openssl, branch OpenSSL_1_1_1o

Prepare for 1.1.1o release

2022-05-03T13:41:15Z

Reviewed-by: Tomas Mraz Release: yes

Update copyright year

2022-05-03T12:38:37Z

Reviewed-by: Tomas Mraz Release: yes

Update CHANGES and NEWS for new release

2022-05-03T12:30:07Z

Reviewed-by: Tomas Mraz Release: yes

Add additional keys to release key fingerprints

2022-05-03T11:40:15Z

Added keys for Paul Dale and Tomáš Mráz. Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/18156)

c_rehash: Do not use shell to invoke openssl

2022-05-03T10:09:18Z

Except on VMS where it is safe. This fixes CVE-2022-1292. Reviewed-by: Matthias St. Pierre Reviewed-by: Matt Caswell

add wycheproof submodule

2022-04-28T11:26:26Z

This is used with the pyca/cryptography test suite (cherry picked from commit a09fb26ba90e46c4f731b5a597051b4d4b9aea3e) Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16340)

[github-ci] Sync pyca workflow with master

2022-04-28T11:26:26Z

Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16340)

Revert "[github-ci][ci.yml] Disable pyca external tests"

2022-04-26T09:42:41Z

This reverts commit 850ed18505631286abbd23d355d4b48f28ad89a9. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16340)

x509: use actual issuer name if a CA is used

2022-04-25T12:02:14Z

Fixes openssl#16080. Reviewed-by: Ben Kaduk Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18129)

Fix an assertion in the DTLS server code

2022-04-14T14:18:29Z

This fixes an internal error alert from the server and an unexpected connection failure in the release version, but a failed assertion and a server crash in the debug version. Reproduce this issue with a DTLS server/client like that: ./openssl s_server -dtls -mtu 1500 ./openssl s_client -dtls -maxfraglen 512 In the debug version a crash happens in the Server now: ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ssl/statem/statem_dtls.c:269: OpenSSL internal error: Assertion failed: len == written Aborted (core dumped) While in the release version the handshake exceeds the negotiated max fragment size, and fails because of this: $ ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ERROR 4057152ADA7F0000:error:0A0000C2:SSL routines:do_dtls1_write:exceeds max fragment size:ssl/record/rec_layer_d1.c:826: shutting down SSL CONNECTION CLOSED From the client's point of view the connection fails with an Internal Error Alert: $ ./openssl s_client -dtls -maxfraglen 512 Connecting to ::1 CONNECTED(00000003) 40B76343377F0000:error:0A000438:SSL routines:dtls1_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_d1.c:613:SSL alert number 80 and now the connection attempt fails unexpectedly. Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/18093) (cherry picked from commit e915c3f5381cd38ebdc1824c3ba9896ea7160103)