INSTALL.md: Remove trailing space

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19960)

(cherry picked from commit 98663afce7a909be1518921a9995540308a52462)

Docs: Move deprecated ECDSA_ functions into a separate file.

Fixes #19829

Examples added for setting/getting ECDSA SIG related r and s values

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19936)

(cherry picked from commit c99209264de98da94937b073a42219bada9ff7f5)

Change HKDF to alloc the info buffer.

Fixes #19909

I have enforced a maximum bound still but it is much higher.
Note also that TLS13 still uses the 2048 buffer size.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19923)

(cherry picked from commit e8115bd1654d5cd7718109679b2047ca573083a8)

ec_kmgmt.c: check the return of BN_CTX_get() in time.

If x and y are all NULL, then it is unnecessary to do subsequent operations.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19905)

(cherry picked from commit 467b0492c1e597857b30b91ed72605387aa9825b)

INSTALL.md: Fix typo

CLA:trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19882)

(cherry picked from commit 0e4e03c8528ab54a5b125582afdf2cdadfb6c9bb)

Add Demos for DSA params/DSA keygen.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19853)

(cherry picked from commit de1164102083730298e4f53eb465c9324aa6a0c0)

Fix possible UB in init_info_strings

"openssl version -c" may create undefined behavior in the shift:

crypto/info.c:42:50: runtime error: left shift of 4275712515
by 32 places cannot be represented in type 'long long int'

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19668)

(cherry picked from commit ee17dcc7ffbd6621f82838c75792f19aa97bd5d7)

Add a CMS test for a bad encryption algorithm

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19919)

(cherry picked from commit 0c5fe6e4e740e7150ecb9f0a1954ef085f1fcf10)

Ensure ossl_cms_EncryptedContent_init_bio() reports an error on no OID

If the cipher being used in ossl_cms_EncryptedContent_init_bio() has no
associated OID then we should report an error rather than continuing on
regardless. Continuing on still ends up failing - but later on and with a
more cryptic error message.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19919)

(cherry picked from commit cc122995d1fa12fb8f93562e0aca4a62cd83fc5b)

Fix BIO_f_asn1() to properly report some errors

Some things that may go wrong in asn1_bio_write() are serious errors
that should be reported as -1, rather than 0 (which just means "we wrote
no data").

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19919)

(cherry picked from commit 903e96599b53639d6a72f9b05514f93136eaf03b)

Fix SMIME_crlf_copy() to properly report an error

If the BIO unexpectedly fails to flush then SMIME_crlf_copy() was not
correctly reporting the error. We modify it to properly propagate the
error condition.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19919)

(cherry picked from commit 6259cf34eab1abdcfde12b7b3892b4780844091b)

Fix BIO_f_cipher() flushing

If an error occurs during a flush on a BIO_f_cipher() then in some cases
we could get into an infinite loop. We add a check to make sure we are
making progress during flush and exit if not.

This issue was reported by Octavio Galland who also demonstrated an
infinite loop in CMS encryption as a result of this bug.

The security team has assessed this issue as not a CVE. This occurs on
*encryption* only which is typically processing trusted data. We are not
aware of a way to trigger this with untrusted data.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19919)

(cherry picked from commit 54b5aeb94c34cc78166dec7cf756c12ee858eb29)

Update pyca-cryptography submodule to 38.0.4

(cherry picked from commit d656efb9eb7692c0b1cba843d7787751e388cc8a)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19901)

Honor OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT as set and default to UNCOMPRESSED

Originally the code to im/export the EC pubkey was meant to be consumed
only by the im/export functions when crossing the provider boundary.
Having our providers exporting to a COMPRESSED format octet string made
sense to avoid memory waste, as it wasn't exposed outside the provider
API, and providers had all tools available to convert across the three
formats.

Later on, with #13139 deprecating the `EC_KEY_*` functions, more state
was added among the params imported/exported on an EC provider-native
key (including `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT`, although it
did not affect the format used to export `OSSL_PKEY_PARAM_PUB_KEY`).

Finally, in #14800, `EVP_PKEY_todata()` was introduced and prominently
exposed directly to users outside the provider API, and the choice of
COMPRESSED over UNCOMPRESSED as the default became less sensible in
light of usability, given the latter is more often needed by
applications and protocols.

This commit fixes it, by using `EC_KEY_get_conv_form()` to get the
point format from the internal state (an `EC_KEY` under the hood) of the
provider-side object, and using it on
`EVP_PKEY_export()`/`EVP_PKEY_todata()` to format
`OSSL_PKEY_PARAM_PUB_KEY`.
The default for an `EC_KEY` was already UNCOMPRESSED, and it is altered
if the user sets `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT` via
`EVP_PKEY_fromdata()`, `EVP_PKEY_set_params()`, or one of the
more specialized methods.

For symmetry, this commit also alters `ec_pkey_export_to()` in
`crypto/ec/ec_ameth.c`, part of the `EVP_PKEY_ASN1_METHOD` for legacy EC
keys: it exclusively used COMPRESSED format, and now it honors the
conversion format specified in the EC_KEY object being exported to a
provider when this function is called.

Expand documentation about `OSSL_PKEY_PARAM_PUB_KEY` and mention the
change in behavior for our providers.

Fixes #16595

(cherry picked from commit 926db476bc669fdcc4c4d2f1cb547060bdbfa153)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19901)

Fix a logic flaw in test_mod_exp_zero

Due to the logic flaw, possible test failures
in this test case might be ignored.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19929)

(cherry picked from commit 42061268ee8f9ae0555d522870740fc91b744f4f)

Raise the KMAC limits for key and custom size to 512 bytes

This is necessary to pass new ACVP tests and to
fix the CI failure in FIPS provider compat CI

Partial cherry pick of 211c47ca1b1ac129dcee59d383cae44e36532bb9

Original-author: Shane Lontis <shane.lontis@oracle.com>

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19937)

Update FIPS related build instructions.

This also links back to the new location that lists the cert and
security policy.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19617)

(cherry picked from commit e8241fb6fe4e73bb337c9068e5a2421948ee40ad)

Refine the documents of several APIs

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19816)

(cherry picked from commit dd1f28427b375931fda45180619c8f5971cd6bca)

Update HMAC() documentation.

Fixes #19782

Clarify that EVP_Q_MAC() can be used as an alternative that allows
setting of the libctx.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19855)

(cherry picked from commit d1ebd99397e18de367918c201c25c389f1f07005)

Fix FIPS Provider compat CI of 3.0 libcrypto with 3.2 FIPS provider

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19904)

Coverity: fix 272011 resource leak

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19900)

(cherry picked from commit a167e048a40151f9884014680c9a765ef79c3b44)

Fix openssl storeutl to allow serial + issuer

storeutl wants to enforce the use of issuer and serial together,
however the current code prevents to use them together and returns an
error if only one of them is specified.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19856)

(cherry picked from commit abdf35158e4398deedcf160c28bd07c7080edf47)

Make error reason for disallowed legacy sigalg more specific

The internal error reason is confusing and indicating an error
in OpenSSL and not a configuration problem.

Fixes #19867

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19875)

(cherry picked from commit 97b8db1af2f71059ecea986e4d12fc6a23699a74)

crypto/err: expand on error code generation

Signed-off-by: Čestmír Kalina <ckalina@redhat.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19823)

(cherry picked from commit 2ee2b74cc7b78d2fd3c15dab08adb76fee6249f9)

Run-checker merge CI: Memleak test does not work without ubsan

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19874)

(cherry picked from commit 1ca61aa56090356bbdbb16cf48916fbd9886c78d)

Revert "Run-checker merge CI: Replace no-shared with no-modules"

This reverts commit d5696547e46e9ea85fcb7581b9d49c58b7c24eeb.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19874)

(cherry picked from commit b71b9534c423eaae79378556337e466a7dec8e35)

unbuffer stdin before get passwd from stdin

commond LD_LIBRARY_PATH= openssl rsa -aes256 -passout stdin <<< "xxxxxx” will get pass(fun app_get_pass()) from stdin first, and then load key(fun load_key()). but it unbuffer stdin before load key, this will cause the load key to fail.

now unbuffer stdin before get pass, this will solve https://github.com/openssl/openssl/issues/19835

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19851)

(cherry picked from commit efec0f4611ee854f2b0b3da0c135e839bf8e7d04)

Obtain PSS salt length from provider

Rather than computing the PSS salt length again in core using
ossl_rsa_ctx_to_pss_string, which calls rsa_ctx_to_pss and computes the
salt length, obtain it from the provider using the
OSSL_SIGNATURE_PARAM_ALGORITHM_ID param to handle the case where the
interpretation of the magic constants in the provider differs from that
of OpenSSL core.

Add tests that verify that the rsa_pss_saltlen:max,
rsa_pss_saltlen:<integer> and rsa_pss_saltlen:digest options work and
put the computed digest length into the CMS_ContentInfo struct when
using CMS. Do not add a test for the salt length generated by a provider
when no specific rsa_pss_saltlen option is defined, since that number
could change between providers and provider versions, and we want to
preserve compatibility with older providers.

Signed-off-by: Clemens Lang <cllang@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(cherry picked from commit 5a3bbe1712435d577bbc5ec046906979e8471d8b)

(Merged from https://github.com/openssl/openssl/pull/19863)

Run-checker merge CI: Replace no-shared with no-modules

ASAN otherwise fails to detect memleaks.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19860)

(cherry picked from commit d5696547e46e9ea85fcb7581b9d49c58b7c24eeb)

Cross compiles CI: Disable stringop-overflow warning on s390x and m68k

These warnings trigger on false positives on these platforms
with recent compiler update.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19860)

(cherry picked from commit 8b63a305bf2db0e980cb76040fa66a17f781d6c7)

Fuzz checker CI: Use more generic include dir for fuzzer includes

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19860)

(cherry picked from commit aef6b82882750594b7f8e50ad734d9fe1d70f049)

Bump actions/setup-python from 4.3.0 to 4.3.1

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.3.0 to 4.3.1.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v4.3.0...v4.3.1)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19866)

(cherry picked from commit 7176c1af1077e1740f9d5e0dfc1028cf8a422792)

Fix `no-ec enable-ktls` build

The KTLS test uses a TLSv1.2 cipher that uses ECDHE

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19841)

(cherry picked from commit 2dded44a4911250acb989a535d2bad0bcf0ccc78)

test: add test case for deadlock reported in #19643

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19652)

(cherry picked from commit 61203c2c59df5d0022e316a4fe614e5d18907715)

x509: fix double locking problem

This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
redundant flag setting.

Fixes #19643

Fixes LOW CVE-2022-3996

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19652)

(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)

cmp_vfy_test.c: fix name OSSL_CMP_CTX_set0_trusted{,Store}

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19859)

OSSL_CMP_validate_msg(): make sure to reject protection type mismatch

Do not accept password-based if expected signature-based and no secret is available and
do not accept signature-based if expected password-based and no trust anchors available.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19729)

(cherry picked from commit fc93335760686ad7cf3633d457caf18b0ac83ea2)

Replace some boldened types with a corresponding man page link

The types OSSL_DISPATCH, OSSL_ITEM, OSSL_ALGORITHM, OSSL_PARAM,
OSSL_CALLBACK, and OSSL_PASSPHRASE_CALLBACK are described in their own
manual page, so we change every mention of them to links to those pages.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19842)

(cherry picked from commit 318a9dfa5f7bd1237d2697ad950697d241b8b49f)

Move the description of the core types into their own pages

This expands on some of the core type descriptions, and also makes it
easier to find the documentation for each type, at least on Unix, with
a simple call like "man OSSL_ALGORITHM".

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19842)

(cherry picked from commit 801e54d65ca5d87f3b003477f26597541b95b55b)

Better sorting of util/other.syms

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19842)

(cherry picked from commit 9dabb55da3463f651582db8ac9030afb5a718bd8)

Fix treatment of BUILD_METADATA

According to documentation [^1], the BUILD_METADATA from VERSION.dat should
be prefixed with a plus sign when used.  It is given this treatment in
Configure, but not in all other scripts that use VERSION.dat directly.
This change fixes that.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19815)

(cherry picked from commit 83a5bd80708adc6726deac390e405a7b50dec540)

Replace "a RSA" with "an RSA"

Fixes openssl#19771

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19787)

(cherry picked from commit a63fa5f711f1f97e623348656b42717d6904ee3e)
(cherry picked from commit f3e9308fe1b692c424feaa256fbecce958cef1f4)

Fix the check of BIO_set_write_buffer_size and BIO_set_read_buffer_size

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19819)

(cherry picked from commit 25d02f333b9a5531fa88db294f69a8347f275858)

Fix the check of EVP_PKEY_decrypt_init

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19819)

(cherry picked from commit b794476df71441a6d30740ab9fadcc0f6d18d3d6)

Fix the checks in rsautl_main

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19819)

(cherry picked from commit 4c3fadfe57b94f71fa83786726046b8833997c7c)

doc: fix EVP_SignInit.pod

Fixes GH #19786

Also simplify the CSPRNG must be seeded argument.

Since version 1.1.1, the CSPRNG is seeded automatically on first use,
so it's not the responsibility of the programmer anymore.  Still, he
needs to be aware that the seeding might fail.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19789)

(cherry picked from commit 328dc33365f8bd9c097bc95c3632467f690502a4)

Clarify the EVP_PKEY_decrypt manual page

Fixes #19790

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19792)

(cherry picked from commit 8f48a978e5cce483eadfd0df20e34480f205511c)

cmp_client_test.c: add tests for OSSL_CMP_CTX_get_status

This is a follow-up of #19205, adding test cases as requested.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19760)

(cherry picked from commit 6ea44d07a7d0acb4af9eab15d9b4a76227f55f4e)

doc: fix location of AES-SIV ciphers

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19776)

Fix occasional assertion failure when storing properties

Fixes #18631

The store lock does not prevent concurrent access to the
property cache, because there are multiple stores.

We drop the newly created entry and use the exisiting one
if there is one already.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19762)

(cherry picked from commit 92a25e24e6ec9735dea9ec645502cb075a5f8d24)

Drop incorrect skipping of some evp_test testcases with no-gost

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19739)

(cherry picked from commit d5e1fe9c04c7eb28e21070e3dfe0d2242504a9bc)

Add test for EVP_PKEY_Q_keygen

Test for #19736

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19761)

(cherry picked from commit 667a8501f0b6e5705fd611d5bb3ca24848b07154)

Fix typos in doc/man3/EVP_EncryptInit.pod

Fixes #19728

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19753)

(cherry picked from commit 0dbd3a81e46dd7ea9f7832307fdd0b2ac207a5bf)

When using PEM_read_bio_PrivateKey_ex() the public key is optional

Fixes #19498

However the private key part is not optional which was
mishandled by the legacy routine.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19505)

(cherry picked from commit adb408dc791e83f59f3a86bd90d8e804c814ac30)

add missing OSSL_CMP_CTX_reset_geninfo_ITAVs() function

Fixup for glitch while handling merge conflict in OSSL_CMP_CTX_new.pod

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19216)

(cherry picked from commit a2ede0396addd13f7fe9a629b450a14892152a83)

add missing OSSL_CMP_CTX_reset_geninfo_ITAVs() function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19216)

(cherry picked from commit a2ede0396addd13f7fe9a629b450a14892152a83)

OSSL_CMP_CTX_reinit(): fix missing reset of ctx->genm_ITAVs

Otherwise, further OSSL_CMP_exec_GENM_ses() calls will go wrong.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19216)

(cherry picked from commit 1c04866c671db4a6db0a1784399b351ea061bc16)

CMP: fix gen_new() in cmp_msg.c checking wrong ITAVs

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19216)

(cherry picked from commit 7e3034939b40ee15013bdba9ff6178de6bcc26d4)

Fix typo in openssl-x509.pod.in

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19746)

(cherry picked from commit 0b7ad5d928f9ee749cfc670ad08067a961217fea)

Add SM2 support for EVP_PKEY_Q_keygen

There is no reason preventing this API to support SM2,
which gives us a simple method to do SM2 key gen.

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19736)

(cherry picked from commit 3f32d29ad464591ed968a1e430111e1525280f4c)

CMP: fix handling of unset or missing failInfo PKI status information

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19205)

(cherry picked from commit cba0e2afd6a222aa041e05f8455e83c9e959d05b)

CMP: fix status held in OSSL_CMP_CTX, in particular for genp messages

On this occasion, replace magic constants by mnemonic ones; update doc

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19205)

(cherry picked from commit 19ddcc4cbb43464493a4b82332a1ab96da823451)

Fix coverity issues in X509v3_addr

CID 1516955 : Null pointer deref (REVERSE_INULL)
CID 1516954 : Null pointer deref (REVERSE_INULL)
CID 1516953 : RESOURCE_LEAK of child

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19700)

(cherry picked from commit 26cfa4cd85f6b26dd7a48c2ff06bfa4a2cea4764)

Add missing HISTORY sections for OpenSSL 3.0 related documents.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19690)

(cherry picked from commit 4741c80c0556653c74252ec91425dcb74066b2ec)

Add doc for EVP_ASYM_CIPHER-RSA and clean up OSSL_PROVIDER-FIPS.pod.

Removed fields from missingcrypto.txt that are no longer missing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19692)

(cherry picked from commit ad60cd522b4f717a69c690f68f1591371a048591)

evp_extra_test2: Test DH param checks with non-NULL libctx

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19656)

(cherry picked from commit 5e38e0acf4e1681ae32fa1b164adbc08719bd613)

DH_check[_params]() use libctx of the dh for prime checks

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19656)

(cherry picked from commit 7c639f0b8e97b8290b9f935e83d5e948614c5bf7)

ParseC.pm: gracefully handle DOS-style end-of-line in source files

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19686)

(cherry picked from commit c507db9678f50482df5f6c58e42572fe6fe3007c)

Add test to confirm IPAddressFamily_check_len catches invalid len

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19273)

(cherry picked from commit 7489ada9f3fd902c5bc3c58cc03a90de2800d0ab)

Catch incorrect IPAddressFamily lengths

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19273)

(cherry picked from commit 9351f675fab42abbc321f0994bff7e0b27cfbe57)

Drop explicit check for engines in opt_legacy_okay

The providers indication should always indicate that this is not a
legacy request.
This makes a check for engines redundant as the default return is that
legacy is ok if there are no explicit providers.

Fixes #19662

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19671)

(cherry picked from commit 2fea56832780248af2aba2e4433ece2d18428515)

Fix the check of EC_GROUP_check_named_curve

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19678)

(cherry picked from commit 3b6154ccaf3e64bcdfda4859f2b98ef21b08c5b2)

apps/speed.c: fix the wrong checks

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19678)

(cherry picked from commit 9dd009dd513276e602b6592bc337a8563a1a82a1)

Add documentation for CPUID bit #64+17

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19670)

(cherry picked from commit ec7689186f3ea5c1a4d1564089cd8df287dfcf3c)

Add test for EVP_PKEY_eq

This tests that the comparison work even if a provider can only return
a public key.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19648)

(cherry picked from commit e5202fbd461cb6c067874987998e91c6093e5267)

Update documentation for keymgmt export utils

Change function prototypes and explain how to use the selection
argument.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19648)

(cherry picked from commit 504427eb5f32108dd64ff7858012863fe47b369b)

Propagate selection all the way on key export

EVP_PKEY_eq() is used to check, among other things, if a certificate
public key corresponds to a private key. When the private key belongs to
a provider that does not allow to export private keys this currently
fails as the internal functions used to import/export keys ignored the
selection given (which specifies that only the public key needs to be
considered) and instead tries to export everything.

This patch allows to propagate the selection all the way down including
adding it in the cache so that a following operation actually looking
for other selection parameters does not mistakenly pick up an export
containing only partial information.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19648)

(cherry picked from commit 98642df4ba886818900ab7e6b23703544e6addd4)

apps/ocsp.c: Add missing test if make_ocsp_response failed

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19660)

(cherry picked from commit 93e1271eedfe3af0a1c1b14d26899d2c8bde98e9)

fipsinstall test: skip PCT DSA signature test for new providers

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19665)

test: add two comparision options to fips version test utility code

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19665)

Use the same encryption growth macro consistently

We had two different macros for calculating the potential growth due to
encryption. The macro we use for allocating the underlying buffer should be
the same one that we use for reserving bytes for encryption growth.

Also if we are adding the MAC independently of the cipher algorithm then
the encryption growth will not include that MAC so we should remove it
from the amount of bytes that we reserve for that growth. Otherwise we
might exceed our buffer size and the WPACKET_reserve operation will
fail.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19264)

(cherry picked from commit 3d004cefec5135a3b080dc898d7f7d5452ef309f)

apps/speed.c: add verifying if fdopen returns NULL

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19651)

(cherry picked from commit c9a542e41837ea65671dcd75c448d7113d34a4fd)

Resign test/certs/rootCA.pem to expire in 100 years

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19654)

(cherry picked from commit 43086b1bd48958ce95fadba8459ad88675da4fdf)

Update the validity period of ed25519 cerificates

Note: The private key is test/certs/root-ed25519.privkey.pem

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19654)

(cherry picked from commit 42f917432999b34ad8618ae03a5f199738a2b5ba)

Add test for generating safeprime DH parameters

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19635)

(cherry picked from commit 10119e7475bb198e13b1722b186303b8a7528dfe)

Use libctx when generating DH parameters

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19635)

(cherry picked from commit 990d280da95d3c955b86f38b01f5b95ea88d42bb)

pem: avoid segfault if PKEY is NULL in PEM_write_bio_PrivateKey

Make the code more robust and correctly handle EVP_PKEY set to NULL
instead of dereferencing null pointer.

Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19536)

(cherry picked from commit 373d90128042cb0409e347827d80b50a99d3965a)

pem: fix a memory leak in PEM_write_bio_PrivateKey_traditional

The copy of PKEY should be released on the error path.
Easily reproduced with "ED448" context.

Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19536)

(cherry picked from commit 608aca8ed2becccfe9c238846834ea2b162fc98b)

Limit size of modulus for BN_mod_exp_mont_consttime()

Otherwise the powerbufLen can overflow.

Issue reported by Jiayi Lin.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19632)

(cherry picked from commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8)

Release the drbg in the global default context before engines

Fixes #17995
Fixes #18578

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/19390)

Add a test case for the engine crash with AES-256-CTR

Implement the AES-256-CTR cipher in the dasync engine.

Use that to reproduce the reported problems with the
devcrypto engine in our normal test environment.

See #17995 and #17532 for details.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19390)

fips-label.yml: Fix the script after actions/github-script upgrade

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19636)

(cherry picked from commit ada6f0533d3299833b27e623ff1bfe3134e8e466)

Fix PACKET_equal test with BUF_LEN+1 on -Wstringop-overread

Either suppress the error, or better make smbuf longer.
Detected with -Werror.

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19528)

(cherry picked from commit 91b7520e2385a513ad879dfa8fe8e45466315a27)

Fix documentation for some i2d return values.

i2d_XXX_bio and i2d_XXX_fp return either 0 or 1.
Other i2d_XXX functions return the number of bytes or negative on error.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18427)

(cherry picked from commit 943051d0f9ce8dcb38707774a5757a5dc436704f)

Test that signatures using hash name commands work properly

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19606)

(cherry picked from commit e9e6827445528caf1d9d6647953fbe67a0c78716)

apps/dgst.c: Set digestname from argv[0] if it is a builtin hash name

Fixes #19589

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19606)

(cherry picked from commit 1e5780dbc79dab14c1ec1584313755fc2fd2cf55)

Check for private key existence before calling eddsa sign functions

Fixes #19524

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19525)

(cherry picked from commit f5a10d5cc19215ab22be55b4a2ee1e41bd38fb14)

crypto/sha/asm/sha512-ia64.pl: When checking assembler file names, ignore case

The use case is that uppercase .ASM extension may be used on some platforms,
and we were only testing for the lowercase extension.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19604)

(cherry picked from commit 119b7b5f2ad7efcf273f395e7633747f56ff3f95)

Configurations/*.tmpl: overhaul assembler make rules.

NOTE: Not Configurations/unix-Makefile.tmpl, as that was done 4 years
ago, in commit a23f03166e0ec49ac09b3671e7ab4ba4fa57d42a.

So far assembly modules were intended to be built as .pl->.S->.{asmext}
followed by .{asmext}->.o.  This posed a problem in build_all_generated
rule if it was executed on another computer, and also turned out to be
buggy, as .S was also translated to .{asmext} on Windows and VMS.
Both issues are fixed by changing the rule sequence to .pl->.S and then
.S->.s->.o, with the added benefit that the Windows and VMS build file
templates are more in sync with unix-Makefile.tmpl and slightly simpler.

Fixes #19594

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19598)

(cherry picked from commit b8d3cf0954737a9665e3b2bff25bc689a5114010)

Update GitHub actions as suggested by dependabot

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19581)

(cherry picked from commit ec33ed712665ca65cabcd87d446e5db79a64379e)