openssl/ssl, branch feature/engineremoval

Remove ssl_evp_md_fetch()

2025-12-04T12:32:18Z

Signed-off-by: Norbert Pocs Reviewed-by: Paul Yang Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29183)

Refactor ssl_evp_cipher_fetch()

2025-12-04T12:32:18Z

Signed-off-by: Norbert Pocs Reviewed-by: Paul Yang Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29183)

Clear ssl dir from engines

2025-12-04T12:32:18Z

Signed-off-by: Norbert Pocs Reviewed-by: Paul Yang Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29183)

ssl/: Remove ENGINEs

2025-12-04T12:31:06Z

Signed-off-by: Norbert Pocs Reviewed-by: Matt Caswell Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28384)

RECORD_LAYER_clear(): Remove redundant BIO_free(rl->rrlnext)

2025-12-03T16:40:06Z

Fixes #29283 CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29289)

tls_process_cert_status_body(): Reject invalid cert status

2025-12-03T16:23:45Z

When a CertStatus message is received and the length of the OCSP response is zero error out. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29207)

dtls_get_reassembled_message(): Fix potential use-after-realloc

2025-12-03T14:28:43Z

Fortunately due to the initial size of the allocated buffer and the limit for unfragmented DTLS record size the use-after-realloc cannot be triggered. But we fix the potentially problematic code anyway. Reported Joshua Rogers. It was found with the ZeroPath security tooling. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/29278)

CONF: Add support for configurations per OSSL_LIB_CTX

2025-12-03T13:15:51Z

Add support for configurations per OSSL_LIB_CTX and fix cross-context overrides. Fixes #19248 Fixes #19243 Co-authored-by: Matt Caswell Reviewed-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29145)

Fix change of behavior of the single stapled OCSP response API

2025-12-01T10:42:02Z

Fixes #28888 Fixes b1b4b154 Instead of transferring the ownership of the single OCSP response to the SSL object, the multi-stapling PR modified the semantics of SSL_set_tlsext_status_ocsp_resp() to copying semantics. This change reverts the behavior to the previous one. Partially based on fix by Remi Gacogne: https://github.com/openssl/openssl/pull/28894 Reviewed-by: Matt Caswell Reviewed-by: Saša Nedvědický (Merged from https://github.com/openssl/openssl/pull/29251)

Do not make key share choice in tls1_set_groups()

2025-11-28T16:31:53Z

tls1_set_groups(), which is used by SSL_CTX_set1_groups() does not check whether the NIDs passed as argument actually have an implementation available in any of the currently loaded providers. It is not simple to add this check, either, because it would require access to the SSL_CTX, which this function does not receive. There are legacy callers that do not have an SSL_CTX pointer and are public API. This becomes a problem, when an application sets the first group to one that is not supported by the current configuration, and can trigger sending of an empty key share. Set the first entry of the key share list to 0 (and the key share list length to 1) to signal to tls1_construct_ctos_key_share that it should pick the first supported group and generate a key share for that. See also tls1_get_requested_keyshare_groups, which documents this special case. See: https://issues.redhat.com/browse/RHEL-128018 Signed-off-by: Clemens Lang Reviewed-by: Norbert Pocs Reviewed-by: Simo Sorce Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29192)