openssl, branch openssl-3.3.3

Prepare for release of 3.3.3

2025-02-11T14:33:36Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Release: yes

make update

2025-02-11T14:33:35Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Release: yes

Copyright year updates

2025-02-11T14:32:03Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Release: yes

Update CHANGES and NEWS for security release

2025-02-11T13:45:34Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (cherry picked from commit cf9d6685fda656c07fab8527750284f4446a7372)

Use ERR marks also when verifying server X.509 certs

2025-02-11T13:42:08Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (cherry picked from commit 739c4b2e92116952e4baf3e14d219b82f871ec6a)

With SSL_VERIFY_PEER client RPK should abort on X509 error

2025-02-11T13:42:00Z

While RPK performs X.509 checks correctly, at the SSL layer the SSL_VERIFY_PEER flag was not honoured and connections were allowed to complete even when the server was not verified. The client can of course determine this by calling SSL_get_verify_result(), but some may not know to do this. Added tests to make sure this does not regress. Fixes CVE-2024-12797 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (cherry picked from commit 6ae8e947d8e3f3f03eeb7d9ad993e341791900bc)

Fix compile error when building VC-WIN64-CLANGASM-ARM target

2025-02-06T16:30:38Z

With MSVC v143, C++ Clang Compiler for Windows (18.1.8) there are many errors similar to: crypto\aes\libcrypto-lib-aesv8-armx.obj.asm:3795:7: error: unknown token in expression ld1 {v2.16b},[x0],#16 CLA: trivial Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26603) (cherry picked from commit becc0078f8215ffc062f5ba06c73ba51d3b14b6e)

backport make-release.yml workflow to openssl-3.x branches

2025-02-06T16:20:38Z

Reviewed-by: Tim Hudson Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26541) (cherry picked from commit 39cd63bdc9b584536019c07e39b2043a14378ffe)

80-test_cmp_http.t: on test failures also print failed client invocations

2025-02-03T07:39:13Z

Reviewed-by: Bernd Edlinger Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26589) (cherry picked from commit b1775ba4c9eff94df2a6395e2430749f7a7b259d)

80-test_cmp_http.t: on test failures print Mock server STDERR output

2025-02-03T07:39:11Z

Reviewed-by: Bernd Edlinger Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26589) (cherry picked from commit e7c6c5e0885b797c67a363802072fd1df2c54558)