openssl/apps, branch openssl-3.3.1

Copyright year updates

2024-06-04T12:50:58Z

Reviewed-by: Neil Horman Release: yes

apps/pkcs12: Not writing the private key file until the import password is verified

2024-05-14T13:37:30Z

Fixes #904 CLA: trivial Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23729) (cherry picked from commit f5462572a1873482ce38646cbf00dfc483f02068)

Remove all references to FLOSS for NonStop Builds.

2024-04-24T07:35:54Z

FLOSS is no longer a dependency for NonStop as of the deprecation of the SPT thread model builds. Fixes: #24214 Signed-off-by: Randall S. Becker Reviewed-by: Tom Cosgrove Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24217) (cherry picked from commit 0339382abad578ccb3989799ea2fb99dfb2d099b)

fix sending error when no root CA cert update available

2024-04-22T06:31:46Z

Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24169) (cherry picked from commit fc9649f61a8ac5f980da6807214fcbbbae1c45aa)

list_provider_info(): Fix leak on error

2024-04-15T07:10:56Z

Fixes #24110 Reviewed-by: Tom Cosgrove Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/24117) (cherry picked from commit 993c2407d04956ffdf9b32cf0a7e4938ace816dc)

APPS: Add missing OPENSSL_free() and combine the error handler

2024-04-09T18:37:02Z

Add the OPENSSL_free() in the error handler to release the "*md_value" allocated by app_malloc(). To make the code clear and avoid possible future errors, combine the error handler in the "err" tag. Then, we only need to use "goto err" instead of releasing the memory separately. Since the EVP_MD_get_size() may return negative numbers when an error occurs, create_query() may fail to catch the error since it only considers 0 as an error code. Therefore, unifying the error codes of create_digest() from non-positive numbers to 0 is better, which also benefits future programming. Fixes: c7235be ("RFC 3161 compliant time stamp request creation, response generation and response verification.") Signed-off-by: Jiasheng Jiang Reviewed-by: Neil Horman Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/23873) (cherry picked from commit beb82177ddcd4b536544ceec92bb53f4d85d8e91)

Fix "Error finalizing cipher loop" when running openssl speed -evp -decrypt

2024-04-09T18:28:04Z

When using CCM, openssl speed uses the loop function EVP_Update_loop_ccm() which sets a (fake) tag when decrypting. When using -aead (which benchmarks a different sequence than normal, to be comparable to TLS operation), the loop function EVP_Update_loop_aead() is used, which also sets a tag when decrypting. However, when using defaults, the loop function EVP_Update_loop() is used, which does not set a tag on decryption, leading to "Error finalizing cipher loop". To fix this, set a fake tag value if we're doing decryption on an AEAD cipher in EVP_Update_loop(). We don't check the return value: this shouldn't really be able to fail, and if it does, the following EVP_DecryptUpdate() is almost certain to fail, so that can catch it. The decryption is certain to fail (well, almost certain, but with a very low probability of success), but this is no worse than at present. This minimal change means that future benchmarking data should be comparable to previous benchmarking data. (This is benchmarking code: don't write real apps like this!) Fixes #23657 Change-Id: Id581cf30503c1eb766464e315b1f33914040dcf7 Reviewed-by: Paul Yang Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23757) (cherry picked from commit b3be6cc89e4dcfafe8f8be97e9519c26af2d19f5)

Copyright year updates

2024-04-09T12:09:20Z

Reviewed-by: Richard Levitte Release: yes

Diverse small VMS build fixups

2024-04-04T16:15:10Z

Reviewed-by: Tom Cosgrove Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24008)

Fix openssl req with -addext subjectAltName=dirName

2024-04-02T15:35:55Z

The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23669) (cherry picked from commit 387418893e45e588d1cbd4222549b5113437c9ab)