openssl/include, branch openssl-3.0.3

Update copyright year

2022-05-03T12:36:42Z

Reviewed-by: Tomas Mraz Release: yes

Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions

2022-04-27T09:18:10Z

Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18038) (cherry picked from commit 948cf521798a801cfde47a137343e6f958d71f04)

Public API functions OPENSSL_str[n]casecmp

2022-04-21T15:12:31Z

Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18103)

Add error code for unsupported explicit parameters

2022-04-14T06:52:05Z

Reviewed-by: Nicola Tuveri Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit 53137462f42f8673fbd5b0831f8ea051ddea509f)

Redefine macro X509_http_nbio to avoid using ocsp.h

2022-04-05T07:21:14Z

The functions used from ocsp.h are actually just aliases for functions from http.h. Use them directly to avoid including ocsp.h. Fixes openssl#17148 Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/17980) (cherry picked from commit f593f32eede30ead69e0a16e47a564a664171283)

Update copyright year

2022-03-15T13:52:58Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell

EVP_MD performance fix (refcount cache contention)

2022-03-15T09:59:43Z

Partial fix for #17064. Avoid excessive writes to the cache line containing the refcount for an EVP_MD object to avoid extreme cache contention when using a single EVP_MD at high frequency on multiple threads. This changes performance in 3.0 from being double that of 1.1 to only slightly higher than that of 1.1. Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/17857) (cherry picked from commit c0b7dac66edde45b8da80918f5b5b62d1e766a0c)

Replace handling of negative verification result with SSL_set_retry_verify()

2022-03-14T08:42:54Z

Provide a different mechanism to indicate that the application wants to retry the verification. The negative result of the callback function now indicates an error again. Instead the SSL_set_retry_verify() can be called from the callback to indicate that the handshake should be suspended. Fixes #17568 Reviewed-by: David von Oheimb Reviewed-by: Viktor Dukhovni Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/17825) (cherry picked from commit dfb39f73132edf56daaad189e6791d1bdb57c4db)

Change `strlen' argument name to `strlength' to avoid c++ reserved words.

2022-02-28T05:27:23Z

Fixes #17753 Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/17764) (cherry picked from commit 28e141c45d36757e052b72685fb874968f013d43)

Prevent crash with engine using different openssl runtime

2022-02-08T12:28:24Z

This problem happens usually because an application links libcrypto and/or libssl statically which installs an atexit handler, but later an engine using a shared instance of libcrypto is installed. The problem is in simple words that both instances of libcrypto have an atexit handler installed, but both are unable to coordinate with each other, which causes a crash, typically a use-after-free in the engine's destroy function. Work around that by preventing the engine's libcrypto to install the atexit handler. This may result in a small memory leak, but that memory is still reachable. Fixes #15898 Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/17112) (cherry picked from commit 9362a1b32b7330e24d3bca230b412557caea095b)