summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-15Fix unbounded memory growth when using no-cached-fetchMatt Caswell
When OpenSSL has been compiled with no-cached-fetch we do not cache algorithms fetched from a provider. When we export an EVP_PKEY to a provider we cache the details of that export in the operation cache for that EVP_PKEY. Amoung the details we cache is the EVP_KEYMGMT that we used for the export. When we come to reuse the key in the same provider that we have previously exported the key to, we check the operation cache for the cached key data. However because the EVP_KEYMGMT instance was not cached then instance will be different every time and we were not recognising that we had already exported the key to the provider. This causes us to re-export the key to the same provider everytime the key is used. Since this consumes memory we end up with unbounded memory growth. The fix is to be more intelligent about recognising that we have already exported key data to a given provider even if the EVP_KEYMGMT instance is different. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23841)
2024-03-15plug potential memory leak in error code pathAlexandr Nedvedicky
Function `module_add()` may leak stack of modules when it fails to initialize newly added module. Fixes #23835 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23836)
2024-03-15Add Content Type OID for id-ct-rpkiSignedPrefixListJob Snijders
References: draft-ietf-sidrops-rpki-prefixlist Title: "A profile for Signed Prefix Lists for Use in the Resource Public Key Infrastructure (RPKI)" OID assigned under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)' https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23426)
2024-03-12Limit the number of http headers when receiving the http responseAlexandr Nedvedicky
Change introduces a default limit on HTTP headers we expect to receive from server to 256. If limit is exceeded http client library indicates HTTP_R_RESPONSE_TOO_MANY_HDRLINES error. Application can use OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines() to change default. Setting limit to 0 implies no limit (current behavior). Fixes #22264 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23781)
2024-03-11PKCS7: Remove one of the duplicate checksJiasheng Jiang
There are two consecutive identical checks "if (i <= 0)". We can remove one of them to make the code clear. CLA: trivial Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23741)
2024-03-11Fix BIO_get_new_index() to return an error when it is exhausted.slontis
Fixes #23655 BIO_get_new_index() returns a range of 129..255. It is set to BIO_TYPE_START (128) initially and is incremented on each call. >= 256 is reserved for the class type flags (BIO_TYPE_DESCRIPTOR) so it should error if it reaches the upper bound. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23732)
2024-03-07Gate setting of ipi_spec_dst on not building for freebsdNeil Horman
some variants of FreeBSD (notably Dells OneFS) implement IP_PKTINFO partially, and as such the build breaks for those variants. specifically, it supports IP_PKTINFO, but the in_pktinfo struct has no defined ipi_spec_dst field. Work around this by gating the setting of that variable on not building for FreeBSD Fixes #23739 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23753)
2024-03-07Fix a memory leak on successful load of CRLDmitry Belyavskiy
Fixes #23693 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23695)
2024-03-06crypto/cmp: add OSSL_CMP_MSG_get0_certreq_publickey(); fix coding style nitDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp: add -reqout_only option for dumping/saving just the initial CMP ↵Dr. David von Oheimb
request message Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06cmperr.h: use free reason value 106 rather than 197 for CMP_R_UNEXPECTED_SENDERDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-01Fix off by one issue in buf2hexstr_sep()shridhar kalavagunta
Fixes #23363 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23404)
2024-02-25Add appropriate lower bound checks for GeneralizedTime and UTCTimeJob Snijders
ITU-T X.690 / ISO/IEC 8825-1 section 11.7 and section 11.8 impose specific constraints on how GeneralizedTime and UTCTime can be encoded in BER/CER/DER. Following from these constraints a minimum length can be derived. Checking the length in this context can potentially help prevent applications from interpreting an invalid GeneralizedTime as a valid UTCTime. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23483)
2024-02-22Apply the AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100Tom Cosgrove
Performance improvements range from 18% to 32%. Change-Id: Ifb89eeac3c0625a582a25ff07cf7f9c9ec8f5ba6 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23651)
2024-02-22chachap10-ppc.pl: Fix truncated relocation响马
Fix error: relocation truncated to fit: R_PPC64_REL14 (stub) against symbol `ChaCha20_ctr32_vsx_8x' CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23618)
2024-02-19OpenSSL License is applied for some source files, change to Apache 2Shakti Shah
The following files include/openssl/hpke.h crypto/hpke/hpke.c crypto/ec/asm/ecp_sm2p256-armv8.pl crypto/chacha/asm/chacha-loongarch64.pl still seem to be released under the OpenSSL License instead of the Apache 2 license. Fixes #23570 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23576)
2024-02-16Fixed Visual Studio 2008 compiler errorsMarcel Gosmann
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23586)
2024-02-16Check for NULL cleanup function before using it in encoder_processNeil Horman
encoder_process assumes a cleanup function has been set in the currently in-use encoder during processing, which can lead to segfaults if said function hasn't been set Add a NULL check for this condition, returning -1 if it is not set Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23069)
2024-02-14Fix the grammar as suggsted in the reviewDimitri Papadopoulos
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23545)
2024-02-14Fix new typos found by codespellDimitri Papadopoulos
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23545)
2024-02-10make updateHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23495)
2024-02-10QUIC: Add polling APIHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23495)
2024-02-09Rearrange terms in gf_mul to prevent segfaultAngel Baez
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23512)
2024-02-08Fix error code collisionHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23360)
2024-02-08QUIC: Add new error codes for tuning APIHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23360)
2024-02-08Fix sm4-xts aarch64 assembly implementation bugLiu-Ermeng
Tested on kunpeng920, to turn on 'VPSM4_EX_CAPABLE'. Signed-off-by: Liu-Ermeng <liuermeng2@huawei.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23317)
2024-02-06Fix SM2 test failures on Apple SiliconXu Yizhou
This patch is to fix #23368. Signed-off-by: Xu Yizhou <xuyizhou1@huawei.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23472)
2024-02-02Fix a few incorrect paths in some build.info filesRichard Levitte
The following files referred to ../liblegacy.a when they should have referred to ../../liblegacy.a. This cause the creation of a mysterious directory 'crypto/providers', and because of an increased strictness with regards to where directories are created, configuration failure on some platforms. Fixes #23436 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23452) (cherry picked from commit 667b45454a47959ce2934b74c899662e686993de)
2024-02-01Add atexit configuration option to using atexit() in libcrypto at build-time.Randall S. Becker
This fixes an issue with a mix of atexit() usage in DLL and statically linked libcrypto that came out in the test suite on NonStop, which has slightly different DLL unload processing semantics compared to Linux. The change allows a build configuration to select whether to register OPENSSL_cleanup() with atexit() or not, so avoid situations where atexit() registration causes SIGSEGV. INSTALL.md and CHANGES.md have been modified to include and describe this option. The no-atexit option has been added to .github/workflows/run-checker-daily.yml. Fixes: #23135 Signed-of-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23394)
2024-02-01Add exemplar use case for rcu locksNeil Horman
To demonstrate the use of RCU locks, convert CONF_MOD api to using rcu rather than RW locks Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22729)
2024-02-01RCU lock implementationNeil Horman
Introduce an RCU lock implementation as an alternative locking mechanism to openssl. The api is documented in the ossl_rcu.pod file Read side implementaiton is comparable to that of RWLOCKS: ossl_rcu_read_lock(lock); < critical section in which data can be accessed via ossl_derefrence > ossl_rcu_read_unlock(lock); Write side implementation is: ossl_rcu_write_lock(lock); < critical section in which data can be updated via ossl_assign_pointer and stale data can optionally be scheduled for removal via ossl_rcu_call > ossl_rcu_write_unlock(lock); ... ossl_synchronize_rcu(lock); ossl_rcu_call fixup Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22729)
2024-01-31Revert "Improved detection of engine-provided private "classic" keys"Tomas Mraz
This reverts commit 2b74e75331a27fc89cad9c8ea6a26c70019300b5. The commit was wrong. With 3.x versions the engines must be themselves responsible for creating their EVP_PKEYs in a way that they are treated as legacy - either by using the respective set1 calls or by setting non-default EVP_PKEY_METHOD. The workaround has caused more problems than it solved. Fixes #22945 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23063)
2024-01-31Fix error reporting in EVP_PKEY_{sign,verify,verify_recover}Richard Levitte
For some reason, those functions (and the _init functions too) would raise EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE when the passed ctx is NULL, and then not check if the provider supplied the function that would support these libcrypto functions. This corrects the situation, and has all those libcrypto functions raise ERR_R_PASS_NULL_PARAMETER if ctx is NULL, and then check for the corresponding provider supplied, and only when that one is missing, raise EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE. Because 0 doesn't mean error for EVP_PKEY_verify(), -1 is returned when ERR_R_PASSED_NULL_PARAMETER is raised. This is done consistently for all affected functions. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23411)
2024-01-31Optimize the implementation of ec_field_size()K1
No need to create and copy BIGNUM p, a and b, just call EC_GROUP_get0_field() instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/23313)
2024-01-25replace strstr() with strchr() for single charactersrilysh
strstr() is used to match multiple characters in the haystack, whereas strchr() is used to matched only single character. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23347)
2024-01-25Have OSSL_PARAM_allocate_from_text() fail on odd number of hex digitsRichard Levitte
The failure would be caught later on, so this went unnoticed, until someone tried with just one hex digit, which was simply ignored. Fixes #23373 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23374)
2024-01-25Add NULL checks where ContentInfo data can be NULLMatt Caswell
PKCS12 structures contain PKCS7 ContentInfo fields. These fields are optional and can be NULL even if the "type" is a valid value. OpenSSL was not properly accounting for this and a NULL dereference can occur causing a crash. CVE-2024-0727 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23361)
2024-01-25Add appropriate NULL checks in EVP_CIPHER apiNeil Horman
The EVP_CIPHER api currently assumes that calls made into several APIs have already initalized the cipher in a given context via a call to EVP_CipherInit[_ex[2]]. If that hasnt been done, instead of an error, the result is typically a SIGSEGV. Correct that by adding missing NULL checks in the apropriate apis prior to using ctx->cipher Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22995)
2024-01-23Fix typosJakub Wilk
CLA: trivial Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23345)
2024-01-23QUIC APL: Implement optimised FIN APIHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23343)
2024-01-18prevent integer overflow in ossl_asn1_time_from_tmPaul Dreik
this could be triggered by the following code (assuming 64 bit time_t): time_t t = 67768011791126057ULL; ASN1_TIME* at = ASN1_TIME_set(NULL, t); Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22976)
2024-01-17Fix reason value collision for CMP_R_UNEXPECTED_SENDERTomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23323)
2024-01-17Introduce hash thunking functions to do proper castingNeil Horman
ubsan on clang17 has started warning about the following undefined behavior: crypto/lhash/lhash.c:299:12: runtime error: call to function err_string_data_hash through pointer to incorrect function type 'unsigned long (*)(const void *)' [...]/crypto/err/err.c:184: note: err_string_data_hash defined here #0 0x7fa569e3a434 in getrn [...]/crypto/lhash/lhash.c:299:12 #1 0x7fa569e39a46 in OPENSSL_LH_insert [...]/crypto/lhash/lhash.c:119:10 #2 0x7fa569d866ee in err_load_strings [...]/crypto/err/err.c:280:15 [...] The issue occurs because, the generic hash functions (OPENSSL_LH_*) will occasionaly call back to the type specific registered functions for hash generation/comparison/free/etc, using functions of the (example) prototype: [return value] <hash|cmp|free> (void *, [void *], ...) While the functions implementing hash|cmp|free|etc are defined as [return value] <fnname> (TYPE *, [TYPE *], ...) The compiler, not knowing the type signature of the function pointed to by the implementation, performs no type conversion on the function arguments While the C language specification allows for pointers to data of one type to be converted to pointers of another type, it does not allow for pointers to functions with one signature to be called while pointing to functions of another signature. Compilers often allow this behavior, but strictly speaking it results in undefined behavior As such, ubsan warns us about this issue This is an potential fix for the issue, implemented using, in effect, thunking macros. For each hash type, an additional set of wrapper funtions is created (currently for compare and hash, but more will be added for free/doall/etc). The corresponding thunking macros for each type cases the actuall corresponding callback to a function pointer of the proper type, and then calls that with the parameters appropriately cast, avoiding the ubsan warning This approach is adventageous as it maintains a level of type safety, but comes at the cost of having to implement several additional functions per hash table type. Related to #22896 Reviewed-by: Sasa Nedvedicky <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23192)
2024-01-17cmp_vfy.c/check_msg_all_certs(): remove needless trace output in case 3GPP ↵Dr. David von Oheimb
mode is not enabled Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-17ossl_cmp_msg_check_update(): improve diagnostics of checking expected sender ↵Dr. David von Oheimb
name Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-17CMP app and doc: add -no_cache_extracerts option / ↵Dr. David von Oheimb
OSSL_CMP_OPT_NO_CACHE_EXTRACERTS Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-17Fix performance regression of ChaCha20 on LoongArch64Lin Runze
The regression was introduced in PR #22817. In that pull request, the input length check was moved forward, but the related ori instruction was missing, and it will cause input of any length down to the much slower scalar implementation. Fixes #23300 CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23301)
2024-01-16hurd: Fix dgram_sendmmsgSamuel Thibault
GNU/Hurd does not have IP_PKTINFO yet, thus SUPPORT_LOCAL_ADDR is undef, data->local_addr_enabled never set to 1, and thus the M_METHOD_RECVMSG method would end up raising BIO_R_LOCAL_ADDR_NOT_AVAILABLE immediately. Fixes #22872 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23293)
2024-01-16Check whether the pubkey exists in ossl_ecx_key_duplan1120
Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22984)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-22 12:32:10 +0000