Prepare for release of 3.2 alpha 2


Reviewed-by: Richard Levitte <levitte@openssl.org>
Release: yes

make update


Reviewed-by: Richard Levitte <levitte@openssl.org>
Release: yes

Copyright year updates


Reviewed-by: Richard Levitte <levitte@openssl.org>
Release: yes

Fix no-ssl-trace

Ensure we use OPENSSL_NO_SSL_TRACE guards where appropriate.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged

Fix no-ssl-trace

Ensure we use OPENSSL_NO_SSL_TRACE guards where appropriate.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22193)

show more ...

Move e_os2.h up in quictestlib.c to allow symbol definition consistency.

Fixes: #22178

Signed-of-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Paul Dale

Move e_os2.h up in quictestlib.c to allow symbol definition consistency.

Fixes: #22178

Signed-of-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22179)

show more ...

Fix a mem leak when the FIPS provider is used in a different thread

We were neglecting to register the main thread to receive thread stop
notifications. This is important if the thread t

Fix a mem leak when the FIPS provider is used in a different thread

We were neglecting to register the main thread to receive thread stop
notifications. This is important if the thread that starts the FIPS
provider is not the same one that is used when OPENSSL_cleanup() is
called.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

show more ...

evp_test: recondition cipher dupctx FIPS version check.

Until the cipher dupctx is properly implemented in 3.1 and 3.0 the check is
wrong. This should be reverted once the implemenation

evp_test: recondition cipher dupctx FIPS version check.

Until the cipher dupctx is properly implemented in 3.1 and 3.0 the check is
wrong. This should be reverted once the implemenation has been done.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

show more ...

fips: use seed source requested

Fixes #21909

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl

fips: use seed source requested

Fixes #21909

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

show more ...

rand: add extra error code

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

fips selftest: avoid relying on a real RNG for self tests

Rather than instantiate the private and primary DRBGs during the
selftest, instead use a test RNG. This leaves the DRBG setup

fips selftest: avoid relying on a real RNG for self tests

Rather than instantiate the private and primary DRBGs during the
selftest, instead use a test RNG. This leaves the DRBG setup
pristine and permits later replacement of the seed source despite
the very early running power up self tests.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

show more ...

Provider cross version checks warning

Add a warning note to the provider cross version checks indicating that a
pull request branch will not be used if execution is set to on pull reques

Provider cross version checks warning

Add a warning note to the provider cross version checks indicating that a
pull request branch will not be used if execution is set to on pull request.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

show more ...

fix indentation

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

remove redundant free of NULL

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21964)

Support all NULL-syntax X.509v3 extensions

Signed-off-by: Jonathan M. Wilbur <jonathan@wilbur.space>

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@op

Support all NULL-syntax X.509v3 extensions

Signed-off-by: Jonathan M. Wilbur <jonathan@wilbur.space>

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21342)

show more ...

Add a test for BIO_ADDR_copy()

We also add a test for BIO_ADDR_dup() which was also added in 3.2

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl

Add a test for BIO_ADDR_copy()

We also add a test for BIO_ADDR_dup() which was also added in 3.2

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22164)

show more ...

Clean away the test code implementation of bio_addr_copy

We now have a public function for BIO_ADDR_copy() which can be used in
preference to the test code's private implementation.

Clean away the test code implementation of bio_addr_copy

We now have a public function for BIO_ADDR_copy() which can be used in
preference to the test code's private implementation.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22164)

show more ...

Add documentation for the BIO_ADDR_copy() function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>

Add documentation for the BIO_ADDR_copy() function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22164)

show more ...

Implement a public BIO_ADDR_copy() function

We already have BIO_ADDR_dup() but in some contexts that is not sufficent.
We implement BIO_ADDR_copy() and make BIO_ADDR_dup() use it.

Implement a public BIO_ADDR_copy() function

We already have BIO_ADDR_dup() but in some contexts that is not sufficent.
We implement BIO_ADDR_copy() and make BIO_ADDR_dup() use it.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22164)

show more ...

Remove a spurious inclusion of the sparse array header file

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pau

Remove a spurious inclusion of the sparse array header file

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22174)

show more ...

adding -outpubkey option to genpkey

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pul

adding -outpubkey option to genpkey

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22173)

show more ...

no-engine: fix signing with legacy app method based keys

Signing with an app method based key (i.e. an `EVP_PKEY` which wraps an
`RSA` key with an application defined `RSA_METHOD`) used

no-engine: fix signing with legacy app method based keys

Signing with an app method based key (i.e. an `EVP_PKEY` which wraps an
`RSA` key with an application defined `RSA_METHOD`) used to work in 1.1.1.
That feature was broken in commit 60488d2434, but later on fixed by @t8m
in commit b247113c05 (see #14859).

This commit corrects a minor flaw of the fix, which affects only
`no-engine` builds: the special treatment for foreign keys is guarded
by an `OPENSSL_NO_ENGINE` check.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/22163)

show more ...

Do not include sparse_array.o in libssl

sparse_array.o is not needed in libssl at 3.0.x version.

Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com>

Reviewed-by: Matt Caswell <m

Do not include sparse_array.o in libssl

sparse_array.o is not needed in libssl at 3.0.x version.

Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22111)

(cherry picked from commit a31cd07af1ca34cdbbd2b077a933208d447ed0b2)

show more ...

Clarify the terminology in the noisy dgram BIO

The previous terminology was quite confusing. We try to use drop, duplicate
and delay more consistently and introduce the "reinject" termin

Clarify the terminology in the noisy dgram BIO

The previous terminology was quite confusing. We try to use drop, duplicate
and delay more consistently and introduce the "reinject" terminology as a
mechanism for implementing duplicates and delays.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22157)

show more ...

Ensure we free all the BIOs in a chain for QUIC like we do in TLS

An application may pass in a whole BIO chain via SSL_set_bio(). When we
free the BIO we should be using BIO_free_all() n

Ensure we free all the BIOs in a chain for QUIC like we do in TLS

An application may pass in a whole BIO chain via SSL_set_bio(). When we
free the BIO we should be using BIO_free_all() not BIO_free() like we do
with TLS.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22157)

show more ...

Ensure we up-ref the sbio before passing it to tserver

We are actually passing two references to sbio: one as part of a BIO chain
and one stand alone. Therefore we need two references.

Ensure we up-ref the sbio before passing it to tserver

We are actually passing two references to sbio: one as part of a BIO chain
and one stand alone. Therefore we need two references.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22157)

show more ...