openssl/include, branch openssl-3.3.2

Copyright year updates

2024-09-03T12:44:27Z

Reviewed-by: Neil Horman Release: yes

Fix '--strict-warnings' build breakage

2024-08-21T13:41:24Z

... due to a missing const. Reviewed-by: Tom Cosgrove Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25111)

riscv: Fix cpuid_obj asm checks for sm4/sm3

2024-07-12T10:10:26Z

Similar to #22881 / #23752 Reviewed-by: Tomas Mraz Reviewed-by: Paul Yang (Merged from https://github.com/openssl/openssl/pull/24486) (cherry picked from commit 6cf42ad392241c9fee586d99b53d9bfa74130b0b)

Make rcu_thread_key context-aware

2024-06-20T14:54:40Z

Currently, rcu has a global bit of data, the CRYPTO_THREAD_LOCAL object to store per thread data. This works in some cases, but fails in FIPS, becuase it contains its own copy of the global key. So 1) Make the rcu_thr_key a per-context variable, and force ossl_rcu_lock_new to be context aware 2) Store a pointer to the context in the lock object 3) Use the context to get the global thread key on read/write lock 4) Use ossl_thread_start_init to properly register a cleanup on thread exit 5) Fix up missed calls to OSSL_thread_stop() in our tests (cherry picked from commit 24d16d3a1915a06a2130385a87de9a37fc09c4b9) Fixes #24581 Reviewed-by: Paul Dale Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24630)

Fix handling of max_fragment_length extension for PSK

2024-06-20T14:51:39Z

A psk session was assumed to be a resumption which failed a check when parsing the max_fragment_length extension hello from the client. Relevant code from PR#18130 which was a suggested fix to the issue was cherry-picked. Fixes #18121 Reviewed-by: Matt Caswell Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24513) (cherry picked from commit fa495604516a610d988f02298c8d97a6ac4777bb)

enable AES-XTS optimization for AIX

2024-06-05T08:14:25Z

Reviewed-by: Todd Short Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24518) (cherry picked from commit dda1635cbff44d8d1b41a08e53c936ccb6c41acd)

Copyright year updates

2024-06-04T12:50:58Z

Reviewed-by: Neil Horman Release: yes

uefi: add typedef for uintptr_t

2024-05-30T16:38:38Z

Signed-off-by: Gerd Hoffmann Reviewed-by: Matt Caswell Reviewed-by: Todd Short Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24459) (cherry picked from commit 7b33501a74ec2db4e54ddcd751dd42ded32bfd5b)

Add reason codes with the correct offset for two alerts

2024-05-14T13:27:42Z

Fixes #24300. The current values of SSL_R_NO_APPLICATION_PROTOCOL and SSL_R_PSK_IDENTITY_NOT_FOUND don't allow for a correct lookup of the corresponding reason strings. CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24351) (cherry picked from commit a401aaf9ed6eb34842cdedfcc35448bdc4174df3)

Rename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top()

2024-05-02T07:23:07Z

And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top. We do this to avoid leaking fixed top numbers via the public API. Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top() and make it LE/BE agnostic. Reviewed-by: Paul Dale Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 9c85f6cd2d6debe5ef6ef475ff4bf17e0985f7a2)