VMS because of the unresolved symbol
'app_malloc'.

On platforms that do not need anything from libapps.a, adding it is a
no-op.

This is for OpenSSL 1.1.1 only.  OpenSSL 3.0 and beyond have a
different solution.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16512)

* VMS: Compensate for compiler type incompatibility

The compiler says that 'unsigned long long' isn't the same as
'unsigned __int64'.  Sure, and considering that crypto/rand/rand_vms.c
is specific VMS only code, it's easy to just change the type to the
exact same as what's specified in the system headers.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15613)

* DOCS: Update the page for 'openssl passwd' to not duplicate some info

The options -1 and -apr1 were mentioned in DESCRIPTION, not mentioning
any other options or even mentioning that there are more algorithms.
The simple fix is to remove that sentence and let the OPTIONS section
speak for itself.

Fixes #16529

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16531)

(cherry picked from commit 116799ff6a8fc803ec4685fc432c7329d0511e23)

* VMS: Fix misspelt type

'__int64', not 'int64_t'

Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16557)

* Fix nc_email to check ASN1 strings with NULL byte in the middle

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16524)

(cherry picked from commit 485d0790ac1a29a0d4e7391d804810d485890376)

* MacOS prior to 10.12 does not support random API correctly

Fixes #16517

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16587)

* Clarify what SSL_get_session() does on the server side in TLSv1.3

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)

* Correct the documentation for SSL_set_num_tickets()

The behaviour for what happens in a resumption connection was not quite
described correctly.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)

* ssl: Correct filename in README

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16671)

* Add sm2 encryption test case from GM/T 0003.5-2012

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16511)

(cherry picked from commit 8ba65c35ea3af347c3b2adc8e665066b541a1c35)

* doc/man3/SSL_set_fd.pod: add note about Windows compiler warning

According to an old stackoverflow thread [1], citing an even older comment by
Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05),
a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although
the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2),
in practice the socket() implementation on Windows returns an index into the kernel
handle table, the size of which is limited to 2^24 [3].

Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow.

[1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64
[2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2
[3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16699)

(cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)

* Fix a NPD bug in engines/e_dasync.c

The dasync_aes_128_cbc_hmac_sha1 cipher depends on
EVP_aes_128_cbc_hmac_sha1() returning a NON-NULL value.
We should simply not advertise this cipher otherwise.

Fixes: #7950

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16722)

* Fix a memory leak in the afalg engine

Fixes: #16743

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16744)

(cherry picked from commit 6f6a5e0c7c41b6b3639e51f435cd98bb3ae061bc)

* Fix some possible memory leaks in EVP_CipherInit_ex

An EVP_CONTEXT with zero cipher but non-zero engine,
and/or cipher_data is possible if an error happens
in EVP_CTRL_INIT or in EVP_CTRL_COPY, the error handling
will just clear the cipher in that case.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16756)

* Fix double-free in e_dasync.c

When the cipher is copied, the inner_cihper_data
need to be copied as well, using the EVP_CTRL_COPY method.
The EVP_CIPH_CUSTOM_COPY bit needs to be set as well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16751)

* Bindhost/bindport should be freed

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16775)

(cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)

* New extensions can be sent in a certificate request

Normally we expect a client to send new  extensions in the ClientHello,
which may be echoed back by the server in subsequent messages. However the
server can also send a new extension in the certificate request message to
be echoed back in a certificate message

Fixes #16632

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)

* Extend custom extension testing

Test the scenario where we add a custom extension to a cetificate
request and expect a response in the client's certificate message.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit 0db3a9904fa00569905be130854a31dab7b8f49d)

* Fix test/recipes/01-test_symbol_presence.t to allow for stripped libraries

It's a small change to the 'nm' call, to have it look at dynamic symbols
rather than the normal ones.

Fixes #16810

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16822)

(cherry picked from commit a85b4de6a6cbe03c46219d4b1c3b2828ca3fd51c)

* Fix test/recipes/01-test_symbol_presence.t to disregard version info

The output of 'nm -DPg' contains version info attached to the symbols,
which makes the test fail.  Simply dropping the version info makes the
test work again.

Fixes #16810 (followup)

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16840)

(cherry picked from commit 73970cb91fdf8e7b4b434d479b875a47a0aa0dbc)

* test/ssl_old_test.c: Fix potential leak

Reviewed-by: Kurt Roeckx <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16806)

(cherry picked from commit 34563be5368fb8e6ade7d06d8376522ba83cd6ac)

* Ensure pkey_set_type handles ENGINE references correctly

pkey_set_type should not consume the ENGINE references that may be
passed to it.

Fixes #16757

Reviewed-by: Tomas Mraz <tomas@openssl.…

* Add riscv64 target

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/14724)

* apple getentropy removal

backport of #15924

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15935)

* Fix use of uninitialized memory in test_rsa_oaep

48f1739600f33c92387debce2002acec6e365f1d did not convert the RSA OAEP
tests correctly. The corrupted ciphertext and truncation tests were
really decrypting uninitialized memory, rather than the sample
ciphertext. This results in an error in tools like MSan.

The test is somewhat roundabout. In the original version, before the
conversion, ctext_ex was an OAEP test vector from key1(), etc.,
functions. The test would:

1. Encrypt ptext_ex as ctext.
2. Decrypt ctext and check it gives ptext_ex.
3. Decrypt ctext_ex and check it gives ptext_ex.
4. Try corrupted and truncated versions of ctext.

48f1739600f33c92387debce2002acec6e365f1d then moved steps 1 and 2 into
test_rsa_simple, which meant ctext is no longer available for step 4. It
then mistakenly left the variable around, but uninitialized, so the test
wasn't testing anything. (Confusingly, test_rsa_simple outputs ctext_ex
to the caller, but doesn't do anything with it. The ctext_ex output is
also only usable for OAEP, not PKCS#1 v1.5.)

It doesn't really matter whether we use ctext or ctext_ex for step 4, so
this PR fixes it by using ctext_ex instead.

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15950)

(cherry picked from commit 36a4637e158508f5d2fb7750e4870888072a56f9)

* doc: Mention the update of der data pointers in d2i/i2d

Fixes #15958

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15973)

* bn: procduce correct sign for result of BN_mod()

There is a problem that appears when calling BN_div(a, c, a, b) with negative b.
In this case, the sign of the remainder c is incorrect.  The problem only
occurs if the dividend and the quotient are the same BIGNUM.

Fixes #15982

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15991)

(cherry picked from commit 105c83150f15af3f78ea0758859062842bdbe30e)

* Fix memory leak in i2d_ASN1_bio_stream

When creating a signed S/MIME message using SMIME_write_CMS()
if the reading from the bio fails, the state is therefore
still ASN1_STATE_START when BIO_flush() is called by i2d_ASN1_bio_stream().
This results in calling asn1_bio_flush_ex cleanup but will only
reset retry flags as the state is not ASN1_STATE_POST_COPY.
Therefore 48 bytes (Linux x86_64) leaked since the
ndef_prefix_free / ndef_suffix_free callbacks are not executed
and the ndef_aux structure is not freed.

By always calling free function callback in asn1_bio_free() the
memory leak is fixed.

(cherry picked from commit 3a1d2b59522163ebb83bb68e13c896188dc222c6)

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15999)

* ssl: do not choose auto DH groups that are weaker than the security level

manual merge from https://github.com/openssl/openssl/pull/15818
id d7b5c648d682b499b71320a03747602a6ba4dec3

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15832)

* test: add test for auto DH security level meets the minimum

Manual merge from https://github.com/openssl/openssl/pull/15818
Commit id d0e5230dcecc6013d351545ceb275aa2ba5baa80

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15832)

* Fix s_server PSK handling

Issue #15951 describes a scenario which causes s_server to fail when using
a PSK. In the originally described issue this only impacted master and not
1.1.1. However, in fact this issue does also impact 1.1.1 - but only if you
additionally supply the option "-no_ticket" to the s_server command line.

The difference between the behaviour in master and 1.1.1 is due to 9c13b49,
which changed PSK_MAX_IDENTITY_LEN from 128 to 256. It just so happens that
a default OpenSSL TLSv1.3 ticket length happens to fall between those 2
values. Tickets are presented in TLSv1.3 as a PSK "identity". Passing
"no_ticket" doesn't actually stop TLSv1.3 tickets completely, it just
forces the use of "session ids as a ticket" instead. This significantly
reduces the ticket size to below 128 in 1.1.1.

The problem was due to s_server setting a TLSv1.2 PSK callback and a
TLSv1.3 PSK callback. For backwards compat reasons the TLSv1.2 PSK
callbacks also work in TLSv1.3 but are not preferred. In the described
scenario we use a PSK to create the initial connection. Subsequent to that
we attempt a resumption using a TLSv1.3 ticket (psk). If the psk length is
below PSK_MAX_IDENTITY_LEN then we first call the TLSv1.2 PSK callback.
Subsequently we call the TLSv1.3 PSK callback. Unfortunately s_server's
TLSv1.2 PSK callback accepts the identity regardless, even though it is an
unexpected value, and hence the binder subsequently fails to verify.

The fix is to bail early in the TLSv1.2 callback if we detect we are being
called from a TLSv1.3 connection.

Fixes #15951

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16008)

(cherry picked from commit 0007ff257c95f5cd046799e492436f41caf4ecb2)

* TEST: Check that i2d refuses to encode non-optional items with no content

The test case creates an RSA public key and tries to pass it through
i2d_PrivateKey().  This SHOULD fail, since the private bits are missing.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* ASN.1: Refuse to encode to DER if non-optional items are missing

Fixes #16026

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Fix test/asn1_encode_test.c to not use ASN1_FBOOLEAN

ASN1_FBOOLEAN is designed to use as a default for optional ASN1 items.
This test program used it for non-optional items, which doesn't encode
well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Fix test/asn1_encode_test.c to handle encoding/decoding failure

Make it only report (and fail on) encoding/decoding failures when success
is expected.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* make update (adds a new function code)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Avoid "excessive message size" for session tickets

We received a report of an "excessive message size" for a received
session ticket. Our maximum size was significantly less than the theoretical
maximum. The server may put any data it likes in the session ticket
including (for example) the full certificate chain so we should be able to
handle longer tickets. Update the value to the maximum allowed by the spec.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15877)

(cherry picked from commit e54f0c9b2fe3dd2dcb5e8100e2c69e5b2f6eb681)

* BIO_lookup_ex: use AI_ADDRCONFIG only if explicit host name is given

The flag only affects which record types are queried via DNS (A or
AAAA, or both).  When node is NULL and AF_UNSPEC is used, it prevents
getaddrinfo returning the right address associated with the loopback
interface.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16039)

* Avoid empty lines in nmake rule bodies

nmake is tolerant of those empty lines, but jom isn't.  That tolerance
isn't standard make behaviour, so we lean towards avoiding them.

We simply use '@rem' instead.

Fixes #16014

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16047)

* apps: Use the first detected address family if IPv6 is not available

This is a follow up of 15729bef385211bc2a0497e2d53a45c45d677d2c.  Even
when the host does not support IPv6 at all, BIO_lookup_ex may now
return IN6ADDR_ANY in addition to INADDR_ANY, as the second element of
the ai_next field.

After eee8a40aa5e06841eed6fa8eb4f6109238d59aea, the do_server function
prefers the IPv6 address and fails on the BIO_socket call.  This adds
a fallback code to retry with the IPv4 address returned as the first
element to avoid the error.

The failure had been partially avoided in the previous code with
AI_ADDRCONFIG, because getaddrinfo returns only IPv4 address if no
IPv6 address is associated with external interface.  However, it would
be still a problem if the external interface has an IPv6 address
assigned, while the loopback interface doesn't.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16078)

* Don't reset the packet pointer in ssl3_setup_read_buffer

Sometimes this function gets called when the buffers have already been
set up. If there is already a partial packet in the read buffer then the
packet pointer will be set to an incorrect value. The packet pointer already
gets reset to the correct value when we first read a packet anyway, so we
don't also need to do it in ssl3_setup_read_buffer.

Fixes #13729

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Disallow SSL_key_update() if there are writes pending

If an application is halfway through writing application data it should
not be allowed to attempt an SSL_key_update() operation. Instead the
SSL_write() operation should be completed.

Fixes #12485

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Fix some minor record layer issues

Various comments referred to s->packet and s->packet_length instead of
s->rlayer.packet and s->rlayer.packet_length. Also fixed is a spot where
RECORD_LAYER_write_pending() should have been used. Based on the review
comments in #16077.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>

(cherry picked from commit ca001524971ccd595bc0e9843611e6784adfc981)

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16105)

* Fix a read buffer overrun in X509_aux_print().

The ASN1_STRING_get0_data(3) manual explitely cautions the reader
that the data is not necessarily NUL-terminated, and the function
X509_alias_set1(3) does not sanitize the data passed into it in any
way either, so we must assume the return value from X509_alias_get0(3)
is merely a byte array and not necessarily a string in the sense
of the C language.

I found this bug while writing manual pages for X509_print_ex(3)
and related functions.  Theo Buehler <[email protected]> checked my
patch to fix the same bug in LibreSSL, see

http://cvsweb.openbsd.org/src/lib/libcrypto/asn1/t_x509a.c#rev1.9

As an aside, note that the function still produces incomplete and
misleading results when the data contains a NUL byte in the middle
and that error handling is consistently absent throughout, even
though the function provides an "int" return value obviously intended
to be 1 for success and 0 for failure, and even though this function
is called by another function that also wants to return 1 for success
and 0 for failure and even does so in many of its code paths, though
not in others.  But let's stay focussed.  Many things would be nice
to have in the wide wild world, but a buffer overflow must not be
allowed to remain in our backyard.

CLA: trivial

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16108)

(cherry picked from commit c5dc9ab965f2a69bca964c709e648158f3e4cd67)

* DSA/RSA_print(): Fix potential memory leak

Fixes #10777

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16130)

(cherry picked from commit 40184c96103a388209939c1c19920971c05bb78c)

* [doc/man3] documentation: BN_cmp manpage updates

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16214)

(cherry picked from commit 3d4ca443b4778e3230ff23f17625f58f815a9142)

* Revert "make update (adds a new function code)"

This reverts commit ea26844c4f624ef515d9228d3b623761a369b049.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to handle encoding/decoding failure"

This reverts commit f1d97905bbd8679b7647c992b97f526791069040.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to not use ASN1_FBOOLEAN"

This reverts commit 5434acb6c4d56507d761b28f7e142ccab808a8fa.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "ASN.1: Refuse to encode to DER if non-optional items are missing"

This reverts commit 006906cddda37e24a66443199444ef4476697477.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "TEST: Check that i2d refuses to encode non-optional items with no content"

This reverts commit 12e9b74c513a8ed3c1c260cf25221a465ae14b84.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Fix potential double-free

The `sk` variable is assigned to `s->session->peer_chain`.
If `ssl3_digest_cached_records()` were to fail, then `sk` would still be
non-NULL, and subsequently freed on the error return. When the session
is freed, it will then attempt to free `s->session->peer_chain`,
resulting in a double-free (of `sk`).

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16309)

(cherry picked from commit 0449702abc95a3af24c049cb02c01ca6a8015cef)

* s390x: AES OFB/CFB: Maintain running IV from cipher context

Copy the current IV from the cipher context into the kmo/kmf param before
the operation, and copy the modified IV back to the context afterwards.
Without this, an application that obtains the running IV from the context
would still get the original IV, but not the updated one.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* Test EVP Cipher updating the context's IV

Ensure that an EVP_CipherUpdate operation updates the context's
IV for AES CBC, CFB, OFB, and CTR. An application can get the
updated IV via EVP_CIPHER_CTX_iv().

The s390x implementation of the CFB and OFB ciphers did not
update the IV in the context, but only within its s390x specific
context data.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* pkcs12: check for zero length digest to avoid division by zero

Fixes #16331

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Kurt Roeckx <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16333)

* [github-ci] Sync ci.yml workflow with master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import windows.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import cross-compiles.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker workflows from master

This commit does not include the daily run-checker workflow.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker daily workflow from master

The daily run-checker is scheduled to start at 6:42, instead of the
start of the hour.

The official GitHub documentation remarks the following regarding
scheduled workflows:

> Note: The schedule event can be delayed during periods of high loads
> of GitHub Actions workflow runs. High load times include the start of
> every hour. To decrease the chance of delay, schedule your workflow to
> run at a different time of the hour.

42, obviously, has been picked because it is the answer to the ultimate
question of life, the universe, and everything.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][cross-compiles.yml] Disable sparcv9

This commit temporarily disables cross-compiling tests for sparcv9, due
to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable krb5 external tests

This commit temporarily disables krb5 external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable pyca external tests

This commit temporarily disables pyca external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-ci.yml] Disable no-tls1_3 tests

This commit temporarily disables tests for no-tls1_3,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable memory sanitizer build

In 1.1.1 currently we do not support running multiple tests in parallel,
and the `--debug -O1` msan build required more than 3h to run the tests.

This commit temporarily disables this build configuration.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-merge.yml] Disable ubsan build

This commit temporarily disables the ubsan build,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Add comment about our approach to GitHub Actions CI

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* Revert "[github-ci][cross-compiles.yml] Disable sparcv9"

This reverts commit aa23aa759cf33b4f481fc719d42cb7bae8b2eaf0.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* sparc: fix cross compile build

(cherry picked from commit 64fac96de81d3dc19cc0c9045c341f0dec818075)

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* Fix i2v_GENERAL_NAME to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix POLICYINFO printing to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix printing of PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the name constraints code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix test code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix append_ia5 function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix EC_GROUP_new_from_ecparameters to check the base length

Check that there's at least one byte in params->base before trying to
read it.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Allow fuzz builds to detect string overruns

If FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined then we don't NUL
terminate ASN1_STRING datatypes. This shouldn't be necessary but we add it
any for safety in normal builds.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the error handling in i2v_AUTHORITY_KEYID

Previously if an error path is entered a leak could result.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Correctly calculate the length of SM2 plaintext given the ciphertext

Previously the length of the SM2 plaintext could be incorrectly calculated.
The plaintext length was calculated by taking the ciphertext length and
taking off an "overhead" value.

The overhead value was assumed to have a "fixed" element of 10 bytes.
This is incorrect since in some circumstances it can be more than 10 bytes.
Additionally the overhead included the length of two integers C1x and C1y,
which were assumed to be the same length as the field size (32 bytes for
the SM2 curve). However in some cases these integers can have an additional
padding byte when the msb is set, to disambiguate them from negative
integers. Additionally the integers can also be less than 32 bytes in
length in some cases.

If the calculated overhead is incorrect and larger than the actual value
this can result in the calculated plaintext length being too small.
Applications are likely to allocate buffer sizes based on this and therefore
a buffer overrun can occur.

CVE-2021-3711

Issue reported by John Ouyang.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Extend tests for SM2 decryption

Check the case where C1y < 32 bytes in length (i.e. short overhead), and
also the case with longer plaintext and C1x and C1y > 32 bytes in length
(i.e. long overhead)

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Check the plaintext buffer is large enough when decrypting SM2

Previously there was no check that the supplied buffer was large enough.
It was just assumed to be sufficient. Instead we should check and fail if
not.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Updates to CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <[email protected]>

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>

* Run make update

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1l release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1m-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the array size of dtlsseq in tls1_enc

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16385)

(cherry picked from commit 562d4cd3c35b32f2bc6ac0770b80ce394f8d76a4)

* Avoid using undefined value in generate_stateless_cookie_callback

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16381)

* Fix some strict gcc-12 warnings

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16375)

* apps/ciphers: Fix wrong return value when using -convert parameter

Command 'openssl ciphers -convert <name>' always returns failure,
this patch set the correct return value.

Signed-off-by: Tianjia Zhang <[email protected]>

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16383)

(cherry picked from commit 8b4e9c5265ffd3457ad37133502a9d8a4e8daccd)

* Check for null-pointer dereference in dh_cms_set_peerkey

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16382)

* ts: fix memleaks caused by TS_VERIFY_CTX_set_imprint

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16347)

(cherry picked from commit 62bae84d4587ec9a56d0ce830e36e4a5b2fa8a33)

* Darwin platform allows to build on releases before Yosemite/ios 8.

issue #16407 #16408

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16409)

* cms: fix memleaks in cms_env.c

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16403)

* Fix instances of pointer addition with the NULL pointer

ubsan found undefined pointer addtions in
crypto/bio/bss_mem.c (mem_ctrl),
crypto/pem/pem_lib.c (PEM_read_bio_ex),
test/testutil/format_output.c (test_fail_string_common,
test_fail_memory_common).

Mostly a straight back-port-of: a07dc81

Additionally enable the ubsan run-checker, to prevent regressions.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16423)

* Fix enable-asan with C++ buildtest

the following config:

./config no-shared enable-asan enable-buildtest-c++ enable-external-tests

fails to build with unresolved asan symbols when linking
test/ossl_shim/ossl_shim

Fixed by passing all sanitizer-flags to cxxflags.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16434)

* Fix the "Out of memory" EVP KDF scrypt test

This test did not really execute, since usually
the OPENSSL_malloc(0) will fail and prevent the
execution of the KDF.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16446)

* Ensure that _GNU_SOURCE is defined for bss_dgram.c

This fixes the following error with gcc10 under strict ANSI conditions:

.../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32'

CLA: trivial
Fixes #16449

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16451)

(cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f)

* Fix no-tls1_3 tests

This recently added test needs DH2048 to work without tls1_3.

Fixes: #16335

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16453)

* Add tests for i2d_TYPE_fp and d2i_TYPE_fp

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

@@ Note: This commit limits to ECPKParameters as a type.

(cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

This commit fixes the public headers to reflect these changes.

Fixes #12443

(cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to https://github.com/openssl/openssl/pull/12312

(cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Use applink to fix windows tests

(cherry picked from commit <https://github.com/bernd-edlinger/openssl/commit/96a463cede0070aa5c86629d683a214657a9ba9e>)

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* Openssl fails to compile on Debian with kfreebsd kernels
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler
is:

../crypto/uid.c: In function 'OPENSSL_issetugid':
../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function)
   50 |     return getauxval(AT_SECURE) != 0;
      |                      ^~~~~~~~~

This commit changes the code to use the freebsd code in this case.
This fixes the compilation.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16477)

(cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)

* doc: document the rsa_oaep_md: pkeyopt

This was missing but essential for using non-SHA1 digests with OAEP.

Fixes #15998

Manual backport of #16410

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16488)

* Prioritise DANE TLSA issuer certs over peer certs

When building the certificate chain, prioritise any Cert(0) Full(0)
certificates from TLSA records over certificates received from the peer.

This is important when the server sends a cross cert, but TLSA records include
the underlying root CA cert.  We want to construct a chain with the issuer from
the TLSA record, which can then match the TLSA records (while the associated
cross cert may not).

Reviewed-by: Tomáš Mráz <[email protected]>

* Test for DANE cross cert fix

Reviewed-by: Tomáš Mráz <[email protected]>

* test/ec_internal_test: link with libapps.a too

Whenever the source from $target{apps_init_src} is added to the source
of a test program, it needs to be linked with libapps.a as well.  Some
init sources depend on that.

Without this, builds break on VMS because of the unresolved symbol
'app_malloc'.

On platforms that do not need anything from libapps.a, adding it is a
no-op.

This is for OpenSSL 1.1.1 only.  OpenSSL 3.0 and beyond have a
different solution.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16512)

* VMS: Compensate for compiler type incompatibility

The compiler says that 'unsigned long long' isn't the same as
'unsigned __int64'.  Sure, and considering that crypto/rand/rand_vms.c
is specific VMS only code, it's easy to just change the type to the
exact same as what's specified in the system headers.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15613)

* DOCS: Update the page for 'openssl passwd' to not duplicate some info

The options -1 and -apr1 were mentioned in DESCRIPTION, not mentioning
any other options or even mentioning that there are more algorithms.
The simple fix is to remove that sentence and let the OPTIONS section
speak for itself.

Fixes #16529

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16531)

(cherry picked from commit 116799ff6a8fc803ec4685fc432c7329d0511e23)

* VMS: Fix misspelt type

'__int64', not 'int64_t'

Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16557)

* Fix nc_email to check ASN1 strings with NULL byte in the middle

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16524)

(cherry picked from commit 485d0790ac1a29a0d4e7391d804810d485890376)

* MacOS prior to 10.12 does not support random API correctly

Fixes #16517

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16587)

* Clarify what SSL_get_session() does on the server side in TLSv1.3

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)

* Correct the documentation for SSL_set_num_tickets()

The behaviour for what happens in a resumption connection was not quite
described correctly.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)

* ssl: Correct filename in README

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16671)

* Add sm2 encryption test case from GM/T 0003.5-2012

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16511)

(cherry picked from commit 8ba65c35ea3af347c3b2adc8e665066b541a1c35)

* doc/man3/SSL_set_fd.pod: add note about Windows compiler warning

According to an old stackoverflow thread [1], citing an even older comment by
Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05),
a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although
the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2),
in practice the socket() implementation on Windows returns an index into the kernel
handle table, the size of which is limited to 2^24 [3].

Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow.

[1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64
[2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2
[3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16699)

(cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)

* Fix a NPD bug in engines/e_dasync.c

The dasync_aes_128_cbc_hmac_sha1 cipher depends on
EVP_aes_128_cbc_hmac_sha1() returning a NON-NULL value.
We should simply not advertise this cipher otherwise.

Fixes: #7950

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16722)

* Fix a memory leak in the afalg engine

Fixes: #16743

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16744)

(cherry picked from commit 6f6a5e0c7c41b6b3639e51f435cd98bb3ae061bc)

* Fix some possible memory leaks in EVP_CipherInit_ex

An EVP_CONTEXT with zero cipher but non-zero engine,
and/or cipher_data is possible if an error happens
in EVP_CTRL_INIT or in EVP_CTRL_COPY, the error handling
will just clear the cipher in that case.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16756)

* Fix double-free in e_dasync.c

When the cipher is copied, the inner_cihper_data
need to be copied as well, using the EVP_CTRL_COPY method.
The EVP_CIPH_CUSTOM_COPY bit needs to be set as well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16751)

* Bindhost/bindport should be freed

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16775)

(cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)

* New extensions can be sent in a certificate request

Normally we expect a client to send new  extensions in the ClientHello,
which may be echoed back by the server in subsequent messages. However the
server can also send a new extension in the certificate request message to
be echoed back in a certificate message

Fixes #16632

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)

* Extend custom extension testing

Test the scenario where we add a custom extension to a cetificate
request and expect a response in the client's certificate message.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit 0db3a9904fa00569905be130854a31dab7b8f49d)

* Fix test/recipes/01-test_symbol_presence.t to allow for stripped libraries

It's a small change to the 'nm' call, to have it look at dynamic symbols
rather than the normal ones.

Fixes #16810

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16822)

(cherry picked from commit a85b4de6a6cbe03c46219d4b1c3b2828ca3fd51c)

* Fix test/recipes/01-test_symbol_presence.t to disregard version info

The output of 'nm -DPg' contains version info attached to the symbols,
which makes the test fail.  Simply dropping the version info makes the
test work again.

Fixes #16810 (followup)

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16840)

(cherry picked from commit 73970cb91fdf8e7b4b434d479b875a47a0aa0dbc)

* test/ssl_old_test.c: Fix potential leak

Reviewed-by: Kurt Roeckx <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16806)

(cherry picked from commit 34563be5368fb8e6ade7d06d8376522ba83cd6ac)

* Ensure pkey_set_type handles ENGINE references correctly

pkey_set_type should not consume the ENGINE references that may be
passed to it.

Fixes #16757

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Add tests for ENGINE problems

Add some tests which would have caught the issues fixed in the previous
commit related to engine handling.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Fix some documentation errors related to return values

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16794)

(cherry picked from commit f1d077f1108b1bc2334350a4d53a46e29e082910)

* Fix BIO_get_md_ctx return value check

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16792)

* Fix the s_server psk_server_cb for use in DTLS

Commit 0007ff257c added a protocol version check to psk_server_cb but
failed to take account of DTLS causing DTLS based psk connections to
fail.

Fixes #16707

Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16838)

(cherry picked from commit 8b09a9c76d873f62c2507fa9628a9c96c1d66d5c)

* Fix no-cmac

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16894)

(cherry picked from commit ef2fb64f9dfde1965cb0b8a5f8765c4f467c1604)

* Fix a gcc 11.2.0 warning

gcc 11.2.0 is the default on Ubuntu 21.10. It emits a (spurious) warning
when compiling test/packettest.c, which causes --strict-warnings builds
to fail. A simple fix avoids the warning.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16887)

(cherry picked from commit 37467b2752f75ce80437120f704452982b7c1998)

* speed: range check the argument given to -multi for 1.1.1

Fixes #16899 for 1.1.1 branch.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16922)

* check the return value of BN_new() and BN_dup()

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16948)

(cherry picked from commit d99004fe5de934120765d342586f08d22131b8ed)

* Fix a memory leak in tls_parse_stoc_key_share

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16957)

* Fix a memory leak in ssl_create_cipher_list

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16955)

* Fix: invoking x509_name_cannon improperly

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16974)

(cherry picked from commit 09235289c377ff998964bb6b074bb2a3ad768fd2)

* Reset the rwstate before calling ASYNC_start_job()

If an async job pauses while processing a TLS connection then the
rwstate gets set to SSL_ASYNC_PAUSED. When resuming the job we should
reset the rwstate back to SSL_NOTHING. In fact we can do this
unconditionally since if we're about to call ASYNC_start_job() then either
we are about to start the async job for the first time (in which case the
rwstate should already by SSL_NOTHING), or we are restarting it after a
pause (in which case reseting it to SSL_NOTHING is the correct action).

Fixes #16809

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17013)

(cherry picked from commit 07f620e3acf0dd76a3a03ada9911c544aa483aa7)

* free the Post-Handshake Auth digest when there is an error saving the digest

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16924)

* evp: fix EVP_PKEY_get0_EC_KEY when EC_KEY is SM2

EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2) will change pkey->type to EVP_PKEY_SM2

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17015)

* Avoid loading of a dynamic engine twice

Use the address of the bind function as a DYNAMIC_ID,
since the true name of the engine is not known
before the bind function returns,
but invoking the bind function before the engine
is unloaded results in memory corruption.

Fixes #17023

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17073)

(cherry picked from commit e2571e02d2b0cd83ed1c79d384fe941f27e603c0)

* ERR: Add a missing common reason string

There was no string present for ERR_R_PASSED_INVALID_ARGUMENT

Reviewed-by: David von Oheimb <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17069)

* Add a test case for duplicate engine loading

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17083)

* DOC: Add a few previously documented functions

d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp()
were documented in OpenSSL 1.0.2.  In a grand unification of the
documentation of (almost) all d2i and i2d functions, these were
dropped, most likely by mistake.

This simply adds them back.

Fixes #17091

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17093)

* Fix detection of ARMv7 and ARM64 CPU features on FreeBSD

OpenSSL assumes AT_HWCAP = 16 (as on Linux), but on FreeBSD AT_HWCAP = 25
Switch to using AT_HWCAP, and setting it to 16 if it is not defined.

OpenSSL calls elf_auxv_info() with AT_CANARY which returns ENOENT
resulting in all ARM acceleration features being disabled.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17082)

(cherry picked from commit c1dabe26e3e96cdce0ffc929e9677840ad089ba5)

* Clarify and correct the EVP_CTRL_AEAD_SET_TAG docs

The restriction about setting a tag length prior to setting the IV only
applies to OCB mode. We clarify when in the process EVP_CTRL_AEAD_SET_TAG
can be called.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17111)

(cherry picked from commit 3607b8ad8ee1980a079e985333a196e0c79f8f00)

* doc: fix macro name

OSSL_STORE_INFO_X509 doesn't exist.  It should be OSSL_STORE_INFO_CERT.

Fixes #17121

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17125)

(cherry picked from commit 01fde90eec721b64bc0e1c01cd94a9fd431adcc6)

* BIO_push.pod: fix confusing text and add details on corner cases

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17086)

(cherry picked from commit 7a37fd09a8f3607ed8acf55e03479861595be069)

* Fix speed, use OPENSSL_free instead of free

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17132)

* TEST: Enable and fix test_bn2padded() in test/bntest.c

This looks like old code, written when the padded variety of BN_bn2bin()
was developped, and disabled by default...  and forgotten.

A few simple changes to update it to the current API is all that was
needed to enable it.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17133)

(cherry picked from commit 23750f677ef61b6bea4e81f23f335ad08fc49b51)

* No EtM for GOST ciphers

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17158)

* Fix ssl_free() and thus BIO_free() to respect BIO_NOCLOSE

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* BIO_f_ssl.pod: Make clear where an SSL BIOs are expected as an argument

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* Fix documentation for tlsext_ticket_key

The tlsext_ticket_key functions are documented as returning 0 on success.
In fact they return 1 on success.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17210)

(cherry picked from commit b0be101326f369f0dd547556d2f3eb3ef5ed0e33)

* OBJ_nid2obj.pod: Replace remaining 'B<' by 'I<' were appropriate

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17221)

* Fix a deadlock in OBJ_NAME_add

This happened after an out of memory error:
CRYPTO_THREAD_write_lock may hang in OBJ_NAME_add.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17236)

* CI: Replace windows-2016 with windows-2022

Windows 2016 environment is going to be discontinued.

We also replace windows-latest with windows-2019 so
there aren't two identical builds done once windows-latest
is switched to mean windows-2022.

Fixes #17177

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17211)

* Fix faulty detail in BN_rand() manual

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17131)

* Fix a carry overflow bug in bn_sqr_comba4/8 for mips 32-bit targets

bn_sqr_comba8 does for instance compute a wrong result for the value:
a=0x4aaac919 62056c84 fba7334e 1a6be678 022181ba fd3aa878 899b2346 ee210f45

The correct result is:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3d 97ed17d4 7950b465 3cb32899

but the actual result was:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3c 97ed17d4 7950b465 3cb32899

so the forth word of the result was 0x75be8e3c but should have been
0x75be8e3d instead.

Likewise bn_sqr_comba4 has an identical bug for the same value as well:
a=0x022181ba fd3aa878 899b2346 ee210f45

correct result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3d 97ed17d4 7950b465 3cb32899

wrong result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3c 97ed17d4 7950b465 3cb32899

Fortunately the bn_mul_comba4/8 code paths are not affected.

Also the mips64 target does in fact not handle the carry propagation
correctly.

Example:
a=0x4aaac91900000000 62056c8400000000 fba7334e00000000 1a6be67800000000
    022181ba00000000 fd3aa87800000000 899b234635dad283 ee210f4500000001

correct result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f9 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

wrong result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f8 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17258)

(cherry picked from commit 336923c0c8d705cb8af5216b29a205662db0d590)

* Add some CHANGES entries for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17269)

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17271)

* Update NEWS for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17273)

* Prepare for 1.1.1m release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1n-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the null pointer dereference

Fixed #17296

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17302)

* Fix Configure variable spill

* Evaluating code-refs in Configure can sometimes set the default
variable `$_`
* Prevent spillage influencing the target property by using named
variable in loop

CLA: trivial

Fixes gh-17321

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17322)

(cherry picked from commit a595e3286ae9f033c56452967b3add2145f9085f)

* document additional stack push error code

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17351)

* Ensure s_client sends SNI data when used with -proxy

The use of -proxy prevented s_client from correctly sending the target
hostname as SNI data.

Fixes #17232

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17249)

* Add support for BSD-riscv64 target

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

(cherry picked from commit c2d1ad0e048dd3bfa60e6aa0b5ee343cc6d97a15)
(cherry picked from commit fb72a093f88f7332069659994b67f6b19aceb865)

(Merged from https://github.com/openssl/openssl/pull/17341)

* OBJ_obj2txt(): fix off-by-one documentation of the result

This backports the doc improvements of #17188.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit e36d10925396b6519e1abd338e1ef62cd5b1c9e6)

* Update troublesome copyright years of auto-generated files to 2022

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17401)

* apps/passwd.c: free before error exiting

use goto instead of returning directly while error handling

Signed-off-by: Peiwei Hu <[email protected]>

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17404)

(cherry picked from commit ea4d16bc60dee53feb71997c1e78379eeb69b7ac)

* close_console: Always unlock as the lock is always held

Fixes #17364

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17395)

* Fix password_callback to handle short passwords

Fixes #17426

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17439)

* Remove unsafe call to OPENSSL_cpuid_setup

This function is inherently thread-unsafe,
and moreover it is unnecessary here, because
OPENSSL_init_crypto always calls it in a thread-safe way.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17468)

* Fix a leak in EVP_DigestInit_ex()

If an EVP_MD_CTX is reused then memory allocated and stored in md_data
can be leaked unless the EVP_MD's cleanup function is called.

Fixes #17149

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* Add a test for a custom digest created via EVP_MD_meth_new()

We check that the init and cleanup functions for the custom method are
called as expected.

Based on an original reproducer by Dmitry Belyavsky from issue #17149.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* lhash: Avoid 32 bit right shift of a 32 bit value

Fixes #17583

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17589)

(cherry picked from commit 2ce0a3d19005271e7e3c351b562d9da93e2d4c80)

* Ensure X509_STORE_CTX_purpose_inherit handles a 0 default purpose

The function X509_STORE_CTX_purpose_inherit() can be called with a 0
default purpose. If the main purpose was set to X509_PURPOSE_ANY this
would case the function to incorrectly return an error response.

Fixes #17367

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Add a test for X509_STORE_CTX_set_purpose()

This function was previously incorrectly failing if it is called with
X509_PURPOSE_ANY. Add a test to catch this.

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Document purpose and trust setting functions

In particular:
X509_STORE_CTX_set_purpose()
X509_STORE_CTX_set_trust();
X509_STORE_CTX_purpose_inherit();

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Fix builds with DJGPP

CLA: trivial

To get the master branch compiled with DJGPP some minor
adjustments are required. They will have no impact on any other ports.
The DJGPP port uses the Watt-32 library to provide the required network
functionality and some of its headers need to be included.

Neither DJGPP nor the Watt-32 library provide in_addr_t thus it must be
provided as it is done for OPENSSL_SYS_WINDOWS in crypto/bio/b_addr.c.

In the DJGPP section of include/internal/sockets.h the following Watt-32
headers must be added:

  -  arpa/inet.h: to provide declaration of inet_ntoa required in crypto/bio/b_addr.c
  -  netinet/tcp.h: to provide defintion of TCP_NODELAY required in crypto/bio/b_sock2.c

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17623)

(cherry picked from commit b9b211fcb6b9068ef1d8729a4971fbe693fd2cde)

* Don't link test/ec_internal_test with libapps.a

It's not at all necessary, and on some platforms, it's disruptive
(leads to unresolved symbols because of object files that get included
in the link that depend on libssl).

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17637)

* Correct return type for BIO_ptr_ctrl

Fixes #17549
CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17636)

(cherry picked from commit 984cc9a0284ee4800862aa305f9f178827baf459)

* scrypt: increase memory usage beyond limit

This brings these tests in line with 3.0 and master and makes them
fail correctly.

Fixes #17612

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17619)

* Prevent crash with engine using different openssl runtime

This problem happens usually because an application
links libcrypto and/or libssl statically which
installs an atexit handler, but later an engine using
a shared instance of libcrypto is installed.
The problem is in simple words that both instances
of libcrypto have an atexit handler installed,
but both are unable to coordinate with each other,
which causes a crash, typically a use-after-free
in the engine's destroy function.

Work around that by preventing the engine's
libcrypto to install the atexit handler.
This may result in a small memory leak, but that
memory is still reachable.

Fixes #15898

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* Check for presence of 3.x openssl runtime

if the newly loaded engine contains the symbol
EVP_PKEY_get_base_id, we know it is linked to 3.x openssl.
Abort loading this engine, as it will definitely crash.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* crypto/x509/v3_utl.c: Add missing check for OPENSSL_strndup

Since the potential failure of memory allocation, it
should be better to check the return value of the
OPENSSL_strndup(), like x509v3_add_len_value().
And following the comment of 'if (astrlen < 0)',
return -1 if fails.

Signed-off-by: Jiasheng Jiang <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17737)

(cherry picked from commit 366a16263959c0b6599f0b9ec18124d75560c6ef)

* Improve documentation of BIO_FLAGS_BASE64_NO_NL flag.

Fixes #12491.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17744)

(cherry picked from commit 8bfb7506d210841f2ee4eda8afe96441a0e33fa5)

* Fix NULL pointer dereference for BN_mod_exp2_mont

This fixes a bug whereby BN_mod_exp2_mont can dereference a NULL pointer
if BIGNUM argument m represents zero.

Regression test added. Fixes #17648. Backport from master to 1.1.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17787)

* VMS: move copy_argc to its own module and make it an aux source

copy_argv was never initialization code.

Make it self-cleaning too.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17746)

* [ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias

`SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already
marked as aliases of each other in the headers.
This commit, for each pair, replaces the leftover uses of the latter
synonym with the first one, which is considered more common.

(manually cherry picked from commit 66914fc024cfe0fec00dc0f2c7bd8a7957da5ec4)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* [ssl] Add SSL_kDHEPSK and SSL_kECDHEPSK as PFS ciphersuites for SECLEVEL >= 3

Fixes #17743

(manually cherry picked from comm…

* make update (adds a new function code)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16027)

* Avoid "excessive message size" for session tickets

We received a report of an "excessive message size" for a received
session ticket. Our maximum size was significantly less than the theoretical
maximum. The server may put any data it likes in the session ticket
including (for example) the full certificate chain so we should be able to
handle longer tickets. Update the value to the maximum allowed by the spec.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15877)

(cherry picked from commit e54f0c9b2fe3dd2dcb5e8100e2c69e5b2f6eb681)

* BIO_lookup_ex: use AI_ADDRCONFIG only if explicit host name is given

The flag only affects which record types are queried via DNS (A or
AAAA, or both).  When node is NULL and AF_UNSPEC is used, it prevents
getaddrinfo returning the right address associated with the loopback
interface.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16039)

* Avoid empty lines in nmake rule bodies

nmake is tolerant of those empty lines, but jom isn't.  That tolerance
isn't standard make behaviour, so we lean towards avoiding them.

We simply use '@rem' instead.

Fixes #16014

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16047)

* apps: Use the first detected address family if IPv6 is not available

This is a follow up of 15729bef385211bc2a0497e2d53a45c45d677d2c.  Even
when the host does not support IPv6 at all, BIO_lookup_ex may now
return IN6ADDR_ANY in addition to INADDR_ANY, as the second element of
the ai_next field.

After eee8a40aa5e06841eed6fa8eb4f6109238d59aea, the do_server function
prefers the IPv6 address and fails on the BIO_socket call.  This adds
a fallback code to retry with the IPv4 address returned as the first
element to avoid the error.

The failure had been partially avoided in the previous code with
AI_ADDRCONFIG, because getaddrinfo returns only IPv4 address if no
IPv6 address is associated with external interface.  However, it would
be still a problem if the external interface has an IPv6 address
assigned, while the loopback interface doesn't.

Signed-off-by: Daiki Ueno <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16078)

* Don't reset the packet pointer in ssl3_setup_read_buffer

Sometimes this function gets called when the buffers have already been
set up. If there is already a partial packet in the read buffer then the
packet pointer will be set to an incorrect value. The packet pointer already
gets reset to the correct value when we first read a packet anyway, so we
don't also need to do it in ssl3_setup_read_buffer.

Fixes #13729

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Disallow SSL_key_update() if there are writes pending

If an application is halfway through writing application data it should
not be allowed to attempt an SSL_key_update() operation. Instead the
SSL_write() operation should be completed.

Fixes #12485

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16098)

* Fix some minor record layer issues

Various comments referred to s->packet and s->packet_length instead of
s->rlayer.packet and s->rlayer.packet_length. Also fixed is a spot where
RECORD_LAYER_write_pending() should have been used. Based on the review
comments in #16077.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>

(cherry picked from commit ca001524971ccd595bc0e9843611e6784adfc981)

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16105)

* Fix a read buffer overrun in X509_aux_print().

The ASN1_STRING_get0_data(3) manual explitely cautions the reader
that the data is not necessarily NUL-terminated, and the function
X509_alias_set1(3) does not sanitize the data passed into it in any
way either, so we must assume the return value from X509_alias_get0(3)
is merely a byte array and not necessarily a string in the sense
of the C language.

I found this bug while writing manual pages for X509_print_ex(3)
and related functions.  Theo Buehler <[email protected]> checked my
patch to fix the same bug in LibreSSL, see

http://cvsweb.openbsd.org/src/lib/libcrypto/asn1/t_x509a.c#rev1.9

As an aside, note that the function still produces incomplete and
misleading results when the data contains a NUL byte in the middle
and that error handling is consistently absent throughout, even
though the function provides an "int" return value obviously intended
to be 1 for success and 0 for failure, and even though this function
is called by another function that also wants to return 1 for success
and 0 for failure and even does so in many of its code paths, though
not in others.  But let's stay focussed.  Many things would be nice
to have in the wide wild world, but a buffer overflow must not be
allowed to remain in our backyard.

CLA: trivial

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16108)

(cherry picked from commit c5dc9ab965f2a69bca964c709e648158f3e4cd67)

* DSA/RSA_print(): Fix potential memory leak

Fixes #10777

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16130)

(cherry picked from commit 40184c96103a388209939c1c19920971c05bb78c)

* [doc/man3] documentation: BN_cmp manpage updates

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16214)

(cherry picked from commit 3d4ca443b4778e3230ff23f17625f58f815a9142)

* Revert "make update (adds a new function code)"

This reverts commit ea26844c4f624ef515d9228d3b623761a369b049.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to handle encoding/decoding failure"

This reverts commit f1d97905bbd8679b7647c992b97f526791069040.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "Fix test/asn1_encode_test.c to not use ASN1_FBOOLEAN"

This reverts commit 5434acb6c4d56507d761b28f7e142ccab808a8fa.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "ASN.1: Refuse to encode to DER if non-optional items are missing"

This reverts commit 006906cddda37e24a66443199444ef4476697477.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Revert "TEST: Check that i2d refuses to encode non-optional items with no content"

This reverts commit 12e9b74c513a8ed3c1c260cf25221a465ae14b84.

Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16308)

* Fix potential double-free

The `sk` variable is assigned to `s->session->peer_chain`.
If `ssl3_digest_cached_records()` were to fail, then `sk` would still be
non-NULL, and subsequently freed on the error return. When the session
is freed, it will then attempt to free `s->session->peer_chain`,
resulting in a double-free (of `sk`).

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16309)

(cherry picked from commit 0449702abc95a3af24c049cb02c01ca6a8015cef)

* s390x: AES OFB/CFB: Maintain running IV from cipher context

Copy the current IV from the cipher context into the kmo/kmf param before
the operation, and copy the modified IV back to the context afterwards.
Without this, an application that obtains the running IV from the context
would still get the original IV, but not the updated one.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* Test EVP Cipher updating the context's IV

Ensure that an EVP_CipherUpdate operation updates the context's
IV for AES CBC, CFB, OFB, and CTR. An application can get the
updated IV via EVP_CIPHER_CTX_iv().

The s390x implementation of the CFB and OFB ciphers did not
update the IV in the context, but only within its s390x specific
context data.

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Patrick Steuer <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16292)

* pkcs12: check for zero length digest to avoid division by zero

Fixes #16331

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Kurt Roeckx <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16333)

* [github-ci] Sync ci.yml workflow with master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import windows.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import cross-compiles.yml workflow from master

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker workflows from master

This commit does not include the daily run-checker workflow.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Import run-checker daily workflow from master

The daily run-checker is scheduled to start at 6:42, instead of the
start of the hour.

The official GitHub documentation remarks the following regarding
scheduled workflows:

> Note: The schedule event can be delayed during periods of high loads
> of GitHub Actions workflow runs. High load times include the start of
> every hour. To decrease the chance of delay, schedule your workflow to
> run at a different time of the hour.

42, obviously, has been picked because it is the answer to the ultimate
question of life, the universe, and everything.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][cross-compiles.yml] Disable sparcv9

This commit temporarily disables cross-compiling tests for sparcv9, due
to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable krb5 external tests

This commit temporarily disables krb5 external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable pyca external tests

This commit temporarily disables pyca external tests,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-ci.yml] Disable no-tls1_3 tests

This commit temporarily disables tests for no-tls1_3,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][ci.yml] Disable memory sanitizer build

In 1.1.1 currently we do not support running multiple tests in parallel,
and the `--debug -O1` msan build required more than 3h to run the tests.

This commit temporarily disables this build configuration.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci][run-checker-merge.yml] Disable ubsan build

This commit temporarily disables the ubsan build,
due to failures to be investigated in a dedicated PR.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* [github-ci] Add comment about our approach to GitHub Actions CI

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16252)

* Revert "[github-ci][cross-compiles.yml] Disable sparcv9"

This reverts commit aa23aa759cf33b4f481fc719d42cb7bae8b2eaf0.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* sparc: fix cross compile build

(cherry picked from commit 64fac96de81d3dc19cc0c9045c341f0dec818075)

Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16336)

* Fix i2v_GENERAL_NAME to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix POLICYINFO printing to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix printing of PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the name constraints code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix test code to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix append_ia5 function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix EC_GROUP_new_from_ecparameters to check the base length

Check that there's at least one byte in params->base before trying to
read it.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Allow fuzz builds to detect string overruns

If FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined then we don't NUL
terminate ASN1_STRING datatypes. This shouldn't be necessary but we add it
any for safety in normal builds.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Fix the error handling in i2v_AUTHORITY_KEYID

Previously if an error path is entered a leak could result.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

* Correctly calculate the length of SM2 plaintext given the ciphertext

Previously the length of the SM2 plaintext could be incorrectly calculated.
The plaintext length was calculated by taking the ciphertext length and
taking off an "overhead" value.

The overhead value was assumed to have a "fixed" element of 10 bytes.
This is incorrect since in some circumstances it can be more than 10 bytes.
Additionally the overhead included the length of two integers C1x and C1y,
which were assumed to be the same length as the field size (32 bytes for
the SM2 curve). However in some cases these integers can have an additional
padding byte when the msb is set, to disambiguate them from negative
integers. Additionally the integers can also be less than 32 bytes in
length in some cases.

If the calculated overhead is incorrect and larger than the actual value
this can result in the calculated plaintext length being too small.
Applications are likely to allocate buffer sizes based on this and therefore
a buffer overrun can occur.

CVE-2021-3711

Issue reported by John Ouyang.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Extend tests for SM2 decryption

Check the case where C1y < 32 bytes in length (i.e. short overhead), and
also the case with longer plaintext and C1x and C1y > 32 bytes in length
(i.e. long overhead)

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Check the plaintext buffer is large enough when decrypting SM2

Previously there was no check that the supplied buffer was large enough.
It was just assumed to be sufficient. Instead we should check and fail if
not.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>

* Updates to CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <[email protected]>

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>

* Run make update

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1l release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1m-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the array size of dtlsseq in tls1_enc

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16385)

(cherry picked from commit 562d4cd3c35b32f2bc6ac0770b80ce394f8d76a4)

* Avoid using undefined value in generate_stateless_cookie_callback

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16381)

* Fix some strict gcc-12 warnings

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16375)

* apps/ciphers: Fix wrong return value when using -convert parameter

Command 'openssl ciphers -convert <name>' always returns failure,
this patch set the correct return value.

Signed-off-by: Tianjia Zhang <[email protected]>

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16383)

(cherry picked from commit 8b4e9c5265ffd3457ad37133502a9d8a4e8daccd)

* Check for null-pointer dereference in dh_cms_set_peerkey

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16382)

* ts: fix memleaks caused by TS_VERIFY_CTX_set_imprint

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16347)

(cherry picked from commit 62bae84d4587ec9a56d0ce830e36e4a5b2fa8a33)

* Darwin platform allows to build on releases before Yosemite/ios 8.

issue #16407 #16408

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16409)

* cms: fix memleaks in cms_env.c

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16403)

* Fix instances of pointer addition with the NULL pointer

ubsan found undefined pointer addtions in
crypto/bio/bss_mem.c (mem_ctrl),
crypto/pem/pem_lib.c (PEM_read_bio_ex),
test/testutil/format_output.c (test_fail_string_common,
test_fail_memory_common).

Mostly a straight back-port-of: a07dc81

Additionally enable the ubsan run-checker, to prevent regressions.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16423)

* Fix enable-asan with C++ buildtest

the following config:

./config no-shared enable-asan enable-buildtest-c++ enable-external-tests

fails to build with unresolved asan symbols when linking
test/ossl_shim/ossl_shim

Fixed by passing all sanitizer-flags to cxxflags.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16434)

* Fix the "Out of memory" EVP KDF scrypt test

This test did not really execute, since usually
the OPENSSL_malloc(0) will fail and prevent the
execution of the KDF.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16446)

* Ensure that _GNU_SOURCE is defined for bss_dgram.c

This fixes the following error with gcc10 under strict ANSI conditions:

.../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32'

CLA: trivial
Fixes #16449

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16451)

(cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f)

* Fix no-tls1_3 tests

This recently added test needs DH2048 to work without tls1_3.

Fixes: #16335

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16453)

* Add tests for i2d_TYPE_fp and d2i_TYPE_fp

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

@@ Note: This commit limits to ECPKParameters as a type.

(cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

This commit fixes the public headers to reflect these changes.

Fixes #12443

(cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to https://github.com/openssl/openssl/pull/12312

(cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Use applink to fix windows tests

(cherry picked from commit <https://github.com/bernd-edlinger/openssl/commit/96a463cede0070aa5c86629d683a214657a9ba9e>)

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* Openssl fails to compile on Debian with kfreebsd kernels
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler
is:

../crypto/uid.c: In function 'OPENSSL_issetugid':
../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function)
   50 |     return getauxval(AT_SECURE) != 0;
      |                      ^~~~~~~~~

This commit changes the code to use the freebsd code in this case.
This fixes the compilation.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16477)

(cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)

* doc: document the rsa_oaep_md: pkeyopt

This was missing but essential for using non-SHA1 digests with OAEP.

Fixes #15998

Manual backport of #16410

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16488)

* Prioritise DANE TLSA issuer certs over peer certs

When building the certificate chain, prioritise any Cert(0) Full(0)
certificates from TLSA records over certificates received from the peer.

This is important when the server sends a cross cert, but TLSA records include
the underlying root CA cert.  We want to construct a chain with the issuer from
the TLSA record, which can then match the TLSA records (while the associated
cross cert may not).

Reviewed-by: Tomáš Mráz <[email protected]>

* Test for DANE cross cert fix

Reviewed-by: Tomáš Mráz <[email protected]>

* test/ec_internal_test: link with libapps.a too

Whenever the source from $target{apps_init_src} is added to the source
of a test program, it needs to be linked with libapps.a as well.  Some
init sources depend on that.

Without this, builds break on VMS because of the unresolved symbol
'app_malloc'.

On platforms that do not need anything from libapps.a, adding it is a
no-op.

This is for OpenSSL 1.1.1 only.  OpenSSL 3.0 and beyond have a
different solution.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16512)

* VMS: Compensate for compiler type incompatibility

The compiler says that 'unsigned long long' isn't the same as
'unsigned __int64'.  Sure, and considering that crypto/rand/rand_vms.c
is specific VMS only code, it's easy to just change the type to the
exact same as what's specified in the system headers.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15613)

* DOCS: Update the page for 'openssl passwd' to not duplicate some info

The options -1 and -apr1 were mentioned in DESCRIPTION, not mentioning
any other options or even mentioning that there are more algorithms.
The simple fix is to remove that sentence and let the OPTIONS section
speak for itself.

Fixes #16529

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16531)

(cherry picked from commit 116799ff6a8fc803ec4685fc432c7329d0511e23)

* VMS: Fix misspelt type

'__int64', not 'int64_t'

Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16557)

* Fix nc_email to check ASN1 strings with NULL byte in the middle

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16524)

(cherry picked from commit 485d0790ac1a29a0d4e7391d804810d485890376)

* MacOS prior to 10.12 does not support random API correctly

Fixes #16517

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16587)

* Clarify what SSL_get_session() does on the server side in TLSv1.3

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)

* Correct the documentation for SSL_set_num_tickets()

The behaviour for what happens in a resumption connection was not quite
described correctly.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)

* ssl: Correct filename in README

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16671)

* Add sm2 encryption test case from GM/T 0003.5-2012

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16511)

(cherry picked from commit 8ba65c35ea3af347c3b2adc8e665066b541a1c35)

* doc/man3/SSL_set_fd.pod: add note about Windows compiler warning

According to an old stackoverflow thread [1], citing an even older comment by
Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05),
a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although
the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2),
in practice the socket() implementation on Windows returns an index into the kernel
handle table, the size of which is limited to 2^24 [3].

Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow.

[1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64
[2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2
[3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16699)

(cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)

* Fix a NPD bug in engines/e_dasync.c

The dasync_aes_128_cbc_hmac_sha1 cipher depends on
EVP_aes_128_cbc_hmac_sha1() returning a NON-NULL value.
We should simply not advertise this cipher otherwise.

Fixes: #7950

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16722)

* Fix a memory leak in the afalg engine

Fixes: #16743

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16744)

(cherry picked from commit 6f6a5e0c7c41b6b3639e51f435cd98bb3ae061bc)

* Fix some possible memory leaks in EVP_CipherInit_ex

An EVP_CONTEXT with zero cipher but non-zero engine,
and/or cipher_data is possible if an error happens
in EVP_CTRL_INIT or in EVP_CTRL_COPY, the error handling
will just clear the cipher in that case.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16756)

* Fix double-free in e_dasync.c

When the cipher is copied, the inner_cihper_data
need to be copied as well, using the EVP_CTRL_COPY method.
The EVP_CIPH_CUSTOM_COPY bit needs to be set as well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16751)

* Bindhost/bindport should be freed

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16775)

(cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)

* New extensions can be sent in a certificate request

Normally we expect a client to send new  extensions in the ClientHello,
which may be echoed back by the server in subsequent messages. However the
server can also send a new extension in the certificate request message to
be echoed back in a certificate message

Fixes #16632

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)

* Extend custom extension testing

Test the scenario where we add a custom extension to a cetificate
request and expect a response in the client's certificate message.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit 0db3a9904fa00569905be130854a31dab7b8f49d)

* Fix test/recipes/01-test_symbol_presence.t to allow for stripped libraries

It's a small change to the 'nm' call, to have it look at dynamic symbols
rather than the normal ones.

Fixes #16810

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16822)

(cherry picked from commit a85b4de6a6cbe03c46219d4b1c3b2828ca3fd51c)

* Fix test/recipes/01-test_symbol_presence.t to disregard version info

The output of 'nm -DPg' contains version info attached to the symbols,
which makes the test fail.  Simply dropping the version info makes the
test work again.

Fixes #16810 (followup)

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16840)

(cherry picked from commit 73970cb91fdf8e7b4b434d479b875a47a0aa0dbc)

* test/ssl_old_test.c: Fix potential leak

Reviewed-by: Kurt Roeckx <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16806)

(cherry picked from commit 34563be5368fb8e6ade7d06d8376522ba83cd6ac)

* Ensure pkey_set_type handles ENGINE references correctly

pkey_set_type should not consume the ENGINE references that may be
passed to it.

Fixes #16757

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Add tests for ENGINE problems

Add some tests which would have caught the issues fixed in the previous
commit related to engine handling.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Fix some documentation errors related to return values

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16794)

(cherry picked from commit f1d077f1108b1bc2334350a4d53a46e29e082910)

* Fix BIO_get_md_ctx return value check

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16792)

* Fix the s_server psk_server_cb for use in DTLS

Commit 0007ff257c added a protocol version check to psk_server_cb but
failed to take account of DTLS causing DTLS based psk connections to
fail.

Fixes #16707

Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16838)

(cherry picked from commit 8b09a9c76d873f62c2507fa9628a9c96c1d66d5c)

* Fix no-cmac

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16894)

(cherry picked from commit ef2fb64f9dfde1965cb0b8a5f8765c4f467c1604)

* Fix a gcc 11.2.0 warning

gcc 11.2.0 is the default on Ubuntu 21.10. It emits a (spurious) warning
when compiling test/packettest.c, which causes --strict-warnings builds
to fail. A simple fix avoids the warning.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16887)

(cherry picked from commit 37467b2752f75ce80437120f704452982b7c1998)

* speed: range check the argument given to -multi for 1.1.1

Fixes #16899 for 1.1.1 branch.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16922)

* check the return value of BN_new() and BN_dup()

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16948)

(cherry picked from commit d99004fe5de934120765d342586f08d22131b8ed)

* Fix a memory leak in tls_parse_stoc_key_share

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16957)

* Fix a memory leak in ssl_create_cipher_list

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16955)

* Fix: invoking x509_name_cannon improperly

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16974)

(cherry picked from commit 09235289c377ff998964bb6b074bb2a3ad768fd2)

* Reset the rwstate before calling ASYNC_start_job()

If an async job pauses while processing a TLS connection then the
rwstate gets set to SSL_ASYNC_PAUSED. When resuming the job we should
reset the rwstate back to SSL_NOTHING. In fact we can do this
unconditionally since if we're about to call ASYNC_start_job() then either
we are about to start the async job for the first time (in which case the
rwstate should already by SSL_NOTHING), or we are restarting it after a
pause (in which case reseting it to SSL_NOTHING is the correct action).

Fixes #16809

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17013)

(cherry picked from commit 07f620e3acf0dd76a3a03ada9911c544aa483aa7)

* free the Post-Handshake Auth digest when there is an error saving the digest

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16924)

* evp: fix EVP_PKEY_get0_EC_KEY when EC_KEY is SM2

EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2) will change pkey->type to EVP_PKEY_SM2

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17015)

* Avoid loading of a dynamic engine twice

Use the address of the bind function as a DYNAMIC_ID,
since the true name of the engine is not known
before the bind function returns,
but invoking the bind function before the engine
is unloaded results in memory corruption.

Fixes #17023

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17073)

(cherry picked from commit e2571e02d2b0cd83ed1c79d384fe941f27e603c0)

* ERR: Add a missing common reason string

There was no string present for ERR_R_PASSED_INVALID_ARGUMENT

Reviewed-by: David von Oheimb <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17069)

* Add a test case for duplicate engine loading

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17083)

* DOC: Add a few previously documented functions

d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp()
were documented in OpenSSL 1.0.2.  In a grand unification of the
documentation of (almost) all d2i and i2d functions, these were
dropped, most likely by mistake.

This simply adds them back.

Fixes #17091

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17093)

* Fix detection of ARMv7 and ARM64 CPU features on FreeBSD

OpenSSL assumes AT_HWCAP = 16 (as on Linux), but on FreeBSD AT_HWCAP = 25
Switch to using AT_HWCAP, and setting it to 16 if it is not defined.

OpenSSL calls elf_auxv_info() with AT_CANARY which returns ENOENT
resulting in all ARM acceleration features being disabled.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17082)

(cherry picked from commit c1dabe26e3e96cdce0ffc929e9677840ad089ba5)

* Clarify and correct the EVP_CTRL_AEAD_SET_TAG docs

The restriction about setting a tag length prior to setting the IV only
applies to OCB mode. We clarify when in the process EVP_CTRL_AEAD_SET_TAG
can be called.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17111)

(cherry picked from commit 3607b8ad8ee1980a079e985333a196e0c79f8f00)

* doc: fix macro name

OSSL_STORE_INFO_X509 doesn't exist.  It should be OSSL_STORE_INFO_CERT.

Fixes #17121

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17125)

(cherry picked from commit 01fde90eec721b64bc0e1c01cd94a9fd431adcc6)

* BIO_push.pod: fix confusing text and add details on corner cases

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17086)

(cherry picked from commit 7a37fd09a8f3607ed8acf55e03479861595be069)

* Fix speed, use OPENSSL_free instead of free

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17132)

* TEST: Enable and fix test_bn2padded() in test/bntest.c

This looks like old code, written when the padded variety of BN_bn2bin()
was developped, and disabled by default...  and forgotten.

A few simple changes to update it to the current API is all that was
needed to enable it.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17133)

(cherry picked from commit 23750f677ef61b6bea4e81f23f335ad08fc49b51)

* No EtM for GOST ciphers

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17158)

* Fix ssl_free() and thus BIO_free() to respect BIO_NOCLOSE

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* BIO_f_ssl.pod: Make clear where an SSL BIOs are expected as an argument

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* Fix documentation for tlsext_ticket_key

The tlsext_ticket_key functions are documented as returning 0 on success.
In fact they return 1 on success.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17210)

(cherry picked from commit b0be101326f369f0dd547556d2f3eb3ef5ed0e33)

* OBJ_nid2obj.pod: Replace remaining 'B<' by 'I<' were appropriate

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17221)

* Fix a deadlock in OBJ_NAME_add

This happened after an out of memory error:
CRYPTO_THREAD_write_lock may hang in OBJ_NAME_add.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17236)

* CI: Replace windows-2016 with windows-2022

Windows 2016 environment is going to be discontinued.

We also replace windows-latest with windows-2019 so
there aren't two identical builds done once windows-latest
is switched to mean windows-2022.

Fixes #17177

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17211)

* Fix faulty detail in BN_rand() manual

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17131)

* Fix a carry overflow bug in bn_sqr_comba4/8 for mips 32-bit targets

bn_sqr_comba8 does for instance compute a wrong result for the value:
a=0x4aaac919 62056c84 fba7334e 1a6be678 022181ba fd3aa878 899b2346 ee210f45

The correct result is:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3d 97ed17d4 7950b465 3cb32899

but the actual result was:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3c 97ed17d4 7950b465 3cb32899

so the forth word of the result was 0x75be8e3c but should have been
0x75be8e3d instead.

Likewise bn_sqr_comba4 has an identical bug for the same value as well:
a=0x022181ba fd3aa878 899b2346 ee210f45

correct result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3d 97ed17d4 7950b465 3cb32899

wrong result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3c 97ed17d4 7950b465 3cb32899

Fortunately the bn_mul_comba4/8 code paths are not affected.

Also the mips64 target does in fact not handle the carry propagation
correctly.

Example:
a=0x4aaac91900000000 62056c8400000000 fba7334e00000000 1a6be67800000000
    022181ba00000000 fd3aa87800000000 899b234635dad283 ee210f4500000001

correct result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f9 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

wrong result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f8 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17258)

(cherry picked from commit 336923c0c8d705cb8af5216b29a205662db0d590)

* Add some CHANGES entries for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17269)

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17271)

* Update NEWS for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17273)

* Prepare for 1.1.1m release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1n-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the null pointer dereference

Fixed #17296

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17302)

* Fix Configure variable spill

* Evaluating code-refs in Configure can sometimes set the default
variable `$_`
* Prevent spillage influencing the target property by using named
variable in loop

CLA: trivial

Fixes gh-17321

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17322)

(cherry picked from commit a595e3286ae9f033c56452967b3add2145f9085f)

* document additional stack push error code

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17351)

* Ensure s_client sends SNI data when used with -proxy

The use of -proxy prevented s_client from correctly sending the target
hostname as SNI data.

Fixes #17232

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17249)

* Add support for BSD-riscv64 target

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

(cherry picked from commit c2d1ad0e048dd3bfa60e6aa0b5ee343cc6d97a15)
(cherry picked from commit fb72a093f88f7332069659994b67f6b19aceb865)

(Merged from https://github.com/openssl/openssl/pull/17341)

* OBJ_obj2txt(): fix off-by-one documentation of the result

This backports the doc improvements of #17188.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit e36d10925396b6519e1abd338e1ef62cd5b1c9e6)

* Update troublesome copyright years of auto-generated files to 2022

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17401)

* apps/passwd.c: free before error exiting

use goto instead of returning directly while error handling

Signed-off-by: Peiwei Hu <[email protected]>

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17404)

(cherry picked from commit ea4d16bc60dee53feb71997c1e78379eeb69b7ac)

* close_console: Always unlock as the lock is always held

Fixes #17364

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17395)

* Fix password_callback to handle short passwords

Fixes #17426

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17439)

* Remove unsafe call to OPENSSL_cpuid_setup

This function is inherently thread-unsafe,
and moreover it is unnecessary here, because
OPENSSL_init_crypto always calls it in a thread-safe way.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17468)

* Fix a leak in EVP_DigestInit_ex()

If an EVP_MD_CTX is reused then memory allocated and stored in md_data
can be leaked unless the EVP_MD's cleanup function is called.

Fixes #17149

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* Add a test for a custom digest created via EVP_MD_meth_new()

We check that the init and cleanup functions for the custom method are
called as expected.

Based on an original reproducer by Dmitry Belyavsky from issue #17149.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* lhash: Avoid 32 bit right shift of a 32 bit value

Fixes #17583

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17589)

(cherry picked from commit 2ce0a3d19005271e7e3c351b562d9da93e2d4c80)

* Ensure X509_STORE_CTX_purpose_inherit handles a 0 default purpose

The function X509_STORE_CTX_purpose_inherit() can be called with a 0
default purpose. If the main purpose was set to X509_PURPOSE_ANY this
would case the function to incorrectly return an error response.

Fixes #17367

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Add a test for X509_STORE_CTX_set_purpose()

This function was previously incorrectly failing if it is called with
X509_PURPOSE_ANY. Add a test to catch this.

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Document purpose and trust setting functions

In particular:
X509_STORE_CTX_set_purpose()
X509_STORE_CTX_set_trust();
X509_STORE_CTX_purpose_inherit();

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Fix builds with DJGPP

CLA: trivial

To get the master branch compiled with DJGPP some minor
adjustments are required. They will have no impact on any other ports.
The DJGPP port uses the Watt-32 library to provide the required network
functionality and some of its headers need to be included.

Neither DJGPP nor the Watt-32 library provide in_addr_t thus it must be
provided as it is done for OPENSSL_SYS_WINDOWS in crypto/bio/b_addr.c.

In the DJGPP section of include/internal/sockets.h the following Watt-32
headers must be added:

  -  arpa/inet.h: to provide declaration of inet_ntoa required in crypto/bio/b_addr.c
  -  netinet/tcp.h: to provide defintion of TCP_NODELAY required in crypto/bio/b_sock2.c

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17623)

(cherry picked from commit b9b211fcb6b9068ef1d8729a4971fbe693fd2cde)

* Don't link test/ec_internal_test with libapps.a

It's not at all necessary, and on some platforms, it's disruptive
(leads to unresolved symbols because of object files that get included
in the link that depend on libssl).

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17637)

* Correct return type for BIO_ptr_ctrl

Fixes #17549
CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17636)

(cherry picked from commit 984cc9a0284ee4800862aa305f9f178827baf459)

* scrypt: increase memory usage beyond limit

This brings these tests in line with 3.0 and master and makes them
fail correctly.

Fixes #17612

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17619)

* Prevent crash with engine using different openssl runtime

This problem happens usually because an application
links libcrypto and/or libssl statically which
installs an atexit handler, but later an engine using
a shared instance of libcrypto is installed.
The problem is in simple words that both instances
of libcrypto have an atexit handler installed,
but both are unable to coordinate with each other,
which causes a crash, typically a use-after-free
in the engine's destroy function.

Work around that by preventing the engine's
libcrypto to install the atexit handler.
This may result in a small memory leak, but that
memory is still reachable.

Fixes #15898

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* Check for presence of 3.x openssl runtime

if the newly loaded engine contains the symbol
EVP_PKEY_get_base_id, we know it is linked to 3.x openssl.
Abort loading this engine, as it will definitely crash.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* crypto/x509/v3_utl.c: Add missing check for OPENSSL_strndup

Since the potential failure of memory allocation, it
should be better to check the return value of the
OPENSSL_strndup(), like x509v3_add_len_value().
And following the comment of 'if (astrlen < 0)',
return -1 if fails.

Signed-off-by: Jiasheng Jiang <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17737)

(cherry picked from commit 366a16263959c0b6599f0b9ec18124d75560c6ef)

* Improve documentation of BIO_FLAGS_BASE64_NO_NL flag.

Fixes #12491.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17744)

(cherry picked from commit 8bfb7506d210841f2ee4eda8afe96441a0e33fa5)

* Fix NULL pointer dereference for BN_mod_exp2_mont

This fixes a bug whereby BN_mod_exp2_mont can dereference a NULL pointer
if BIGNUM argument m represents zero.

Regression test added. Fixes #17648. Backport from master to 1.1.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17787)

* VMS: move copy_argc to its own module and make it an aux source

copy_argv was never initialization code.

Make it self-cleaning too.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17746)

* [ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias

`SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already
marked as aliases of each other in the headers.
This commit, for each pair, replaces the leftover uses of the latter
synonym with the first one, which is considered more common.

(manually cherry picked from commit 66914fc024cfe0fec00dc0f2c7bd8a7957da5ec4)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* [ssl] Add SSL_kDHEPSK and SSL_kECDHEPSK as PFS ciphersuites for SECLEVEL >= 3

Fixes #17743

(manually cherry picked from commit b139a95665eb023b38695d62d9dfc28f3fb89972)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* [ssl] Add tests for Perfect Forward Secrecy criteria on SECLEVEL >= 3

(manually cherry picked from commit d71151ae704847f4ac3f4a5f394ea64f1d229815)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* Document bug in openssl cms -binary

Documents a bug in openssl cms -binary for 1.1 whereby it cannot process
input using LF line endings correctly. Binary input processing was
reworked substantially for 3.0 and backporting these changes doesn't
appear reasonable.

Fixes #17797.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17810)

* Avoid potential memory leak

Resolves #17827

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17828)

(cherry picked from commit 175355923046921a689b500f7a72455f7095708f)

* Set protocol in init_client()

If TCP is being used, protocol = 0 is passed to init_client(), then
protocol == IPPROTO_TCP fails when attempting to set BIO_SOCK_NODELAY.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17838)

(cherry picked from commit 54b6755702309487ea860e1cc3e60ccef4cf7878)

* Fix issue where OBJ_nid2obj doesn't always raise an error

This was previously fixed in 3.0 but not 1.1.

Fixes #13008.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17808)

* DOC: TLS compression is disabled by default

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matthias St. Pierre <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17854)

(cherry picked from commit 2cb52118ddd1d82d7b6028372238eaa2467bbd48)

* Fix OPENSSL_ENGINES in Configurations/descrip.mms.tmpl

Make its value an absolute path.

This was already fixed in all other build file templates, but for some
reason, not here.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17865)

* Make ossltest engine use in test/recipes/20-test_dgst.t platform agnostic

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17861)

(cherry picked from commit abdb2278d2b65ae87bee3121be83322e4219b396)

* Fix possible infinite loop in BN_mod_sqrt()

The calculation in some cases does not finish for non-prime p.

This fixes CVE-2022-0778.

Based on patch by David Benjamin <[email protected]>.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Add documentation of BN_mod_sqrt()

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Add a negative testcase for BN_mod_sqrt

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Update CHANGES/NEWS for new release

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Update copyright year

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Prepare for 1.1.1n release

Reviewed-by: Tomas Mraz <[email protected]>

* Prepare for 1.1.1o-dev

Reviewed-by: Tomas Mraz <[email protected]>

* Check password length only when verify is enabled.

Fixes #16231.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17899)

* eng_dyn: Avoid spurious errors when checking for 3.x engine

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17902)

* print SSL session, fix build warnings on OpenBSD.

time_t is a 64 bits type on this platform.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17917)

(cherry picked from commit 9362638b080e328ccab43f89048bed27bcf2f11d)

* Fix coverity 1498607: uninitialised value

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17897)

(cherry picked from commit 70cd9a51911e9a4e2f24e29ddd84fa9fcb778b63)

* Fix Coverity 1498611 & 1498608: uninitialised read

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17893)

(cherry picked from commit 09134f183f76539aa1294adfef10fcc694e90267)

* Fix Coverity 1201763 uninitialised pointer read

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17890)

(cherry picked from commit a0238b7ed87998c48b1c92bad7fa82dcbba507f9)

* Fix integer overflow in evp_EncryptDecryptUpdate

Fixes #17871.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17872)

* Fix Coverity 1498612: integer overflow

The assert added cannot ever fail because (current & 0xFFFF) != 0 from the
while loop and the trailing zero bit count therefore cannot be as large as 32.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17892)

(cherry picked from commit 81487b65b9eb8148471e729b8c1959521d62c69e)

* s390x: Hide internal cpuid symbol and function

The symbol OPENSSL_s390xcap_P and the OPENSSL_cpuid_setup function are not
exported by the version script of OpenSSL.  However, if someone uses the
static library without the version script, these symbols all of a sudden
become global symbols and their usage in assembler code does not correctly
reflect that for PIC.  Since these symbols should never be used outside of
OpenSSL, hide them inside the binary.

Signed-off-by: Juergen Christ <[email protected]>

Reviewed-by: Paul Dale <pauli…

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>

* Run make update

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1l release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1m-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the array size of dtlsseq in tls1_enc

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16385)

(cherry picked from commit 562d4cd3c35b32f2bc6ac0770b80ce394f8d76a4)

* Avoid using undefined value in generate_stateless_cookie_callback

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16381)

* Fix some strict gcc-12 warnings

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16375)

* apps/ciphers: Fix wrong return value when using -convert parameter

Command 'openssl ciphers -convert <name>' always returns failure,
this patch set the correct return value.

Signed-off-by: Tianjia Zhang <[email protected]>

Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16383)

(cherry picked from commit 8b4e9c5265ffd3457ad37133502a9d8a4e8daccd)

* Check for null-pointer dereference in dh_cms_set_peerkey

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16382)

* ts: fix memleaks caused by TS_VERIFY_CTX_set_imprint

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16347)

(cherry picked from commit 62bae84d4587ec9a56d0ce830e36e4a5b2fa8a33)

* Darwin platform allows to build on releases before Yosemite/ios 8.

issue #16407 #16408

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16409)

* cms: fix memleaks in cms_env.c

CLA: trivial

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16403)

* Fix instances of pointer addition with the NULL pointer

ubsan found undefined pointer addtions in
crypto/bio/bss_mem.c (mem_ctrl),
crypto/pem/pem_lib.c (PEM_read_bio_ex),
test/testutil/format_output.c (test_fail_string_common,
test_fail_memory_common).

Mostly a straight back-port-of: a07dc81

Additionally enable the ubsan run-checker, to prevent regressions.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16423)

* Fix enable-asan with C++ buildtest

the following config:

./config no-shared enable-asan enable-buildtest-c++ enable-external-tests

fails to build with unresolved asan symbols when linking
test/ossl_shim/ossl_shim

Fixed by passing all sanitizer-flags to cxxflags.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16434)

* Fix the "Out of memory" EVP KDF scrypt test

This test did not really execute, since usually
the OPENSSL_malloc(0) will fail and prevent the
execution of the KDF.

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16446)

* Ensure that _GNU_SOURCE is defined for bss_dgram.c

This fixes the following error with gcc10 under strict ANSI conditions:

.../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32'

CLA: trivial
Fixes #16449

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16451)

(cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f)

* Fix no-tls1_3 tests

This recently added test needs DH2048 to work without tls1_3.

Fixes: #16335

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16453)

* Add tests for i2d_TYPE_fp and d2i_TYPE_fp

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

@@ Note: This commit limits to ECPKParameters as a type.

(cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

This commit fixes the public headers to reflect these changes.

Fixes #12443

(cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to https://github.com/openssl/openssl/pull/12312

(cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Use applink to fix windows tests

(cherry picked from commit <https://github.com/bernd-edlinger/openssl/commit/96a463cede0070aa5c86629d683a214657a9ba9e>)

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nicola Tuveri <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/12457)

* Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16441)

* Openssl fails to compile on Debian with kfreebsd kernels
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler
is:

../crypto/uid.c: In function 'OPENSSL_issetugid':
../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function)
   50 |     return getauxval(AT_SECURE) != 0;
      |                      ^~~~~~~~~

This commit changes the code to use the freebsd code in this case.
This fixes the compilation.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16477)

(cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)

* doc: document the rsa_oaep_md: pkeyopt

This was missing but essential for using non-SHA1 digests with OAEP.

Fixes #15998

Manual backport of #16410

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16488)

* Prioritise DANE TLSA issuer certs over peer certs

When building the certificate chain, prioritise any Cert(0) Full(0)
certificates from TLSA records over certificates received from the peer.

This is important when the server sends a cross cert, but TLSA records include
the underlying root CA cert.  We want to construct a chain with the issuer from
the TLSA record, which can then match the TLSA records (while the associated
cross cert may not).

Reviewed-by: Tomáš Mráz <[email protected]>

* Test for DANE cross cert fix

Reviewed-by: Tomáš Mráz <[email protected]>

* test/ec_internal_test: link with libapps.a too

Whenever the source from $target{apps_init_src} is added to the source
of a test program, it needs to be linked with libapps.a as well.  Some
init sources depend on that.

Without this, builds break on VMS because of the unresolved symbol
'app_malloc'.

On platforms that do not need anything from libapps.a, adding it is a
no-op.

This is for OpenSSL 1.1.1 only.  OpenSSL 3.0 and beyond have a
different solution.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16512)

* VMS: Compensate for compiler type incompatibility

The compiler says that 'unsigned long long' isn't the same as
'unsigned __int64'.  Sure, and considering that crypto/rand/rand_vms.c
is specific VMS only code, it's easy to just change the type to the
exact same as what's specified in the system headers.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/15613)

* DOCS: Update the page for 'openssl passwd' to not duplicate some info

The options -1 and -apr1 were mentioned in DESCRIPTION, not mentioning
any other options or even mentioning that there are more algorithms.
The simple fix is to remove that sentence and let the OPTIONS section
speak for itself.

Fixes #16529

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16531)

(cherry picked from commit 116799ff6a8fc803ec4685fc432c7329d0511e23)

* VMS: Fix misspelt type

'__int64', not 'int64_t'

Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16557)

* Fix nc_email to check ASN1 strings with NULL byte in the middle

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16524)

(cherry picked from commit 485d0790ac1a29a0d4e7391d804810d485890376)

* MacOS prior to 10.12 does not support random API correctly

Fixes #16517

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16587)

* Clarify what SSL_get_session() does on the server side in TLSv1.3

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)

* Correct the documentation for SSL_set_num_tickets()

The behaviour for what happens in a resumption connection was not quite
described correctly.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16582)

(cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)

* ssl: Correct filename in README

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16671)

* Add sm2 encryption test case from GM/T 0003.5-2012

Reviewed-by: Nicola Tuveri <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16511)

(cherry picked from commit 8ba65c35ea3af347c3b2adc8e665066b541a1c35)

* doc/man3/SSL_set_fd.pod: add note about Windows compiler warning

According to an old stackoverflow thread [1], citing an even older comment by
Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05),
a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although
the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2),
in practice the socket() implementation on Windows returns an index into the kernel
handle table, the size of which is limited to 2^24 [3].

Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow.

[1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64
[2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2
[3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16699)

(cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)

* Fix a NPD bug in engines/e_dasync.c

The dasync_aes_128_cbc_hmac_sha1 cipher depends on
EVP_aes_128_cbc_hmac_sha1() returning a NON-NULL value.
We should simply not advertise this cipher otherwise.

Fixes: #7950

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16722)

* Fix a memory leak in the afalg engine

Fixes: #16743

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16744)

(cherry picked from commit 6f6a5e0c7c41b6b3639e51f435cd98bb3ae061bc)

* Fix some possible memory leaks in EVP_CipherInit_ex

An EVP_CONTEXT with zero cipher but non-zero engine,
and/or cipher_data is possible if an error happens
in EVP_CTRL_INIT or in EVP_CTRL_COPY, the error handling
will just clear the cipher in that case.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16756)

* Fix double-free in e_dasync.c

When the cipher is copied, the inner_cihper_data
need to be copied as well, using the EVP_CTRL_COPY method.
The EVP_CIPH_CUSTOM_COPY bit needs to be set as well.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16751)

* Bindhost/bindport should be freed

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16775)

(cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)

* New extensions can be sent in a certificate request

Normally we expect a client to send new  extensions in the ClientHello,
which may be echoed back by the server in subsequent messages. However the
server can also send a new extension in the certificate request message to
be echoed back in a certificate message

Fixes #16632

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)

* Extend custom extension testing

Test the scenario where we add a custom extension to a cetificate
request and expect a response in the client's certificate message.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16634)

(cherry picked from commit 0db3a9904fa00569905be130854a31dab7b8f49d)

* Fix test/recipes/01-test_symbol_presence.t to allow for stripped libraries

It's a small change to the 'nm' call, to have it look at dynamic symbols
rather than the normal ones.

Fixes #16810

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16822)

(cherry picked from commit a85b4de6a6cbe03c46219d4b1c3b2828ca3fd51c)

* Fix test/recipes/01-test_symbol_presence.t to disregard version info

The output of 'nm -DPg' contains version info attached to the symbols,
which makes the test fail.  Simply dropping the version info makes the
test work again.

Fixes #16810 (followup)

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16840)

(cherry picked from commit 73970cb91fdf8e7b4b434d479b875a47a0aa0dbc)

* test/ssl_old_test.c: Fix potential leak

Reviewed-by: Kurt Roeckx <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16806)

(cherry picked from commit 34563be5368fb8e6ade7d06d8376522ba83cd6ac)

* Ensure pkey_set_type handles ENGINE references correctly

pkey_set_type should not consume the ENGINE references that may be
passed to it.

Fixes #16757

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Add tests for ENGINE problems

Add some tests which would have caught the issues fixed in the previous
commit related to engine handling.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16860)

* Fix some documentation errors related to return values

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16794)

(cherry picked from commit f1d077f1108b1bc2334350a4d53a46e29e082910)

* Fix BIO_get_md_ctx return value check

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16792)

* Fix the s_server psk_server_cb for use in DTLS

Commit 0007ff257c added a protocol version check to psk_server_cb but
failed to take account of DTLS causing DTLS based psk connections to
fail.

Fixes #16707

Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16838)

(cherry picked from commit 8b09a9c76d873f62c2507fa9628a9c96c1d66d5c)

* Fix no-cmac

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16894)

(cherry picked from commit ef2fb64f9dfde1965cb0b8a5f8765c4f467c1604)

* Fix a gcc 11.2.0 warning

gcc 11.2.0 is the default on Ubuntu 21.10. It emits a (spurious) warning
when compiling test/packettest.c, which causes --strict-warnings builds
to fail. A simple fix avoids the warning.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16887)

(cherry picked from commit 37467b2752f75ce80437120f704452982b7c1998)

* speed: range check the argument given to -multi for 1.1.1

Fixes #16899 for 1.1.1 branch.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16922)

* check the return value of BN_new() and BN_dup()

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16948)

(cherry picked from commit d99004fe5de934120765d342586f08d22131b8ed)

* Fix a memory leak in tls_parse_stoc_key_share

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16957)

* Fix a memory leak in ssl_create_cipher_list

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16955)

* Fix: invoking x509_name_cannon improperly

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16974)

(cherry picked from commit 09235289c377ff998964bb6b074bb2a3ad768fd2)

* Reset the rwstate before calling ASYNC_start_job()

If an async job pauses while processing a TLS connection then the
rwstate gets set to SSL_ASYNC_PAUSED. When resuming the job we should
reset the rwstate back to SSL_NOTHING. In fact we can do this
unconditionally since if we're about to call ASYNC_start_job() then either
we are about to start the async job for the first time (in which case the
rwstate should already by SSL_NOTHING), or we are restarting it after a
pause (in which case reseting it to SSL_NOTHING is the correct action).

Fixes #16809

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17013)

(cherry picked from commit 07f620e3acf0dd76a3a03ada9911c544aa483aa7)

* free the Post-Handshake Auth digest when there is an error saving the digest

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16924)

* evp: fix EVP_PKEY_get0_EC_KEY when EC_KEY is SM2

EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2) will change pkey->type to EVP_PKEY_SM2

CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17015)

* Avoid loading of a dynamic engine twice

Use the address of the bind function as a DYNAMIC_ID,
since the true name of the engine is not known
before the bind function returns,
but invoking the bind function before the engine
is unloaded results in memory corruption.

Fixes #17023

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17073)

(cherry picked from commit e2571e02d2b0cd83ed1c79d384fe941f27e603c0)

* ERR: Add a missing common reason string

There was no string present for ERR_R_PASSED_INVALID_ARGUMENT

Reviewed-by: David von Oheimb <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17069)

* Add a test case for duplicate engine loading

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17083)

* DOC: Add a few previously documented functions

d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp()
were documented in OpenSSL 1.0.2.  In a grand unification of the
documentation of (almost) all d2i and i2d functions, these were
dropped, most likely by mistake.

This simply adds them back.

Fixes #17091

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17093)

* Fix detection of ARMv7 and ARM64 CPU features on FreeBSD

OpenSSL assumes AT_HWCAP = 16 (as on Linux), but on FreeBSD AT_HWCAP = 25
Switch to using AT_HWCAP, and setting it to 16 if it is not defined.

OpenSSL calls elf_auxv_info() with AT_CANARY which returns ENOENT
resulting in all ARM acceleration features being disabled.

CLA: trivial

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17082)

(cherry picked from commit c1dabe26e3e96cdce0ffc929e9677840ad089ba5)

* Clarify and correct the EVP_CTRL_AEAD_SET_TAG docs

The restriction about setting a tag length prior to setting the IV only
applies to OCB mode. We clarify when in the process EVP_CTRL_AEAD_SET_TAG
can be called.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17111)

(cherry picked from commit 3607b8ad8ee1980a079e985333a196e0c79f8f00)

* doc: fix macro name

OSSL_STORE_INFO_X509 doesn't exist.  It should be OSSL_STORE_INFO_CERT.

Fixes #17121

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17125)

(cherry picked from commit 01fde90eec721b64bc0e1c01cd94a9fd431adcc6)

* BIO_push.pod: fix confusing text and add details on corner cases

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17086)

(cherry picked from commit 7a37fd09a8f3607ed8acf55e03479861595be069)

* Fix speed, use OPENSSL_free instead of free

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17132)

* TEST: Enable and fix test_bn2padded() in test/bntest.c

This looks like old code, written when the padded variety of BN_bn2bin()
was developped, and disabled by default...  and forgotten.

A few simple changes to update it to the current API is all that was
needed to enable it.

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17133)

(cherry picked from commit 23750f677ef61b6bea4e81f23f335ad08fc49b51)

* No EtM for GOST ciphers

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17158)

* Fix ssl_free() and thus BIO_free() to respect BIO_NOCLOSE

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* BIO_f_ssl.pod: Make clear where an SSL BIOs are expected as an argument

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17135)

* Fix documentation for tlsext_ticket_key

The tlsext_ticket_key functions are documented as returning 0 on success.
In fact they return 1 on success.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17210)

(cherry picked from commit b0be101326f369f0dd547556d2f3eb3ef5ed0e33)

* OBJ_nid2obj.pod: Replace remaining 'B<' by 'I<' were appropriate

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17221)

* Fix a deadlock in OBJ_NAME_add

This happened after an out of memory error:
CRYPTO_THREAD_write_lock may hang in OBJ_NAME_add.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17236)

* CI: Replace windows-2016 with windows-2022

Windows 2016 environment is going to be discontinued.

We also replace windows-latest with windows-2019 so
there aren't two identical builds done once windows-latest
is switched to mean windows-2022.

Fixes #17177

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17211)

* Fix faulty detail in BN_rand() manual

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17131)

* Fix a carry overflow bug in bn_sqr_comba4/8 for mips 32-bit targets

bn_sqr_comba8 does for instance compute a wrong result for the value:
a=0x4aaac919 62056c84 fba7334e 1a6be678 022181ba fd3aa878 899b2346 ee210f45

The correct result is:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3d 97ed17d4 7950b465 3cb32899

but the actual result was:
r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f
    912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3c 97ed17d4 7950b465 3cb32899

so the forth word of the result was 0x75be8e3c but should have been
0x75be8e3d instead.

Likewise bn_sqr_comba4 has an identical bug for the same value as well:
a=0x022181ba fd3aa878 899b2346 ee210f45

correct result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3d 97ed17d4 7950b465 3cb32899

wrong result:
r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3c 97ed17d4 7950b465 3cb32899

Fortunately the bn_mul_comba4/8 code paths are not affected.

Also the mips64 target does in fact not handle the carry propagation
correctly.

Example:
a=0x4aaac91900000000 62056c8400000000 fba7334e00000000 1a6be67800000000
    022181ba00000000 fd3aa87800000000 899b234635dad283 ee210f4500000001

correct result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f9 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

wrong result:
r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1
    0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d
    3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06
    2822309cd1d292f8 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17258)

(cherry picked from commit 336923c0c8d705cb8af5216b29a205662db0d590)

* Add some CHANGES entries for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17269)

* Update copyright year

Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17271)

* Update NEWS for 1.1.1m

Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17273)

* Prepare for 1.1.1m release

Reviewed-by: Richard Levitte <[email protected]>

* Prepare for 1.1.1n-dev

Reviewed-by: Richard Levitte <[email protected]>

* Fix the null pointer dereference

Fixed #17296

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17302)

* Fix Configure variable spill

* Evaluating code-refs in Configure can sometimes set the default
variable `$_`
* Prevent spillage influencing the target property by using named
variable in loop

CLA: trivial

Fixes gh-17321

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17322)

(cherry picked from commit a595e3286ae9f033c56452967b3add2145f9085f)

* document additional stack push error code

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17351)

* Ensure s_client sends SNI data when used with -proxy

The use of -proxy prevented s_client from correctly sending the target
hostname as SNI data.

Fixes #17232

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17249)

* Add support for BSD-riscv64 target

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>

(cherry picked from commit c2d1ad0e048dd3bfa60e6aa0b5ee343cc6d97a15)
(cherry picked from commit fb72a093f88f7332069659994b67f6b19aceb865)

(Merged from https://github.com/openssl/openssl/pull/17341)

* OBJ_obj2txt(): fix off-by-one documentation of the result

This backports the doc improvements of #17188.

Reviewed-by: Tomas Mraz <[email protected]>

(cherry picked from commit e36d10925396b6519e1abd338e1ef62cd5b1c9e6)

* Update troublesome copyright years of auto-generated files to 2022

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17401)

* apps/passwd.c: free before error exiting

use goto instead of returning directly while error handling

Signed-off-by: Peiwei Hu <[email protected]>

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17404)

(cherry picked from commit ea4d16bc60dee53feb71997c1e78379eeb69b7ac)

* close_console: Always unlock as the lock is always held

Fixes #17364

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17395)

* Fix password_callback to handle short passwords

Fixes #17426

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17439)

* Remove unsafe call to OPENSSL_cpuid_setup

This function is inherently thread-unsafe,
and moreover it is unnecessary here, because
OPENSSL_init_crypto always calls it in a thread-safe way.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17468)

* Fix a leak in EVP_DigestInit_ex()

If an EVP_MD_CTX is reused then memory allocated and stored in md_data
can be leaked unless the EVP_MD's cleanup function is called.

Fixes #17149

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* Add a test for a custom digest created via EVP_MD_meth_new()

We check that the init and cleanup functions for the custom method are
called as expected.

Based on an original reproducer by Dmitry Belyavsky from issue #17149.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17472)

* lhash: Avoid 32 bit right shift of a 32 bit value

Fixes #17583

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17589)

(cherry picked from commit 2ce0a3d19005271e7e3c351b562d9da93e2d4c80)

* Ensure X509_STORE_CTX_purpose_inherit handles a 0 default purpose

The function X509_STORE_CTX_purpose_inherit() can be called with a 0
default purpose. If the main purpose was set to X509_PURPOSE_ANY this
would case the function to incorrectly return an error response.

Fixes #17367

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Add a test for X509_STORE_CTX_set_purpose()

This function was previously incorrectly failing if it is called with
X509_PURPOSE_ANY. Add a test to catch this.

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Document purpose and trust setting functions

In particular:
X509_STORE_CTX_set_purpose()
X509_STORE_CTX_set_trust();
X509_STORE_CTX_purpose_inherit();

Reviewed-by: Shane Lontis <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17604)

* Fix builds with DJGPP

CLA: trivial

To get the master branch compiled with DJGPP some minor
adjustments are required. They will have no impact on any other ports.
The DJGPP port uses the Watt-32 library to provide the required network
functionality and some of its headers need to be included.

Neither DJGPP nor the Watt-32 library provide in_addr_t thus it must be
provided as it is done for OPENSSL_SYS_WINDOWS in crypto/bio/b_addr.c.

In the DJGPP section of include/internal/sockets.h the following Watt-32
headers must be added:

  -  arpa/inet.h: to provide declaration of inet_ntoa required in crypto/bio/b_addr.c
  -  netinet/tcp.h: to provide defintion of TCP_NODELAY required in crypto/bio/b_sock2.c

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17623)

(cherry picked from commit b9b211fcb6b9068ef1d8729a4971fbe693fd2cde)

* Don't link test/ec_internal_test with libapps.a

It's not at all necessary, and on some platforms, it's disruptive
(leads to unresolved symbols because of object files that get included
in the link that depend on libssl).

Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17637)

* Correct return type for BIO_ptr_ctrl

Fixes #17549
CLA: trivial

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17636)

(cherry picked from commit 984cc9a0284ee4800862aa305f9f178827baf459)

* scrypt: increase memory usage beyond limit

This brings these tests in line with 3.0 and master and makes them
fail correctly.

Fixes #17612

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17619)

* Prevent crash with engine using different openssl runtime

This problem happens usually because an application
links libcrypto and/or libssl statically which
installs an atexit handler, but later an engine using
a shared instance of libcrypto is installed.
The problem is in simple words that both instances
of libcrypto have an atexit handler installed,
but both are unable to coordinate with each other,
which causes a crash, typically a use-after-free
in the engine's destroy function.

Work around that by preventing the engine's
libcrypto to install the atexit handler.
This may result in a small memory leak, but that
memory is still reachable.

Fixes #15898

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* Check for presence of 3.x openssl runtime

if the newly loaded engine contains the symbol
EVP_PKEY_get_base_id, we know it is linked to 3.x openssl.
Abort loading this engine, as it will definitely crash.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17541)

* crypto/x509/v3_utl.c: Add missing check for OPENSSL_strndup

Since the potential failure of memory allocation, it
should be better to check the return value of the
OPENSSL_strndup(), like x509v3_add_len_value().
And following the comment of 'if (astrlen < 0)',
return -1 if fails.

Signed-off-by: Jiasheng Jiang <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17737)

(cherry picked from commit 366a16263959c0b6599f0b9ec18124d75560c6ef)

* Improve documentation of BIO_FLAGS_BASE64_NO_NL flag.

Fixes #12491.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17744)

(cherry picked from commit 8bfb7506d210841f2ee4eda8afe96441a0e33fa5)

* Fix NULL pointer dereference for BN_mod_exp2_mont

This fixes a bug whereby BN_mod_exp2_mont can dereference a NULL pointer
if BIGNUM argument m represents zero.

Regression test added. Fixes #17648. Backport from master to 1.1.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17787)

* VMS: move copy_argc to its own module and make it an aux source

copy_argv was never initialization code.

Make it self-cleaning too.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17746)

* [ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias

`SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already
marked as aliases of each other in the headers.
This commit, for each pair, replaces the leftover uses of the latter
synonym with the first one, which is considered more common.

(manually cherry picked from commit 66914fc024cfe0fec00dc0f2c7bd8a7957da5ec4)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* [ssl] Add SSL_kDHEPSK and SSL_kECDHEPSK as PFS ciphersuites for SECLEVEL >= 3

Fixes #17743

(manually cherry picked from commit b139a95665eb023b38695d62d9dfc28f3fb89972)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* [ssl] Add tests for Perfect Forward Secrecy criteria on SECLEVEL >= 3

(manually cherry picked from commit d71151ae704847f4ac3f4a5f394ea64f1d229815)

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17791)

* Document bug in openssl cms -binary

Documents a bug in openssl cms -binary for 1.1 whereby it cannot process
input using LF line endings correctly. Binary input processing was
reworked substantially for 3.0 and backporting these changes doesn't
appear reasonable.

Fixes #17797.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17810)

* Avoid potential memory leak

Resolves #17827

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17828)

(cherry picked from commit 175355923046921a689b500f7a72455f7095708f)

* Set protocol in init_client()

If TCP is being used, protocol = 0 is passed to init_client(), then
protocol == IPPROTO_TCP fails when attempting to set BIO_SOCK_NODELAY.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17838)

(cherry picked from commit 54b6755702309487ea860e1cc3e60ccef4cf7878)

* Fix issue where OBJ_nid2obj doesn't always raise an error

This was previously fixed in 3.0 but not 1.1.

Fixes #13008.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17808)

* DOC: TLS compression is disabled by default

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matthias St. Pierre <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17854)

(cherry picked from commit 2cb52118ddd1d82d7b6028372238eaa2467bbd48)

* Fix OPENSSL_ENGINES in Configurations/descrip.mms.tmpl

Make its value an absolute path.

This was already fixed in all other build file templates, but for some
reason, not here.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17865)

* Make ossltest engine use in test/recipes/20-test_dgst.t platform agnostic

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17861)

(cherry picked from commit abdb2278d2b65ae87bee3121be83322e4219b396)

* Fix possible infinite loop in BN_mod_sqrt()

The calculation in some cases does not finish for non-prime p.

This fixes CVE-2022-0778.

Based on patch by David Benjamin <[email protected]>.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Add documentation of BN_mod_sqrt()

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Add a negative testcase for BN_mod_sqrt

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Update CHANGES/NEWS for new release

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Update copyright year

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Prepare for 1.1.1n release

Reviewed-by: Tomas Mraz <[email protected]>

* Prepare for 1.1.1o-dev

Reviewed-by: Tomas Mraz <[email protected]>

* Check password length only when verify is enabled.

Fixes #16231.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17899)

* eng_dyn: Avoid spurious errors when checking for 3.x engine

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17902)

* print SSL session, fix build warnings on OpenBSD.

time_t is a 64 bits type on this platform.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17917)

(cherry picked from commit 9362638b080e328ccab43f89048bed27bcf2f11d)

* Fix coverity 1498607: uninitialised value

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17897)

(cherry picked from commit 70cd9a51911e9a4e2f24e29ddd84fa9fcb778b63)

* Fix Coverity 1498611 & 1498608: uninitialised read

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17893)

(cherry picked from commit 09134f183f76539aa1294adfef10fcc694e90267)

* Fix Coverity 1201763 uninitialised pointer read

Reviewed-by: Shane Lontis <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17890)

(cherry picked from commit a0238b7ed87998c48b1c92bad7fa82dcbba507f9)

* Fix integer overflow in evp_EncryptDecryptUpdate

Fixes #17871.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17872)

* Fix Coverity 1498612: integer overflow

The assert added cannot ever fail because (current & 0xFFFF) != 0 from the
while loop and the trailing zero bit count therefore cannot be as large as 32.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17892)

(cherry picked from commit 81487b65b9eb8148471e729b8c1959521d62c69e)

* s390x: Hide internal cpuid symbol and function

The symbol OPENSSL_s390xcap_P and the OPENSSL_cpuid_setup function are not
exported by the version script of OpenSSL.  However, if someone uses the
static library without the version script, these symbols all of a sudden
become global symbols and their usage in assembler code does not correctly
reflect that for PIC.  Since these symbols should never be used outside of
OpenSSL, hide them inside the binary.

Signed-off-by: Juergen Christ <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17946)

(cherry picked from commit 37816ef5757e458be9648481e56bf698ee3bfbb1)

* ticket_lifetime_hint may exceed 1 week in TLSv1.3

For TLSv1.3, limit ticket lifetime hint to 1 week per RFC8446

Fixes #17948

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17952)

(cherry picked from commit 0089cc7f9d42f6e39872161199fb8b6a99da2492)

* Fix: ticket_lifetime_hint may exceed 1 week in TLSv1.3

libctx was left in cherry-pick from master/3.0 cherry-pick

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17970)

* tls_process_server_hello: Disallow repeated HRR

Repeated HRR must be rejected.

Fixes #17934

Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17936)

(cherry picked from commit d204a50b898435fbf937316d5693008cebf62eef)

* Test processing of a duplicated HRR

Reviewed-by: Todd Short <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17936)

(cherry picked from commit db44b55aaa42141921217183667800425227b658)

* Fix usage of SSLfatal

A cherry-pick from the master branch incorrectly introduced a usage of
3 argument SSLfatal. In 1.1.1 the function code is also required.

Fixes #17999

Reviewed-by: Bernd Edlinger <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18000)

* Fix failure to check result of bn_rshift_fixed_top

Fixes #18010.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18034)

(cherry picked from commit bc6bac8561ead83d6135f376ffcbbb0b657e64fe)

* err: fix crash in ERR_load_strings() when configured with no-err

This commit removes the entire initialization and cleanup of the
error string hash table (`int_error_hash`) if `no-err` is configured.
The only operative function remaining is `ERR_get_next_error_library()`.
That is the reason why the `err_string_lock` and hence the
`do_err_strings_init()` function can't be removed entirely.

Fixes #17971

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17975)

* err: fix indentation of preprocessor directive

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17975)

* err: get rid of err_free_strings_int()

Even though the function is not part of the public api, it is not
entirely removed, in order to minimize the chance of breakage,
because it is exported from libcrypto. Instead, we keep a dummy
implementation.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17975)

* Fix -no-tls1_2 in tests

This is specific for OpenSSL_1_1_1-stable branch

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bernd Edlinger <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18080)

* Fix a DTLS server hangup due to TLS13_AD_MISSING_EXTENSION

This causes the DTLS server to enter an error state:

./openssl s_server -dtls
./openssl s_client -dtls -maxfraglen 512 -sess_out s1.txt
[...]
Q
./openssl s_client -dtls -sess_in s1.txt
CONNECTED(00000003)
^C
./openssl s_client -dtls
CONNECTED(00000003)
140335537067840:error:14102410:SSL routines:dtls1_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_d1.c:614:SSL alert number 40

At this point the dtls server needs to be restarted,
because verify_cookie_callback always fails, because
the previous cookie is checked against the current one.
The reason for this is not fully understood.

In wireshark we see the following each time:
c->s Client Hello (without cookie)
s->c Hello Verify Request (with new cookie)
s->c Alert (Level: Fatal, Description: Handshake Failure)
c->s Client Hello (echoes new cookie)

The client gives up when the Alert arrives.
The Alert is triggered because the server calls
verify_cookie_callback with the previous cookie,
although it just sent the current cookie in the
Hello Verify Request.

However this does only happen because no Alert message
is sent when the client re-connects the session with
the missing -maxfraglen option.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18094)

* Fix an assertion in the DTLS server code

This fixes an internal error alert from the server and
an unexpected connection failure in the release version,
but a failed assertion and a server crash in the
debug version.

Reproduce this issue with a DTLS server/client like that:

./openssl s_server -dtls -mtu 1500
./openssl s_client -dtls -maxfraglen 512

In the debug version a crash happens in the Server now:

./openssl s_server -dtls -mtu 1500
Using default temp DH parameters
ACCEPT
ssl/statem/statem_dtls.c:269: OpenSSL internal error: Assertion failed: len == written
Aborted (core dumped)

While in the release version the handshake exceeds the
negotiated max fragment size, and fails because of this:

$ ./openssl s_server -dtls -mtu 1500
Using default temp DH parameters
ACCEPT
ERROR
4057152ADA7F0000:error:0A0000C2:SSL routines:do_dtls1_write:exceeds max fragment size:ssl/record/rec_layer_d1.c:826:
shutting down SSL
CONNECTION CLOSED

From the client's point of view the connection fails
with an Internal Error Alert:

$ ./openssl s_client -dtls -maxfraglen 512
Connecting to ::1
CONNECTED(00000003)
40B76343377F0000:error:0A000438:SSL routines:dtls1_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_d1.c:613:SSL alert number 80

and now the connection attempt fails unexpectedly.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18093)

(cherry picked from commit e915c3f5381cd38ebdc1824c3ba9896ea7160103)

* x509: use actual issuer name if a CA is used

Fixes openssl#16080.

Reviewed-by: Ben Kaduk <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18129)

* Revert "[github-ci][ci.yml] Disable pyca external tests"

This reverts commit 850ed18505631286abbd23d355d4b48f28ad89a9.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16340)

* [github-ci] Sync pyca workflow with master

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16340)

* add wycheproof submodule

This is used with the pyca/cryptography test suite

(cherry picked from commit a09fb26ba90e46c4f731b5a597051b4d4b9aea3e)

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16340)

* c_rehash: Do not use shell to invoke openssl

Except on VMS where it is safe.

This fixes CVE-2022-1292.

Reviewed-by: Matthias St. Pierre <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>

* Add additional keys to release key fingerprints

Added keys for Paul Dale and Tomáš Mráz.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18156)

* Update CHANGES and NEWS for new release

Reviewed-by: Tomas Mraz <[email protected]>
Release: yes

* Update copyright year

Reviewed-by: Tomas Mraz <[email protected]>
Release: yes

* Prepare for 1.1.1o release

Reviewed-by: Tomas Mraz <[email protected]>
Release: yes

* Prepare for 1.1.1p-dev

Reviewed-by: Tomas Mraz <[email protected]>
Release: yes

* (1.1) Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions

Backport of #18038 to 1.1.

Fixes #18035.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18190)

* 1_1_1-stable: Detect arm64-*-*bsd and enable assembly optimizations

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/17085)

* Do not send an empty supported groups extension

This allows handshake to proceed if the maximum TLS version enabled is <1.3

Fixes #13583

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18213)

* Add test for empty supported-groups extension

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18213)

* Fix leakage when the cacheline is 32-bytes in CBC_MAC_ROTATE_IN_PLACE

rotated_mac is a 64-byte aligned buffer of size 64 and rotate_offset is secret.
Consider a weaker leakage model(CL) where only cacheline base address is leaked,
i.e address/32 for 32-byte cacheline(CL32).

Previous code used to perform two loads
    1. rotated_mac[rotate_offset ^ 32] and
    2. rotated_mac[rotate_offset++]
which would leak 2q + 1, 2q for 0 <= rotate_offset < 32
and 2q, 2q + 1 for 32 <= rotate_offset < 64

The proposed fix performs load operations which will always leak 2q, 2q + 1 and
selects the appropriate value in constant-time.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18050)

* s_serve: Report an error if init-connection fails without an attempt to read.

Fixes: openssl#18047.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18283)

* Backport some fuzzing data files from master

This is a backport of the following commit from master:

commit 415e6ac80405e13b20b083315747e431274fbd33
Author: Tavis Ormandy <[email protected]>
Date:   Tue Sep 21 15:48:27 2021 -0700

    increase x509 code coverage metrics

    Reviewed-by: Matt Caswell <[email protected]>
    Reviewed-by: Tomas Mraz <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/16651)

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18347)

* Backport a missing bug-fix from master

This is a backport of the following commit from master:

commit 61b0fead5e6079ca826594df5b9ca00e65883cb0
Author: Matt Caswell <[email protected]>
Date:   Thu Nov 19 13:58:21 2020 +0000

    Don't Overflow when printing Thawte Strong Extranet Version

    When printing human readable info on the Thawte Strong Extranet extension
    the version number could overflow if the version number == LONG_MAX. This
    is undefined behaviour.

    Issue found by OSSFuzz.

    Reviewed-by: Ben Kaduk <[email protected]>
    (Merged from https://github.com/openssl/openssl/pull/13452)

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18347)

* Fix a crash in asn1_item_embed_new

This happens usually if an template object is created
and there is an out of memory error before the ASN1_OP_NEW_POST
method is called, but asn1_item_embed_free calls now the
ASN1_OP_FREE_POST which may crash because the object is not
properly initialized.  Apparently that is only an issue with
the ASN1_OP_FREE_POST handling of crypot/x509/x_crl.c, which
ought to be tolerant to incomplete initialized objects.

The error can be reproduced with the reproducible error injection patch:

$ ERROR_INJECT=1652890550 ../util/shlib_wrap.sh ./asn1-test ./corpora/asn1/0ff17293911f54d1538b9896563a4048d67d9ee4
    #0 0x7faae9dbeeba in __sanitizer_print_stack_trace ../../../../gcc-trunk/libsanitizer/asan/asan_stack.cpp:87
    #1 0x408dc4 in my_malloc fuzz/test-corpus.c:114
    #2 0x7faae99f2430 in CRYPTO_zalloc crypto/mem.c:230
    #3 0x7faae97f09e5 in ASN1_STRING_type_new crypto/asn1/asn1_lib.c:341
    #4 0x7faae98118f7 in asn1_primitive_new crypto/asn1/tasn_new.c:318
    #5 0x7faae9812401 in asn1_item_embed_new crypto/asn1/tasn_new.c:78
    #6 0x7faae9812401 in asn1_template_new crypto/asn1/tasn_new.c:240
    #7 0x7faae9812315 in asn1_item_embed_new crypto/asn1/tasn_new.c:137
    #8 0x7faae9812315 in asn1_template_new crypto/asn1/tasn_new.c:240
    #9 0x7faae9812a54 in asn1_item_embed_new crypto/asn1/tasn_new.c:137
    #10 0x7faae9812a54 in ASN1_item_ex_new crypto/asn1/tasn_new.c:39
    #11 0x7faae980be51 in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:325
    #12 0x7faae980c813 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:611
    #13 0x7faae980d288 in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:518
    #14 0x7faae980b9ce in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:382
    #15 0x7faae980caf5 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:643
    #16 0x7faae980d7d3 in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:494
    #17 0x7faae980b9ce in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:382
    #18 0x7faae980dd1f in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:124
    #19 0x7faae980de35 in ASN1_item_d2i crypto/asn1/tasn_dec.c:114
    #20 0x40712c in FuzzerTestOneInput fuzz/asn1.c:301
    #21 0x40893b in testfile fuzz/test-corpus.c:182
    #22 0x406b86 in main fuzz/test-corpus.c:226
    #23 0x7faae8eb1f44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1194==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7faae9b0625f bp 0x7fffffe41a00 sp 0x7fffffe41920 T0)
==1194==The signal is caused by a READ memory access.
==1194==Hint: address points to the zero page.
    #0 0x7faae9b0625f in crl_cb crypto/x509/x_crl.c:258
    #1 0x7faae9811255 in asn1_item_embed_free crypto/asn1/tasn_fre.c:113
    #2 0x7faae9812a65 in asn1_item_embed_new crypto/asn1/tasn_new.c:150
    #3 0x7faae9812a65 in ASN1_item_ex_new crypto/asn1/tasn_new.c:39
    #4 0x7faae980be51 in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:325
    #5 0x7faae980c813 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:611
    #6 0x7faae980d288 in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:518
    #7 0x7faae980b9ce in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:382
    #8 0x7faae980caf5 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:643
    #9 0x7faae980d7d3 in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:494
    #10 0x7faae980b9ce in asn1_item_embed_d2i crypto/asn1/tasn_dec.c:382
    #11 0x7faae980dd1f in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:124
    #12 0x7faae980de35 in ASN1_item_d2i crypto/asn1/tasn_dec.c:114
    #13 0x40712c in FuzzerTestOneInput fuzz/asn1.c:301
    #14 0x40893b in testfile fuzz/test-corpus.c:182
    #15 0x406b86 in main fuzz/test-corpus.c:226
    #16 0x7faae8eb1f44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV crypto/x509/x_crl.c:258 in crl_cb
==1194==ABORTING

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/18360)

(cherry picked from commit 557825acd622f98fc21423aba092e374db84f483)

* Fix a memory leak in ec_key_simple_oct2priv

This is reproducible with my error injection patch:

$ ERROR_INJECT=1652710284 ../util/shlib_wrap.sh ./server-test ./corpora/server/4e48da8aecce6b9b58e8e4dbbf0523e6d2dd56dc
140587884632000:error:03078041:bignum routines:bn_expand_internal:malloc failure:crypto/bn/bn_lib.c:282:
140587884632000:error:10103003:elliptic curve routines:ec_key_simple_oct2priv:BN lib:crypto/ec/ec_key.c:662:
140587884632000:error:100DE08E:elliptic curve routines:old_ec_priv_decode:decode error:crypto/ec/ec_ameth.c:464:
140587884632000:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1149:
140587884632000:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:crypto/asn1/tasn_dec.c:309:Type=X509_ALGOR
140587884632000:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:crypto/asn1/tasn_dec.c:646:Field=pkeyalg, Type=PKCS8_PRIV_KEY_INFO
140587884632000:error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib:crypto/pem/pem_pkey.c:88:

=================================================================
==19676==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x7fdd2a6bb09f in __interceptor_malloc ../../../../gcc-trunk/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7fdd2a2fa430 in CRYPTO_zalloc crypto/mem.c:230
    #2 0x7fdd2a15df11 in BN_new crypto/bn/bn_lib.c:246
    #3 0x7fdd2a15df88 in BN_secure_new crypto/bn/bn_lib.c:257
    #4 0x7fdd2a247390 in ec_key_simple_oct2priv crypto/ec/ec_key.c:655
    #5 0x7fdd2a241fc5 in d2i_ECPrivateKey crypto/ec/ec_asn1.c:1030
    #6 0x7fdd2a23dac5 in old_ec_priv_decode crypto/ec/ec_ameth.c:463
    #7 0x7fdd2a109db7 i…

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to openssl#12312

(cherry picked from commit 7aa3dfc)

Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#12457)