diff -Nru openssl-3.0.2/debian/changelog openssl-3.0.2/debian/changelog --- openssl-3.0.2/debian/changelog 2023-05-24 19:12:55.000000000 +0200 +++ openssl-3.0.2/debian/changelog 2023-09-30 16:34:05.000000000 +0200 @@ -1,3 +1,31 @@ +openssl (3.0.2-0ubuntu1.11) jammy; urgency=medium + + * Fix (upstream): blowfish {enc,de}cryption for OFB and CFB modes + (LP: #1990216) + - lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch + - lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch + WARNING: files encrypted using these modes will become unreadable unless + application developers specify the key size explicitely before setting + the key + * Fix (upstream): crash when using an engine for ciphers used by DRBG + (LP: #2023545) + - lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch + * Fix (upstream): do not ignore return values for S/MIME signature + (LP: #1994165) + - lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch + - lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch + * Perf (upstream): don't empty method stores and provider synchronization + records when flushing the query cache (LP: #2033422) + - lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch + - lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch + - lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch + - lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch + - lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch + - lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch + - lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch + + -- Adrien Nader Sat, 30 Sep 2023 16:34:05 +0200 + openssl (3.0.2-0ubuntu1.10) jammy-security; urgency=medium * SECURITY UPDATE: DoS in AES-XTS cipher decryption diff -Nru openssl-3.0.2/debian/patches/lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch openssl-3.0.2/debian/patches/lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch --- openssl-3.0.2/debian/patches/lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,68 @@ +From 1b8ef23e68b273bb5e59f60df62251153f24768d Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Fri, 20 May 2022 16:27:51 +0200 +Subject: [PATCH 1/2] Fix regression in default key length for Blowfish CFB and + OFB ciphers + +Fixes #18359 + +Reviewed-by: Matt Caswell +Reviewed-by: Richard Levitte +(Merged from https://github.com/openssl/openssl/pull/18362) + +(cherry picked from commit 7a9e93dda58118c0fb1bade8fe915306b845325b) +Origin: https://github.com/openssl/openssl/commit/1b8ef23e68b273bb5e59f60df62251153f24768d +Bug: https://github.com/openssl/openssl/issues/18359 +Applied-Upstream: 3.0.4 +--- + providers/implementations/ciphers/cipher_blowfish.c | 4 ++-- + providers/implementations/include/prov/implementations.h | 4 ++-- + providers/legacyprov.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/providers/implementations/ciphers/cipher_blowfish.c b/providers/implementations/ciphers/cipher_blowfish.c +index 9566f044a4..e3b08ddbe4 100644 +--- a/providers/implementations/ciphers/cipher_blowfish.c ++++ b/providers/implementations/ciphers/cipher_blowfish.c +@@ -55,6 +55,6 @@ IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, ecb, ECB, BF_FLAGS, 128, 64, 0, + /* bf_cbc_functions */ + IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, cbc, CBC, BF_FLAGS, 128, 64, 64, block) + /* bf_ofb_functions */ +-IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, ofb64, OFB, BF_FLAGS, 64, 8, 64, stream) ++IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, ofb64, OFB, BF_FLAGS, 128, 8, 64, stream) + /* bf_cfb_functions */ +-IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, cfb64, CFB, BF_FLAGS, 64, 8, 64, stream) ++IMPLEMENT_var_keylen_cipher(blowfish, BLOWFISH, cfb64, CFB, BF_FLAGS, 128, 8, 64, stream) +diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h +index 30e5e4cd77..e0122a97ac 100644 +--- a/providers/implementations/include/prov/implementations.h ++++ b/providers/implementations/include/prov/implementations.h +@@ -152,8 +152,8 @@ extern const OSSL_DISPATCH ossl_camellia128ctr_functions[]; + #ifndef OPENSSL_NO_BF + extern const OSSL_DISPATCH ossl_blowfish128ecb_functions[]; + extern const OSSL_DISPATCH ossl_blowfish128cbc_functions[]; +-extern const OSSL_DISPATCH ossl_blowfish64ofb64_functions[]; +-extern const OSSL_DISPATCH ossl_blowfish64cfb64_functions[]; ++extern const OSSL_DISPATCH ossl_blowfish128ofb64_functions[]; ++extern const OSSL_DISPATCH ossl_blowfish128cfb64_functions[]; + #endif /* OPENSSL_NO_BF */ + #ifndef OPENSSL_NO_IDEA + extern const OSSL_DISPATCH ossl_idea128ecb_functions[]; +diff --git a/providers/legacyprov.c b/providers/legacyprov.c +index a5999c5f8b..7db32d072b 100644 +--- a/providers/legacyprov.c ++++ b/providers/legacyprov.c +@@ -95,8 +95,8 @@ static const OSSL_ALGORITHM legacy_ciphers[] = { + #ifndef OPENSSL_NO_BF + ALG(PROV_NAMES_BF_ECB, ossl_blowfish128ecb_functions), + ALG(PROV_NAMES_BF_CBC, ossl_blowfish128cbc_functions), +- ALG(PROV_NAMES_BF_OFB, ossl_blowfish64ofb64_functions), +- ALG(PROV_NAMES_BF_CFB, ossl_blowfish64cfb64_functions), ++ ALG(PROV_NAMES_BF_OFB, ossl_blowfish128ofb64_functions), ++ ALG(PROV_NAMES_BF_CFB, ossl_blowfish128cfb64_functions), + #endif /* OPENSSL_NO_BF */ + #ifndef OPENSSL_NO_IDEA + ALG(PROV_NAMES_IDEA_ECB, ossl_idea128ecb_functions), +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch openssl-3.0.2/debian/patches/lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch --- openssl-3.0.2/debian/patches/lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,66 @@ +From 8a2b4ac740bcbb0678fc1e1cdbf625c010f84cc8 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Fri, 20 May 2022 16:31:33 +0200 +Subject: [PATCH 2/2] Test the default key length of the Blowfish ciphers + +Reviewed-by: Matt Caswell +Reviewed-by: Richard Levitte +(Merged from https://github.com/openssl/openssl/pull/18362) + +(cherry picked from commit 091e60c42c5d2a194936da7f4de3ce82527b27a3) +Origin: https://github.com/openssl/openssl/commit/8a2b4ac740bcbb0678fc1e1cdbf625c010f84cc8 +Bug: https://github.com/openssl/openssl/issues/18359 +Applied-Upstream: 3.0.4 +--- + test/evp_extra_test.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c +index 3b59761779..31d078dfba 100644 +--- a/test/evp_extra_test.c ++++ b/test/evp_extra_test.c +@@ -3267,6 +3267,31 @@ err: + } + #endif + ++#ifndef OPENSSL_NO_BF ++static int test_evp_bf_default_keylen(int idx) ++{ ++ int ret = 0; ++ static const char *algos[4] = { ++ "bf-ecb", "bf-cbc", "bf-cfb", "bf-ofb" ++ }; ++ int ivlen[4] = { 0, 8, 8, 8 }; ++ EVP_CIPHER *cipher = NULL; ++ ++ if (lgcyprov == NULL) ++ return TEST_skip("Test requires legacy provider to be loaded"); ++ ++ if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, algos[idx], testpropq)) ++ || !TEST_int_eq(EVP_CIPHER_get_key_length(cipher), 16) ++ || !TEST_int_eq(EVP_CIPHER_get_iv_length(cipher), ivlen[idx])) ++ goto err; ++ ++ ret = 1; ++err: ++ EVP_CIPHER_free(cipher); ++ return ret; ++} ++#endif ++ + #ifndef OPENSSL_NO_EC + static int ecpub_nids[] = { + NID_brainpoolP256r1, NID_X9_62_prime256v1, +@@ -4557,6 +4582,9 @@ int setup_tests(void) + ADD_ALL_TESTS(test_evp_iv_aes, 12); + #ifndef OPENSSL_NO_DES + ADD_ALL_TESTS(test_evp_iv_des, 6); ++#endif ++#ifndef OPENSSL_NO_BF ++ ADD_ALL_TESTS(test_evp_bf_default_keylen, 4); + #endif + ADD_TEST(test_EVP_rsa_pss_with_keygen_bits); + ADD_TEST(test_EVP_rsa_pss_set_saltlen); +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch openssl-3.0.2/debian/patches/lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch --- openssl-3.0.2/debian/patches/lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,58 @@ +From 6ec0318130a31372c7f7da272afee2441a5b8b94 Mon Sep 17 00:00:00 2001 +From: Alon Bar-Lev +Date: Tue, 26 Jul 2022 08:53:48 +0300 +Subject: [PATCH 1/2] REGRESSION: CMS_final: do not ignore CMS_dataFinal result + +The CMS_dataFinal result is important as signature may fail, however, it +is ignored while returning success from CMS_final. + +The SMIME_crlf_copy result is returned while it is ignored in the rest +of the openssl code. + +Prefer the CMS_dataFinal result. + +This is regression from openssl-1. + +Blame finds c1669f41ei as root cause of regression. + +Signed-off-by: Alon Bar-Lev + +Reviewed-by: Tomas Mraz +Reviewed-by: Paul Dale +Reviewed-by: Hugo Landau +(Merged from https://github.com/openssl/openssl/pull/18876) + +(cherry picked from commit b03756130dadb3732b460a6efd930f1b226acdad) +Origin: https://github.com/openssl/openssl/commit/6ec0318130a31372c7f7da272afee2441a5b8b94 +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.6 +--- + crypto/cms/cms_smime.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c +index 57c74f24a2..79589089c3 100644 +--- a/crypto/cms/cms_smime.c ++++ b/crypto/cms/cms_smime.c +@@ -882,7 +882,7 @@ int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags) + return 0; + } + +- ret = SMIME_crlf_copy(data, cmsbio, flags); ++ SMIME_crlf_copy(data, cmsbio, flags); + + (void)BIO_flush(cmsbio); + +@@ -890,6 +890,9 @@ int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags) + ERR_raise(ERR_LIB_CMS, CMS_R_CMS_DATAFINAL_ERROR); + goto err; + } ++ ++ ret = 1; ++ + err: + do_free_upto(cmsbio, dcont); + +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch openssl-3.0.2/debian/patches/lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch --- openssl-3.0.2/debian/patches/lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,135 @@ +From 9154fa3603ba49ffba3b3d2a19f75afde08ef32d Mon Sep 17 00:00:00 2001 +From: Alon Bar-Lev +Date: Tue, 26 Jul 2022 15:17:06 +0300 +Subject: [PATCH 2/2] Handle SMIME_crlf_copy return code + +Currently the SMIME_crlf_copy result is ignored in all usages. It does +return failure when memory allocation fails. + +This patch handles the SMIME_crlf_copy return code in all occurrences. + +Signed-off-by: Alon Bar-Lev + +Reviewed-by: Tomas Mraz +Reviewed-by: Paul Dale +Reviewed-by: Hugo Landau +(Merged from https://github.com/openssl/openssl/pull/18876) + +(cherry picked from commit 67c0460b89cc1b0644a1a59af78284dfd8d720af) +Origin: https://github.com/openssl/openssl/commit/9154fa3603ba49ffba3b3d2a19f75afde08ef32d +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.6 +--- + crypto/asn1/asn_mime.c | 19 +++++++++++++------ + crypto/cms/cms_smime.c | 7 +++++-- + crypto/pkcs7/pk7_smime.c | 3 ++- + 3 files changed, 20 insertions(+), 9 deletions(-) + +diff --git a/crypto/asn1/asn_mime.c b/crypto/asn1/asn_mime.c +index 1b8ac34106..f9cb9985d6 100644 +--- a/crypto/asn1/asn_mime.c ++++ b/crypto/asn1/asn_mime.c +@@ -69,6 +69,8 @@ static void mime_hdr_free(MIME_HEADER *hdr); + int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags, + const ASN1_ITEM *it) + { ++ int rv = 1; ++ + /* If streaming create stream BIO and copy all content through it */ + if (flags & SMIME_STREAM) { + BIO *bio, *tbio; +@@ -77,7 +79,10 @@ int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags, + ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE); + return 0; + } +- SMIME_crlf_copy(in, bio, flags); ++ if (!SMIME_crlf_copy(in, bio, flags)) { ++ rv = 0; ++ } ++ + (void)BIO_flush(bio); + /* Free up successive BIOs until we hit the old output BIO */ + do { +@@ -92,7 +97,7 @@ int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags, + */ + else + ASN1_item_i2d_bio(it, out, val); +- return 1; ++ return rv; + } + + /* Base 64 read and write of ASN1 structure */ +@@ -346,8 +351,7 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags, + * set up to finalise when it is written through. + */ + if (!(flags & SMIME_DETACHED) || (flags & PKCS7_REUSE_DIGEST)) { +- SMIME_crlf_copy(data, out, flags); +- return 1; ++ return SMIME_crlf_copy(data, out, flags); + } + + if (!aux || !aux->asn1_cb) { +@@ -365,7 +369,8 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags, + return 0; + + /* Copy data across, passing through filter BIOs for processing */ +- SMIME_crlf_copy(data, sarg.ndef_bio, flags); ++ if (!SMIME_crlf_copy(data, sarg.ndef_bio, flags)) ++ rv = 0; + + /* Finalize structure */ + if (aux->asn1_cb(ASN1_OP_DETACHED_POST, &val, it, &sarg) <= 0) +@@ -515,8 +520,10 @@ int SMIME_crlf_copy(BIO *in, BIO *out, int flags) + * when streaming as we don't end up with one OCTET STRING per line. + */ + bf = BIO_new(BIO_f_buffer()); +- if (bf == NULL) ++ if (bf == NULL) { ++ ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE); + return 0; ++ } + out = BIO_push(bf, out); + if (flags & SMIME_BINARY) { + while ((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0) +diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c +index 79589089c3..d17df31dd4 100644 +--- a/crypto/cms/cms_smime.c ++++ b/crypto/cms/cms_smime.c +@@ -432,7 +432,8 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs, + * Don't use SMIME_TEXT for verify: it adds headers and we want to + * remove them. + */ +- SMIME_crlf_copy(dcont, cmsbio, flags & ~SMIME_TEXT); ++ if (!SMIME_crlf_copy(dcont, cmsbio, flags & ~SMIME_TEXT)) ++ goto err; + + if (flags & CMS_TEXT) { + if (!SMIME_text(tmpout, out)) { +@@ -882,7 +883,9 @@ int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags) + return 0; + } + +- SMIME_crlf_copy(data, cmsbio, flags); ++ if (!SMIME_crlf_copy(data, cmsbio, flags)) { ++ goto err; ++ } + + (void)BIO_flush(cmsbio); + +diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c +index 60959ba0de..cc5f0b33e8 100644 +--- a/crypto/pkcs7/pk7_smime.c ++++ b/crypto/pkcs7/pk7_smime.c +@@ -81,7 +81,8 @@ int PKCS7_final(PKCS7 *p7, BIO *data, int flags) + return 0; + } + +- SMIME_crlf_copy(data, p7bio, flags); ++ if (!SMIME_crlf_copy(data, p7bio, flags)) ++ goto err; + + (void)BIO_flush(p7bio); + +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch openssl-3.0.2/debian/patches/lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch --- openssl-3.0.2/debian/patches/lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,110 @@ +From d0f8056c47f7aea40a34815fe459404f14501e81 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Tue, 11 Oct 2022 17:26:23 +0200 +Subject: [PATCH] Release the drbg in the global default context before engines + +Fixes #17995 +Fixes #18578 + +Reviewed-by: Paul Dale +Reviewed-by: Bernd Edlinger +(Merged from https://github.com/openssl/openssl/pull/19390) +Origin: https://github.com/openssl/openssl/commit/d0f8056c47f7aea40a34815fe459404f14501e81 +Bug: https://github.com/openssl/openssl/issues/18578 +Applied-Upstream: 3.0.8 +--- + crypto/context.c | 15 +++++++++++++++ + crypto/rand/rand_lib.c | 5 +++-- + include/crypto/rand.h | 1 + + include/internal/cryptlib.h | 2 ++ + 4 files changed, 21 insertions(+), 2 deletions(-) + +diff --git a/crypto/context.c b/crypto/context.c +index bdfc4d02a3..548665fba2 100644 +--- a/crypto/context.c ++++ b/crypto/context.c +@@ -15,6 +15,7 @@ + #include "internal/bio.h" + #include "internal/provider.h" + #include "crypto/ctype.h" ++#include "crypto/rand.h" + + struct ossl_lib_ctx_onfree_list_st { + ossl_lib_ctx_onfree_fn *fn; +@@ -271,6 +272,20 @@ OSSL_LIB_CTX *OSSL_LIB_CTX_set0_default(OSSL_LIB_CTX *libctx) + + return NULL; + } ++ ++void ossl_release_default_drbg_ctx(void) ++{ ++ int dynidx = default_context_int.dyn_indexes[OSSL_LIB_CTX_DRBG_INDEX]; ++ ++ /* early release of the DRBG in global default libctx, no locking */ ++ if (dynidx != -1) { ++ void *data; ++ ++ data = CRYPTO_get_ex_data(&default_context_int.data, dynidx); ++ ossl_rand_ctx_free(data); ++ CRYPTO_set_ex_data(&default_context_int.data, dynidx, NULL); ++ } ++} + #endif + + OSSL_LIB_CTX *ossl_lib_ctx_get_concrete(OSSL_LIB_CTX *ctx) +diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c +index c453d32261..f341d915db 100644 +--- a/crypto/rand/rand_lib.c ++++ b/crypto/rand/rand_lib.c +@@ -96,6 +96,7 @@ void ossl_rand_cleanup_int(void) + CRYPTO_THREAD_lock_free(rand_meth_lock); + rand_meth_lock = NULL; + # endif ++ ossl_release_default_drbg_ctx(); + rand_inited = 0; + } + +@@ -469,7 +470,7 @@ static void *rand_ossl_ctx_new(OSSL_LIB_CTX *libctx) + return NULL; + } + +-static void rand_ossl_ctx_free(void *vdgbl) ++void ossl_rand_ctx_free(void *vdgbl) + { + RAND_GLOBAL *dgbl = vdgbl; + +@@ -494,7 +495,7 @@ static void rand_ossl_ctx_free(void *vdgbl) + static const OSSL_LIB_CTX_METHOD rand_drbg_ossl_ctx_method = { + OSSL_LIB_CTX_METHOD_PRIORITY_2, + rand_ossl_ctx_new, +- rand_ossl_ctx_free, ++ ossl_rand_ctx_free, + }; + + static RAND_GLOBAL *rand_get_global(OSSL_LIB_CTX *libctx) +diff --git a/include/crypto/rand.h b/include/crypto/rand.h +index 6a71a339c8..165deaf95c 100644 +--- a/include/crypto/rand.h ++++ b/include/crypto/rand.h +@@ -125,4 +125,5 @@ void ossl_rand_cleanup_nonce(ossl_unused const OSSL_CORE_HANDLE *handle, + size_t ossl_pool_acquire_entropy(RAND_POOL *pool); + int ossl_pool_add_nonce_data(RAND_POOL *pool); + ++void ossl_rand_ctx_free(void *vdgbl); + #endif +diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h +index 1291299b6e..934d4b089c 100644 +--- a/include/internal/cryptlib.h ++++ b/include/internal/cryptlib.h +@@ -199,6 +199,8 @@ int ossl_lib_ctx_run_once(OSSL_LIB_CTX *ctx, unsigned int idx, + int ossl_lib_ctx_onfree(OSSL_LIB_CTX *ctx, ossl_lib_ctx_onfree_fn onfreefn); + const char *ossl_lib_ctx_get_descriptor(OSSL_LIB_CTX *libctx); + ++void ossl_release_default_drbg_ctx(void); ++ + OSSL_LIB_CTX *ossl_crypto_ex_data_get_ossl_lib_ctx(const CRYPTO_EX_DATA *ad); + int ossl_crypto_new_ex_data_ex(OSSL_LIB_CTX *ctx, int class_index, void *obj, + CRYPTO_EX_DATA *ad); +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch openssl-3.0.2/debian/patches/lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch --- openssl-3.0.2/debian/patches/lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,157 @@ +From 749691374ccf87418ca0e6664a9b9c831dcfe108 Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Wed, 20 Apr 2022 16:43:13 +0200 +Subject: [PATCH 1/7] Drop ossl_provider_clear_all_operation_bits() and all + uses of it + +This is a misused function, as it was called during query cache flush, +when the provider operation bits were meant to record if methods for a +certain operation has already been added to the method store. + +Fixes #18150 + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 20b6d85ab2b9cfa4cd29d2422d69c3e3f4db0a41) +Origin: https://github.com/openssl/openssl/commit/749691374ccf87418ca0e6664a9b9c831dcfe108 +Bug: https://github.com/openssl/openssl/pull/18151 +Applied-Upstream: 3.0.4 +--- + crypto/property/property.c | 3 --- + crypto/provider_core.c | 27 ------------------------- + doc/internal/man3/ossl_provider_new.pod | 8 +------- + include/internal/provider.h | 7 +++++-- + 4 files changed, 6 insertions(+), 39 deletions(-) + +diff --git a/crypto/property/property.c b/crypto/property/property.c +index 509191a893..523d2ba20c 100644 +--- a/crypto/property/property.c ++++ b/crypto/property/property.c +@@ -506,7 +506,6 @@ static void ossl_method_cache_flush(OSSL_METHOD_STORE *store, int nid) + ALGORITHM *alg = ossl_method_store_retrieve(store, nid); + + if (alg != NULL) { +- ossl_provider_clear_all_operation_bits(store->ctx); + store->nelem -= lh_QUERY_num_items(alg->cache); + impl_cache_flush_alg(0, alg, NULL); + } +@@ -518,7 +517,6 @@ int ossl_method_store_flush_cache(OSSL_METHOD_STORE *store, int all) + + if (!ossl_property_write_lock(store)) + return 0; +- ossl_provider_clear_all_operation_bits(store->ctx); + ossl_sa_ALGORITHM_doall_arg(store->algs, &impl_cache_flush_alg, arg); + store->nelem = 0; + ossl_property_unlock(store); +@@ -583,7 +581,6 @@ static void ossl_method_cache_flush_some(OSSL_METHOD_STORE *store) + state.nelem = 0; + if ((state.seed = OPENSSL_rdtsc()) == 0) + state.seed = 1; +- ossl_provider_clear_all_operation_bits(store->ctx); + store->need_flush = 0; + ossl_sa_ALGORITHM_doall_arg(store->algs, &impl_cache_flush_one_alg, &state); + store->nelem = state.nelem; +diff --git a/crypto/provider_core.c b/crypto/provider_core.c +index 177358f054..07fe3974ae 100644 +--- a/crypto/provider_core.c ++++ b/crypto/provider_core.c +@@ -1538,33 +1538,6 @@ void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov, + prov->unquery_operation(prov->provctx, operation_id, algs); + } + +-int ossl_provider_clear_all_operation_bits(OSSL_LIB_CTX *libctx) +-{ +- struct provider_store_st *store; +- OSSL_PROVIDER *provider; +- int i, num, res = 1; +- +- if ((store = get_provider_store(libctx)) != NULL) { +- if (!CRYPTO_THREAD_read_lock(store->lock)) +- return 0; +- num = sk_OSSL_PROVIDER_num(store->providers); +- for (i = 0; i < num; i++) { +- provider = sk_OSSL_PROVIDER_value(store->providers, i); +- if (!CRYPTO_THREAD_write_lock(provider->opbits_lock)) { +- res = 0; +- continue; +- } +- if (provider->operation_bits != NULL) +- memset(provider->operation_bits, 0, +- provider->operation_bits_sz); +- CRYPTO_THREAD_unlock(provider->opbits_lock); +- } +- CRYPTO_THREAD_unlock(store->lock); +- return res; +- } +- return 0; +-} +- + int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum) + { + size_t byte = bitnum / 8; +diff --git a/doc/internal/man3/ossl_provider_new.pod b/doc/internal/man3/ossl_provider_new.pod +index 0cf51a163f..3abcfc695d 100644 +--- a/doc/internal/man3/ossl_provider_new.pod ++++ b/doc/internal/man3/ossl_provider_new.pod +@@ -16,7 +16,7 @@ ossl_provider_name, ossl_provider_dso, + ossl_provider_module_name, ossl_provider_module_path, + ossl_provider_libctx, + ossl_provider_teardown, ossl_provider_gettable_params, +-ossl_provider_get_params, ossl_provider_clear_all_operation_bits, ++ossl_provider_get_params, + ossl_provider_query_operation, ossl_provider_unquery_operation, + ossl_provider_set_operation_bit, ossl_provider_test_operation_bit, + ossl_provider_get_capabilities +@@ -94,7 +94,6 @@ ossl_provider_get_capabilities + int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum); + int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, + int *result); +- int ossl_provider_clear_all_operation_bits(OSSL_LIB_CTX *libctx); + + int ossl_provider_init_as_child(OSSL_LIB_CTX *ctx, + const OSSL_CORE_HANDLE *handle, +@@ -300,9 +299,6 @@ ossl_provider_test_operation_bit() checks if the bit operation I + is set (1) or not (0) in the internal I bitstring, and sets + I<*result> to 1 or 0 accorddingly. + +-ossl_provider_clear_all_operation_bits() clears all of the operation bits +-to (0) for all providers in the library context I. +- + ossl_provider_init_as_child() stores in the library context I references to + the necessary upcalls for managing child providers. The I and I + parameters are the B and B pointers that were +@@ -380,8 +376,6 @@ If this function isn't available in the provider, 0 is returned. + ossl_provider_set_operation_bit() and ossl_provider_test_operation_bit() + return 1 on success, or 0 on error. + +-ossl_provider_clear_all_operation_bits() returns 1 on success, or 0 on error. +- + ossl_provider_get_capabilities() returns 1 on success, or 0 on error. + If this function isn't available in the provider or the provider does not + support the requested capability then 0 is returned. +diff --git a/include/internal/provider.h b/include/internal/provider.h +index d09829d05e..987e1a464d 100644 +--- a/include/internal/provider.h ++++ b/include/internal/provider.h +@@ -95,11 +95,14 @@ void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov, + int operation_id, + const OSSL_ALGORITHM *algs); + +-/* Cache of bits to see if we already queried an operation */ ++/* ++ * Cache of bits to see if we already added methods for an operation in ++ * the "permanent" method store. ++ * They should never be called for temporary method stores! ++ */ + int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum); + int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, + int *result); +-int ossl_provider_clear_all_operation_bits(OSSL_LIB_CTX *libctx); + + /* Configuration */ + void ossl_provider_add_conf_module(void); +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch openssl-3.0.2/debian/patches/lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch --- openssl-3.0.2/debian/patches/lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,251 @@ +From 27c4ac706a059aab81f3d1d8cc0ba0b3693bf155 Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Wed, 20 Apr 2022 18:34:09 +0200 +Subject: [PATCH 2/7] Refactor method construction pre- and post-condition + +The existing pre- and post-condition functions are supposed to check if +methods have already been created and stored, using provider operation +bits. This is supposed to only be done for "permanent" method stores. + +However, the way the pre-condition was called, it could not know if the +set of implementations to be stored is likely to end up in a "permanent" +or a temporary store. It needs access to the |no_store| flag returned +by the provider's operation query function, because that call was done +after the pre-condition was called. + +This requires a bit of refactoring, primarly of |algorithm_do_this()|, +but also of |ossl_method_construct_precondition()|. + +Fixes #18150 + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 10937d5867039afbf869c8514245ed7599b61307) +Origin: https://github.com/openssl/openssl/commit/27c4ac706a059aab81f3d1d8cc0ba0b3693bf155 +Bug: https://github.com/openssl/openssl/pull/18151 +Applied-Upstream: 3.0.4 +--- + crypto/core_algorithm.c | 103 +++++++++++++++++++++++++++------------- + crypto/core_fetch.c | 24 ++++++++-- + include/internal/core.h | 2 +- + 3 files changed, 90 insertions(+), 39 deletions(-) + +diff --git a/crypto/core_algorithm.c b/crypto/core_algorithm.c +index 5ff33eff7c..6d1192f098 100644 +--- a/crypto/core_algorithm.c ++++ b/crypto/core_algorithm.c +@@ -16,7 +16,8 @@ + struct algorithm_data_st { + OSSL_LIB_CTX *libctx; + int operation_id; /* May be zero for finding them all */ +- int (*pre)(OSSL_PROVIDER *, int operation_id, void *data, int *result); ++ int (*pre)(OSSL_PROVIDER *, int operation_id, int no_store, void *data, ++ int *result); + void (*fn)(OSSL_PROVIDER *, const OSSL_ALGORITHM *, int no_store, + void *data); + int (*post)(OSSL_PROVIDER *, int operation_id, int no_store, void *data, +@@ -24,10 +25,71 @@ struct algorithm_data_st { + void *data; + }; + ++/* ++ * Process one OSSL_ALGORITHM array, for the operation |cur_operation|, ++ * by constructing methods for all its implementations and adding those ++ * to the appropriate method store. ++ * Which method store is appropriate is given by |no_store| ("permanent" ++ * if 0, temporary if 1) and other data in |data->data|. ++ * ++ * Returns: ++ * -1 to quit adding algorithm implementations immediately ++ * 0 if not successful, but adding should continue ++ * 1 if successful so far, and adding should continue ++ */ ++static int algorithm_do_map(OSSL_PROVIDER *provider, const OSSL_ALGORITHM *map, ++ int cur_operation, int no_store, void *cbdata) ++{ ++ struct algorithm_data_st *data = cbdata; ++ int ret = 0; ++ ++ /* Do we fulfill pre-conditions? */ ++ if (data->pre == NULL) { ++ /* If there is no pre-condition function, assume "yes" */ ++ ret = 1; ++ } else if (!data->pre(provider, cur_operation, no_store, data->data, ++ &ret)) { ++ /* Error, bail out! */ ++ return -1; ++ } ++ ++ /* ++ * If pre-condition not fulfilled don't add this set of implementations, ++ * but do continue with the next. This simply means that another thread ++ * got to it first. ++ */ ++ if (ret == 0) ++ return 1; ++ ++ if (map != NULL) { ++ const OSSL_ALGORITHM *thismap; ++ ++ for (thismap = map; thismap->algorithm_names != NULL; thismap++) ++ data->fn(provider, thismap, no_store, data->data); ++ } ++ ++ /* Do we fulfill post-conditions? */ ++ if (data->post == NULL) { ++ /* If there is no post-condition function, assume "yes" */ ++ ret = 1; ++ } else if (!data->post(provider, cur_operation, no_store, data->data, ++ &ret)) { ++ /* Error, bail out! */ ++ return -1; ++ } ++ ++ return ret; ++} ++ ++/* ++ * Given a provider, process one operation given by |data->operation_id|, or ++ * if that's zero, process all known operations. ++ * For each such operation, query the associated OSSL_ALGORITHM array from ++ * the provider, then process that array with |algorithm_do_map()|. ++ */ + static int algorithm_do_this(OSSL_PROVIDER *provider, void *cbdata) + { + struct algorithm_data_st *data = cbdata; +- int no_store = 0; /* Assume caching is ok */ + int first_operation = 1; + int last_operation = OSSL_OP__HIGHEST; + int cur_operation; +@@ -39,43 +101,18 @@ static int algorithm_do_this(OSSL_PROVIDER *provider, void *cbdata) + for (cur_operation = first_operation; + cur_operation <= last_operation; + cur_operation++) { ++ int no_store = 0; /* Assume caching is ok */ + const OSSL_ALGORITHM *map = NULL; + int ret; + +- /* Do we fulfill pre-conditions? */ +- if (data->pre == NULL) { +- /* If there is no pre-condition function, assume "yes" */ +- ret = 1; +- } else { +- if (!data->pre(provider, cur_operation, data->data, &ret)) +- /* Error, bail out! */ +- return 0; +- } +- +- /* If pre-condition not fulfilled, go to the next operation */ +- if (!ret) +- continue; +- + map = ossl_provider_query_operation(provider, cur_operation, + &no_store); +- if (map != NULL) { +- const OSSL_ALGORITHM *thismap; +- +- for (thismap = map; thismap->algorithm_names != NULL; thismap++) +- data->fn(provider, thismap, no_store, data->data); +- } ++ ret = algorithm_do_map(provider, map, cur_operation, no_store, data); + ossl_provider_unquery_operation(provider, cur_operation, map); + +- /* Do we fulfill post-conditions? */ +- if (data->post == NULL) { +- /* If there is no post-condition function, assume "yes" */ +- ret = 1; +- } else { +- if (!data->post(provider, cur_operation, no_store, data->data, +- &ret)) +- /* Error, bail out! */ +- return 0; +- } ++ if (ret < 0) ++ /* Hard error, bail out immediately! */ ++ return 0; + + /* If post-condition not fulfilled, set general failure */ + if (!ret) +@@ -88,7 +125,7 @@ static int algorithm_do_this(OSSL_PROVIDER *provider, void *cbdata) + void ossl_algorithm_do_all(OSSL_LIB_CTX *libctx, int operation_id, + OSSL_PROVIDER *provider, + int (*pre)(OSSL_PROVIDER *, int operation_id, +- void *data, int *result), ++ int no_store, void *data, int *result), + void (*fn)(OSSL_PROVIDER *provider, + const OSSL_ALGORITHM *algo, + int no_store, void *data), +diff --git a/crypto/core_fetch.c b/crypto/core_fetch.c +index 367f6ba8a4..6b25379f7b 100644 +--- a/crypto/core_fetch.c ++++ b/crypto/core_fetch.c +@@ -24,16 +24,28 @@ struct construct_data_st { + void *mcm_data; + }; + ++static int is_temporary_method_store(int no_store, void *cbdata) ++{ ++ struct construct_data_st *data = cbdata; ++ ++ return no_store && !data->force_store; ++} ++ + static int ossl_method_construct_precondition(OSSL_PROVIDER *provider, +- int operation_id, void *cbdata, +- int *result) ++ int operation_id, int no_store, ++ void *cbdata, int *result) + { + if (!ossl_assert(result != NULL)) { + ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); + return 0; + } + +- if (!ossl_provider_test_operation_bit(provider, operation_id, result)) ++ /* Assume that no bits are set */ ++ *result = 0; ++ ++ /* No flag bits for temporary stores */ ++ if (!is_temporary_method_store(no_store, cbdata) ++ && !ossl_provider_test_operation_bit(provider, operation_id, result)) + return 0; + + /* +@@ -56,7 +68,9 @@ static int ossl_method_construct_postcondition(OSSL_PROVIDER *provider, + } + + *result = 1; +- return no_store != 0 ++ ++ /* No flag bits for temporary stores */ ++ return is_temporary_method_store(no_store, cbdata) + || ossl_provider_set_operation_bit(provider, operation_id); + } + +@@ -82,7 +96,7 @@ static void ossl_method_construct_this(OSSL_PROVIDER *provider, + * of the passed method. + */ + +- if (data->force_store || !no_store) { ++ if (!is_temporary_method_store(no_store, data)) { + /* If we haven't been told not to store, add to the global store */ + data->mcm->put(NULL, method, provider, algo->algorithm_names, + algo->property_definition, data->mcm_data); +diff --git a/include/internal/core.h b/include/internal/core.h +index 274e368aaa..545d985385 100644 +--- a/include/internal/core.h ++++ b/include/internal/core.h +@@ -49,7 +49,7 @@ void *ossl_method_construct(OSSL_LIB_CTX *ctx, int operation_id, + void ossl_algorithm_do_all(OSSL_LIB_CTX *libctx, int operation_id, + OSSL_PROVIDER *provider, + int (*pre)(OSSL_PROVIDER *, int operation_id, +- void *data, int *result), ++ int no_store, void *data, int *result), + void (*fn)(OSSL_PROVIDER *provider, + const OSSL_ALGORITHM *algo, + int no_store, void *data), +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch openssl-3.0.2/debian/patches/lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch --- openssl-3.0.2/debian/patches/lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,259 @@ +From 8b76db9e2618225f78c84ed2b338cd005f6ef310 Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Fri, 22 Apr 2022 11:00:36 +0200 +Subject: [PATCH 3/7] Don't empty the method store when flushing the query + cache + +When evp_method_store_flush() flushed the query cache, it also freed +all methods in the EVP method store, through an unfortunate call of +ossl_method_store_flush_cache() with an argument saying that all +methods should indeed be dropped. + +To undo some of the confusion, ossl_method_store_flush_cache() is +renamed to ossl_method_store_cache_flush_all(), and limited to do +only that. Some if the items in the internal ALGORITHM structure are +also renamed and commented to clarify what they are for. + +Fixes #18150 + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 60640d79ca7ea0980dc09c71fe6a297b5f8588a2) +Origin: https://github.com/openssl/openssl/commit/8b76db9e2618225f78c84ed2b338cd005f6ef310 +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.4 +--- + crypto/evp/evp_fetch.c | 6 ++-- + crypto/property/property.c | 47 +++++++++++-------------- + crypto/provider_core.c | 4 +-- + doc/internal/man3/OSSL_METHOD_STORE.pod | 8 ++--- + include/crypto/evp.h | 3 +- + include/internal/property.h | 2 +- + 6 files changed, 33 insertions(+), 37 deletions(-) + +diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c +index c126ea177e..fd2b38c100 100644 +--- a/crypto/evp/evp_fetch.c ++++ b/crypto/evp/evp_fetch.c +@@ -429,12 +429,12 @@ void *evp_generic_fetch_from_prov(OSSL_PROVIDER *prov, int operation_id, + return method; + } + +-int evp_method_store_flush(OSSL_LIB_CTX *libctx) ++int evp_method_store_cache_flush(OSSL_LIB_CTX *libctx) + { + OSSL_METHOD_STORE *store = get_evp_method_store(libctx); + + if (store != NULL) +- return ossl_method_store_flush_cache(store, 1); ++ return ossl_method_store_cache_flush_all(store); + return 1; + } + +@@ -481,7 +481,7 @@ static int evp_set_parsed_default_properties(OSSL_LIB_CTX *libctx, + ossl_property_free(*plp); + *plp = def_prop; + if (store != NULL) +- return ossl_method_store_flush_cache(store, 0); ++ return ossl_method_store_cache_flush_all(store); + } + ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); + return 0; +diff --git a/crypto/property/property.c b/crypto/property/property.c +index 523d2ba20c..b4c0cf06d7 100644 +--- a/crypto/property/property.c ++++ b/crypto/property/property.c +@@ -61,10 +61,16 @@ typedef struct { + + struct ossl_method_store_st { + OSSL_LIB_CTX *ctx; +- size_t nelem; + SPARSE_ARRAY_OF(ALGORITHM) *algs; +- int need_flush; + CRYPTO_RWLOCK *lock; ++ ++ /* query cache specific values */ ++ ++ /* Count of the query cache entries for all algs */ ++ size_t cache_nelem; ++ ++ /* Flag: 1 if query cache entries for all algs need flushing */ ++ int cache_need_flush; + }; + + typedef struct { +@@ -486,19 +492,10 @@ fin: + return ret; + } + +-static void impl_cache_flush_alg(ossl_uintmax_t idx, ALGORITHM *alg, void *arg) ++static void impl_cache_flush_alg(ossl_uintmax_t idx, ALGORITHM *alg) + { +- SPARSE_ARRAY_OF(ALGORITHM) *algs = arg; +- + lh_QUERY_doall(alg->cache, &impl_cache_free); +- if (algs != NULL) { +- sk_IMPLEMENTATION_pop_free(alg->impls, &impl_free); +- lh_QUERY_free(alg->cache); +- OPENSSL_free(alg); +- ossl_sa_ALGORITHM_set(algs, idx, NULL); +- } else { +- lh_QUERY_flush(alg->cache); +- } ++ lh_QUERY_flush(alg->cache); + } + + static void ossl_method_cache_flush(OSSL_METHOD_STORE *store, int nid) +@@ -506,19 +503,17 @@ static void ossl_method_cache_flush(OSSL_METHOD_STORE *store, int nid) + ALGORITHM *alg = ossl_method_store_retrieve(store, nid); + + if (alg != NULL) { +- store->nelem -= lh_QUERY_num_items(alg->cache); +- impl_cache_flush_alg(0, alg, NULL); ++ store->cache_nelem -= lh_QUERY_num_items(alg->cache); ++ impl_cache_flush_alg(0, alg); + } + } + +-int ossl_method_store_flush_cache(OSSL_METHOD_STORE *store, int all) ++int ossl_method_store_cache_flush_all(OSSL_METHOD_STORE *store) + { +- void *arg = (all != 0 ? store->algs : NULL); +- + if (!ossl_property_write_lock(store)) + return 0; +- ossl_sa_ALGORITHM_doall_arg(store->algs, &impl_cache_flush_alg, arg); +- store->nelem = 0; ++ ossl_sa_ALGORITHM_doall(store->algs, &impl_cache_flush_alg); ++ store->cache_nelem = 0; + ossl_property_unlock(store); + return 1; + } +@@ -581,9 +576,9 @@ static void ossl_method_cache_flush_some(OSSL_METHOD_STORE *store) + state.nelem = 0; + if ((state.seed = OPENSSL_rdtsc()) == 0) + state.seed = 1; +- store->need_flush = 0; ++ store->cache_need_flush = 0; + ossl_sa_ALGORITHM_doall_arg(store->algs, &impl_cache_flush_one_alg, &state); +- store->nelem = state.nelem; ++ store->cache_nelem = state.nelem; + } + + int ossl_method_store_cache_get(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, +@@ -634,7 +629,7 @@ int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, + + if (!ossl_property_write_lock(store)) + return 0; +- if (store->need_flush) ++ if (store->cache_need_flush) + ossl_method_cache_flush_some(store); + alg = ossl_method_store_retrieve(store, nid); + if (alg == NULL) +@@ -645,7 +640,7 @@ int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, + elem.provider = prov; + if ((old = lh_QUERY_delete(alg->cache, &elem)) != NULL) { + impl_cache_free(old); +- store->nelem--; ++ store->cache_nelem--; + } + goto end; + } +@@ -664,8 +659,8 @@ int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, + goto end; + } + if (!lh_QUERY_error(alg->cache)) { +- if (++store->nelem >= IMPL_CACHE_FLUSH_THRESHOLD) +- store->need_flush = 1; ++ if (++store->cache_nelem >= IMPL_CACHE_FLUSH_THRESHOLD) ++ store->cache_need_flush = 1; + goto end; + } + ossl_method_free(&p->method); +diff --git a/crypto/provider_core.c b/crypto/provider_core.c +index 07fe3974ae..a2520efa1c 100644 +--- a/crypto/provider_core.c ++++ b/crypto/provider_core.c +@@ -15,7 +15,7 @@ + #include + #include + #include "crypto/cryptlib.h" +-#include "crypto/evp.h" /* evp_method_store_flush */ ++#include "crypto/evp.h" /* evp_method_store_cache_flush */ + #include "crypto/rand.h" + #include "internal/nelem.h" + #include "internal/thread_once.h" +@@ -1160,7 +1160,7 @@ static int provider_flush_store_cache(const OSSL_PROVIDER *prov) + CRYPTO_THREAD_unlock(store->lock); + + if (!freeing) +- return evp_method_store_flush(prov->libctx); ++ return evp_method_store_cache_flush(prov->libctx); + return 1; + } + +diff --git a/doc/internal/man3/OSSL_METHOD_STORE.pod b/doc/internal/man3/OSSL_METHOD_STORE.pod +index 49b3459ab2..a4c1c1bab2 100644 +--- a/doc/internal/man3/OSSL_METHOD_STORE.pod ++++ b/doc/internal/man3/OSSL_METHOD_STORE.pod +@@ -34,7 +34,7 @@ ossl_method_store_flush_cache + int nid, const char *prop_query, void *method, + int (*method_up_ref)(void *), + void (*method_destruct)(void *)); +- void ossl_method_store_flush_cache(OSSL_METHOD_STORE *store, int all); ++ void ossl_method_store_cache_flush_all(OSSL_METHOD_STORE *store); + + =head1 DESCRIPTION + +@@ -83,9 +83,6 @@ I<*prop> may be a pointer to a provider, which will narrow the search + to methods from that provider. + The result, if any, is returned in I<*method>, and its provider in I<*prov>. + +-ossl_method_store_flush_cache() flushes all cached entries associated with +-I. +- + =head2 Cache Functions + + ossl_method_store_cache_get() queries the cache associated with the I +@@ -102,6 +99,9 @@ The I function is called to increment the + reference count of the method and the I function is called + to decrement it. + ++ossl_method_store_cache_flush_all() flushes all cached entries associated with ++I. ++ + =head1 NOTES + + The I argument to ossl_method_store_cache_get() and +diff --git a/include/crypto/evp.h b/include/crypto/evp.h +index 206ac26337..2afdd94323 100644 +--- a/include/crypto/evp.h ++++ b/include/crypto/evp.h +@@ -893,7 +893,8 @@ int evp_pkey_ctx_get1_id_len_prov(EVP_PKEY_CTX *ctx, size_t *id_len); + int evp_pkey_ctx_use_cached_data(EVP_PKEY_CTX *ctx); + # endif /* !defined(FIPS_MODULE) */ + +-int evp_method_store_flush(OSSL_LIB_CTX *libctx); ++int evp_method_store_cache_flush(OSSL_LIB_CTX *libctx); ++ + int evp_default_properties_enable_fips_int(OSSL_LIB_CTX *libctx, int enable, + int loadconfig); + int evp_set_default_properties_int(OSSL_LIB_CTX *libctx, const char *propq, +diff --git a/include/internal/property.h b/include/internal/property.h +index 8211974595..9c68e8c346 100644 +--- a/include/internal/property.h ++++ b/include/internal/property.h +@@ -77,7 +77,7 @@ int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, + int (*method_up_ref)(void *), + void (*method_destruct)(void *)); + +-__owur int ossl_method_store_flush_cache(OSSL_METHOD_STORE *store, int all); ++__owur int ossl_method_store_cache_flush_all(OSSL_METHOD_STORE *store); + + /* Merge two property queries together */ + OSSL_PROPERTY_LIST *ossl_property_merge(const OSSL_PROPERTY_LIST *a, +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch openssl-3.0.2/debian/patches/lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch --- openssl-3.0.2/debian/patches/lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,287 @@ +From 215708c53bc3d62fd29ec842d80fa929910178ee Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Fri, 22 Apr 2022 16:44:51 +0200 +Subject: [PATCH 4/7] Make it possible to remove methods by the provider that + provides them + +This adds ossl_method_store_remove_all_provided(), which selectively +removes methods from the given store that are provided by the given +provider. + +This also adds the EVP specific evp_method_store_remove_all_provided(), +which matches ossl_method_store_remove_all_provided() but can also +retrieve the correct store to manipulate for EVP functions. + +This allows us to modify ossl_provider_self_test() to do the job it's +supposed to do, but through clearly defined functions instead of a +cache flushing call that previously did more than that. + +ossl_provider_deactivate() is also modified to remove methods associated +with the deactivated provider, and not just clearing the cache. + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 2e4d0677ea858c619a33235265dbee19520a9d35) +Origin: https://github.com/openssl/openssl/commit/215708c53bc3d62fd29ec842d80fa929910178ee +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.4 +--- + crypto/evp/evp_fetch.c | 10 ++++ + crypto/property/property.c | 70 ++++++++++++++++++++++--- + crypto/provider_core.c | 28 +++++++++- + doc/internal/man3/OSSL_METHOD_STORE.pod | 12 ++++- + include/crypto/evp.h | 1 + + include/internal/property.h | 2 + + 6 files changed, 112 insertions(+), 11 deletions(-) + +diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c +index fd2b38c100..90d6a4e6d4 100644 +--- a/crypto/evp/evp_fetch.c ++++ b/crypto/evp/evp_fetch.c +@@ -438,6 +438,16 @@ int evp_method_store_cache_flush(OSSL_LIB_CTX *libctx) + return 1; + } + ++int evp_method_store_remove_all_provided(const OSSL_PROVIDER *prov) ++{ ++ OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov); ++ OSSL_METHOD_STORE *store = get_evp_method_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_remove_all_provided(store, prov); ++ return 1; ++} ++ + static int evp_set_parsed_default_properties(OSSL_LIB_CTX *libctx, + OSSL_PROPERTY_LIST *def_prop, + int loadconfig, +diff --git a/crypto/property/property.c b/crypto/property/property.c +index b4c0cf06d7..93d12afb18 100644 +--- a/crypto/property/property.c ++++ b/crypto/property/property.c +@@ -88,6 +88,8 @@ typedef struct ossl_global_properties_st { + #endif + } OSSL_GLOBAL_PROPERTIES; + ++static void ossl_method_cache_flush_alg(OSSL_METHOD_STORE *store, ++ ALGORITHM *alg); + static void ossl_method_cache_flush(OSSL_METHOD_STORE *store, int nid); + + /* Global properties are stored per library context */ +@@ -205,6 +207,12 @@ static void impl_cache_free(QUERY *elem) + } + } + ++static void impl_cache_flush_alg(ossl_uintmax_t idx, ALGORITHM *alg) ++{ ++ lh_QUERY_doall(alg->cache, &impl_cache_free); ++ lh_QUERY_flush(alg->cache); ++} ++ + static void alg_cleanup(ossl_uintmax_t idx, ALGORITHM *a) + { + if (a != NULL) { +@@ -374,6 +382,55 @@ int ossl_method_store_remove(OSSL_METHOD_STORE *store, int nid, + return 0; + } + ++struct alg_cleanup_by_provider_data_st { ++ OSSL_METHOD_STORE *store; ++ const OSSL_PROVIDER *prov; ++}; ++ ++static void ++alg_cleanup_by_provider(ossl_uintmax_t idx, ALGORITHM *alg, void *arg) ++{ ++ struct alg_cleanup_by_provider_data_st *data = arg; ++ int i, count; ++ ++ /* ++ * We walk the stack backwards, to avoid having to deal with stack shifts ++ * caused by deletion ++ */ ++ for (count = 0, i = sk_IMPLEMENTATION_num(alg->impls); i-- > 0;) { ++ IMPLEMENTATION *impl = sk_IMPLEMENTATION_value(alg->impls, i); ++ ++ if (impl->provider == data->prov) { ++ impl_free(impl); ++ (void)sk_IMPLEMENTATION_delete(alg->impls, i); ++ count++; ++ } ++ } ++ ++ /* ++ * If we removed any implementation, we also clear the whole associated ++ * cache, 'cause that's the sensible thing to do. ++ * There's no point flushing the cache entries where we didn't remove ++ * any implementation, though. ++ */ ++ if (count > 0) ++ ossl_method_cache_flush_alg(data->store, alg); ++} ++ ++int ossl_method_store_remove_all_provided(OSSL_METHOD_STORE *store, ++ const OSSL_PROVIDER *prov) ++{ ++ struct alg_cleanup_by_provider_data_st data; ++ ++ if (!ossl_property_write_lock(store)) ++ return 0; ++ data.prov = prov; ++ data.store = store; ++ ossl_sa_ALGORITHM_doall_arg(store->algs, &alg_cleanup_by_provider, &data); ++ ossl_property_unlock(store); ++ return 1; ++} ++ + static void alg_do_one(ALGORITHM *alg, IMPLEMENTATION *impl, + void (*fn)(int id, void *method, void *fnarg), + void *fnarg) +@@ -492,20 +549,19 @@ fin: + return ret; + } + +-static void impl_cache_flush_alg(ossl_uintmax_t idx, ALGORITHM *alg) ++static void ossl_method_cache_flush_alg(OSSL_METHOD_STORE *store, ++ ALGORITHM *alg) + { +- lh_QUERY_doall(alg->cache, &impl_cache_free); +- lh_QUERY_flush(alg->cache); ++ store->cache_nelem -= lh_QUERY_num_items(alg->cache); ++ impl_cache_flush_alg(0, alg); + } + + static void ossl_method_cache_flush(OSSL_METHOD_STORE *store, int nid) + { + ALGORITHM *alg = ossl_method_store_retrieve(store, nid); + +- if (alg != NULL) { +- store->cache_nelem -= lh_QUERY_num_items(alg->cache); +- impl_cache_flush_alg(0, alg); +- } ++ if (alg != NULL) ++ ossl_method_cache_flush_alg(store, alg); + } + + int ossl_method_store_cache_flush_all(OSSL_METHOD_STORE *store) +diff --git a/crypto/provider_core.c b/crypto/provider_core.c +index a2520efa1c..fef6fdca9b 100644 +--- a/crypto/provider_core.c ++++ b/crypto/provider_core.c +@@ -1164,6 +1164,30 @@ static int provider_flush_store_cache(const OSSL_PROVIDER *prov) + return 1; + } + ++static int provider_remove_store_methods(OSSL_PROVIDER *prov) ++{ ++ struct provider_store_st *store; ++ int freeing; ++ ++ if ((store = get_provider_store(prov->libctx)) == NULL) ++ return 0; ++ ++ if (!CRYPTO_THREAD_read_lock(store->lock)) ++ return 0; ++ freeing = store->freeing; ++ CRYPTO_THREAD_unlock(store->lock); ++ ++ if (!freeing) { ++ OPENSSL_free(prov->operation_bits); ++ prov->operation_bits = NULL; ++ prov->operation_bits_sz = 0; ++ CRYPTO_THREAD_unlock(prov->opbits_lock); ++ ++ return evp_method_store_remove_all_provided(prov); ++ } ++ return 1; ++} ++ + int ossl_provider_activate(OSSL_PROVIDER *prov, int upcalls, int aschild) + { + int count; +@@ -1191,7 +1215,7 @@ int ossl_provider_deactivate(OSSL_PROVIDER *prov, int removechildren) + if (prov == NULL + || (count = provider_deactivate(prov, 1, removechildren)) < 0) + return 0; +- return count == 0 ? provider_flush_store_cache(prov) : 1; ++ return count == 0 ? provider_remove_store_methods(prov) : 1; + } + + void *ossl_provider_ctx(const OSSL_PROVIDER *prov) +@@ -1500,7 +1524,7 @@ int ossl_provider_self_test(const OSSL_PROVIDER *prov) + return 1; + ret = prov->self_test(prov->provctx); + if (ret == 0) +- (void)provider_flush_store_cache(prov); ++ (void)provider_remove_store_methods((OSSL_PROVIDER *)prov); + return ret; + } + +diff --git a/doc/internal/man3/OSSL_METHOD_STORE.pod b/doc/internal/man3/OSSL_METHOD_STORE.pod +index a4c1c1bab2..70f6eb520f 100644 +--- a/doc/internal/man3/OSSL_METHOD_STORE.pod ++++ b/doc/internal/man3/OSSL_METHOD_STORE.pod +@@ -4,9 +4,10 @@ + + OSSL_METHOD_STORE, ossl_method_store_new, ossl_method_store_free, + ossl_method_store_init, ossl_method_store_cleanup, +-ossl_method_store_add, ossl_method_store_remove, ossl_method_store_fetch, ++ossl_method_store_add, ossl_method_store_fetch, ++ossl_method_store_remove, ossl_method_store_remove_all_provided, + ossl_method_store_cache_get, ossl_method_store_cache_set, +-ossl_method_store_flush_cache ++ossl_method_store_cache_flush_all + - implementation method store and query + + =head1 SYNOPSIS +@@ -28,6 +29,9 @@ ossl_method_store_flush_cache + int ossl_method_store_fetch(OSSL_METHOD_STORE *store, + int nid, const char *properties, + void **method, const OSSL_PROVIDER **prov_rw); ++ int ossl_method_store_remove_all_provided(OSSL_METHOD_STORE *store, ++ const OSSL_PROVIDER *prov); ++ + int ossl_method_store_cache_get(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, + int nid, const char *prop_query, void **method); + int ossl_method_store_cache_set(OSSL_METHOD_STORE *store, OSSL_PROVIDER *prov, +@@ -83,6 +87,10 @@ I<*prop> may be a pointer to a provider, which will narrow the search + to methods from that provider. + The result, if any, is returned in I<*method>, and its provider in I<*prov>. + ++ossl_method_store_remove_all_provided() removes all methods from I ++that are provided by I. ++When doing so, it also flushes the corresponding cache entries. ++ + =head2 Cache Functions + + ossl_method_store_cache_get() queries the cache associated with the I +diff --git a/include/crypto/evp.h b/include/crypto/evp.h +index 2afdd94323..9db5d89430 100644 +--- a/include/crypto/evp.h ++++ b/include/crypto/evp.h +@@ -894,6 +894,7 @@ int evp_pkey_ctx_use_cached_data(EVP_PKEY_CTX *ctx); + # endif /* !defined(FIPS_MODULE) */ + + int evp_method_store_cache_flush(OSSL_LIB_CTX *libctx); ++int evp_method_store_remove_all_provided(const OSSL_PROVIDER *prov); + + int evp_default_properties_enable_fips_int(OSSL_LIB_CTX *libctx, int enable, + int loadconfig); +diff --git a/include/internal/property.h b/include/internal/property.h +index 9c68e8c346..db08c33cc3 100644 +--- a/include/internal/property.h ++++ b/include/internal/property.h +@@ -64,6 +64,8 @@ void ossl_method_store_do_all(OSSL_METHOD_STORE *store, + int ossl_method_store_fetch(OSSL_METHOD_STORE *store, + int nid, const char *prop_query, + const OSSL_PROVIDER **prov, void **method); ++int ossl_method_store_remove_all_provided(OSSL_METHOD_STORE *store, ++ const OSSL_PROVIDER *prov); + + /* Get the global properties associate with the specified library context */ + OSSL_PROPERTY_LIST **ossl_ctx_global_properties(OSSL_LIB_CTX *ctx, +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch openssl-3.0.2/debian/patches/lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch --- openssl-3.0.2/debian/patches/lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,67 @@ +From 106f5c231ccf7103564c8f81f169e372c444351b Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Mon, 25 Apr 2022 07:22:27 +0200 +Subject: [PATCH 5/7] Complete the cleanup of an algorithm in OSSL_METHOD_STORE + +The `alg_cleanup` didn't properly clear the OPENSSL_SA leaf that it +had just freed the contents of. Fortunately, `ossl_sa_ALGORITHM_doall_arg()` +allows us to pass the store pointer itself as an extra argument, which +allows a modified `alg_cleanup` to complete the job. + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 03454ba2a234197c961920f1bac37cc9f4cf3f54) +Origin: https://github.com/openssl/openssl/commit/106f5c231ccf7103564c8f81f169e372c444351b +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.4 +--- + crypto/property/property.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/crypto/property/property.c b/crypto/property/property.c +index 93d12afb18..83f49d92d5 100644 +--- a/crypto/property/property.c ++++ b/crypto/property/property.c +@@ -213,14 +213,18 @@ static void impl_cache_flush_alg(ossl_uintmax_t idx, ALGORITHM *alg) + lh_QUERY_flush(alg->cache); + } + +-static void alg_cleanup(ossl_uintmax_t idx, ALGORITHM *a) ++static void alg_cleanup(ossl_uintmax_t idx, ALGORITHM *a, void *arg) + { ++ OSSL_METHOD_STORE *store = arg; ++ + if (a != NULL) { + sk_IMPLEMENTATION_pop_free(a->impls, &impl_free); + lh_QUERY_doall(a->cache, &impl_cache_free); + lh_QUERY_free(a->cache); + OPENSSL_free(a); + } ++ if (store != NULL) ++ ossl_sa_ALGORITHM_set(store->algs, idx, NULL); + } + + /* +@@ -250,7 +254,7 @@ OSSL_METHOD_STORE *ossl_method_store_new(OSSL_LIB_CTX *ctx) + void ossl_method_store_free(OSSL_METHOD_STORE *store) + { + if (store != NULL) { +- ossl_sa_ALGORITHM_doall(store->algs, &alg_cleanup); ++ ossl_sa_ALGORITHM_doall_arg(store->algs, &alg_cleanup, store); + ossl_sa_ALGORITHM_free(store->algs); + CRYPTO_THREAD_lock_free(store->lock); + OPENSSL_free(store); +@@ -340,7 +344,7 @@ int ossl_method_store_add(OSSL_METHOD_STORE *store, const OSSL_PROVIDER *prov, + + err: + ossl_property_unlock(store); +- alg_cleanup(0, alg); ++ alg_cleanup(0, alg, NULL); + impl_free(impl); + return 0; + } +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch openssl-3.0.2/debian/patches/lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch --- openssl-3.0.2/debian/patches/lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,89 @@ +From a860a5807adf61f624872fa26aeb31585c17aa72 Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Fri, 29 Apr 2022 08:08:06 +0200 +Subject: [PATCH 6/7] For child libctx / provider, don't count self-references + in parent + +In child library contexts, which contain child "clones" of the +providers the application has in store, one of these children will +always be the provider that creates the child library context; let's +call them self-refering child providers. + +For these self-refering child providers, we don't increment the parent +provider reference count, nor do we free the parent provider, as those +become self defeating and hinder the teardown and unloading process +when the application cleans up. + +For non self-refering child providers, we must retain this propagation +of reference count to the parent, so that aren't torn down too early, +i.e. when there's still a "foreign" reference (fetched algorithm). + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 4da7663b02bf05542830e85db6f74cf90daf1f49) +Origin: https://github.com/openssl/openssl/commit/a860a5807adf61f624872fa26aeb31585c17aa72 +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.4 +--- + crypto/provider_child.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/crypto/provider_child.c b/crypto/provider_child.c +index 977ea4db3b..950ba2ef82 100644 +--- a/crypto/provider_child.c ++++ b/crypto/provider_child.c +@@ -279,9 +279,22 @@ void ossl_provider_deinit_child(OSSL_LIB_CTX *ctx) + gbl->c_provider_deregister_child_cb(gbl->handle); + } + ++/* ++ * ossl_provider_up_ref_parent() and ossl_provider_free_parent() do ++ * nothing in "self-referencing" child providers, i.e. when the parent ++ * of the child provider is the same as the provider where this child ++ * provider was created. ++ * This allows the teardown function in the parent provider to be called ++ * at the correct moment. ++ * For child providers in other providers, the reference count is done to ++ * ensure that cross referencing is recorded. These should be cleared up ++ * through that providers teardown, as part of freeing its child libctx. ++ */ ++ + int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate) + { + struct child_prov_globals *gbl; ++ const OSSL_CORE_HANDLE *parent_handle; + + gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov), + OSSL_LIB_CTX_CHILD_PROVIDER_INDEX, +@@ -289,12 +302,16 @@ int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate) + if (gbl == NULL) + return 0; + +- return gbl->c_prov_up_ref(ossl_provider_get_parent(prov), activate); ++ parent_handle = ossl_provider_get_parent(prov); ++ if (parent_handle == gbl->handle) ++ return 1; ++ return gbl->c_prov_up_ref(parent_handle, activate); + } + + int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate) + { + struct child_prov_globals *gbl; ++ const OSSL_CORE_HANDLE *parent_handle; + + gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov), + OSSL_LIB_CTX_CHILD_PROVIDER_INDEX, +@@ -302,5 +319,8 @@ int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate) + if (gbl == NULL) + return 0; + ++ parent_handle = ossl_provider_get_parent(prov); ++ if (parent_handle == gbl->handle) ++ return 1; + return gbl->c_prov_free(ossl_provider_get_parent(prov), deactivate); + } +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch openssl-3.0.2/debian/patches/lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch --- openssl-3.0.2/debian/patches/lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-3.0.2/debian/patches/lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch 2023-09-30 16:34:05.000000000 +0200 @@ -0,0 +1,239 @@ +From 37a6e9efe013f9e6a840e38beb81e44b9fee3629 Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Wed, 4 May 2022 09:15:29 +0200 +Subject: [PATCH 7/7] Add method store cache flush and method removal to + non-EVP operations + +evp_method_store_flush() and evp_method_store_remove_all_provided() +only cover EVP operations, but not encoders, decoders and store loaders. +This adds corresponding methods for those as well. Without this, their +method stores are never cleaned up when the corresponding providers are +deactivated or otherwise modified. + +Reviewed-by: Tomas Mraz +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/18151) + +(cherry picked from commit 32e3c071373280b69be02ba91fc3204495e2e1bf) +Origin: https://github.com/openssl/openssl/commit/37a6e9efe013f9e6a840e38beb81e44b9fee3629 +Bug: https://github.com/openssl/openssl/pull/18876 +Applied-Upstream: 3.0.4 +--- + crypto/encode_decode/decoder_meth.c | 19 ++++++++++++++ + crypto/encode_decode/encoder_meth.c | 19 ++++++++++++++ + crypto/provider_core.c | 39 ++++++++++++++++++++++++++--- + crypto/store/store_meth.c | 19 ++++++++++++++ + include/crypto/decoder.h | 2 ++ + include/crypto/encoder.h | 10 +++++++- + include/crypto/store.h | 2 ++ + 7 files changed, 106 insertions(+), 4 deletions(-) + +diff --git a/crypto/encode_decode/decoder_meth.c b/crypto/encode_decode/decoder_meth.c +index cb53343c54..434385f04f 100644 +--- a/crypto/encode_decode/decoder_meth.c ++++ b/crypto/encode_decode/decoder_meth.c +@@ -446,6 +446,25 @@ OSSL_DECODER *ossl_decoder_fetch_by_number(OSSL_LIB_CTX *libctx, int id, + return method; + } + ++int ossl_decoder_store_cache_flush(OSSL_LIB_CTX *libctx) ++{ ++ OSSL_METHOD_STORE *store = get_decoder_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_cache_flush_all(store); ++ return 1; ++} ++ ++int ossl_decoder_store_remove_all_provided(const OSSL_PROVIDER *prov) ++{ ++ OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov); ++ OSSL_METHOD_STORE *store = get_decoder_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_remove_all_provided(store, prov); ++ return 1; ++} ++ + /* + * Library of basic method functions + */ +diff --git a/crypto/encode_decode/encoder_meth.c b/crypto/encode_decode/encoder_meth.c +index eb8fd2f457..52bbd2baac 100644 +--- a/crypto/encode_decode/encoder_meth.c ++++ b/crypto/encode_decode/encoder_meth.c +@@ -455,6 +455,25 @@ OSSL_ENCODER *ossl_encoder_fetch_by_number(OSSL_LIB_CTX *libctx, int id, + return method; + } + ++int ossl_encoder_store_cache_flush(OSSL_LIB_CTX *libctx) ++{ ++ OSSL_METHOD_STORE *store = get_encoder_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_cache_flush_all(store); ++ return 1; ++} ++ ++int ossl_encoder_store_remove_all_provided(const OSSL_PROVIDER *prov) ++{ ++ OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov); ++ OSSL_METHOD_STORE *store = get_encoder_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_remove_all_provided(store, prov); ++ return 1; ++} ++ + /* + * Library of basic method functions + */ +diff --git a/crypto/provider_core.c b/crypto/provider_core.c +index fef6fdca9b..c089c1b70d 100644 +--- a/crypto/provider_core.c ++++ b/crypto/provider_core.c +@@ -15,7 +15,10 @@ + #include + #include + #include "crypto/cryptlib.h" ++#include "crypto/decoder.h" /* ossl_decoder_store_cache_flush */ ++#include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */ + #include "crypto/evp.h" /* evp_method_store_cache_flush */ ++#include "crypto/store.h" /* ossl_store_loader_store_cache_flush */ + #include "crypto/rand.h" + #include "internal/nelem.h" + #include "internal/thread_once.h" +@@ -1159,8 +1162,22 @@ static int provider_flush_store_cache(const OSSL_PROVIDER *prov) + freeing = store->freeing; + CRYPTO_THREAD_unlock(store->lock); + +- if (!freeing) +- return evp_method_store_cache_flush(prov->libctx); ++ if (!freeing) { ++ int acc ++ = evp_method_store_cache_flush(prov->libctx) ++#ifndef FIPS_MODULE ++ + ossl_encoder_store_cache_flush(prov->libctx) ++ + ossl_decoder_store_cache_flush(prov->libctx) ++ + ossl_store_loader_store_cache_flush(prov->libctx) ++#endif ++ ; ++ ++#ifndef FIPS_MODULE ++ return acc == 4; ++#else ++ return acc == 1; ++#endif ++ } + return 1; + } + +@@ -1178,12 +1195,28 @@ static int provider_remove_store_methods(OSSL_PROVIDER *prov) + CRYPTO_THREAD_unlock(store->lock); + + if (!freeing) { ++ int acc; ++ ++ if (!CRYPTO_THREAD_read_lock(prov->opbits_lock)) ++ return 0; + OPENSSL_free(prov->operation_bits); + prov->operation_bits = NULL; + prov->operation_bits_sz = 0; + CRYPTO_THREAD_unlock(prov->opbits_lock); + +- return evp_method_store_remove_all_provided(prov); ++ acc = evp_method_store_remove_all_provided(prov) ++#ifndef FIPS_MODULE ++ + ossl_encoder_store_remove_all_provided(prov) ++ + ossl_decoder_store_remove_all_provided(prov) ++ + ossl_store_loader_store_remove_all_provided(prov) ++#endif ++ ; ++ ++#ifndef FIPS_MODULE ++ return acc == 4; ++#else ++ return acc == 1; ++#endif + } + return 1; + } +diff --git a/crypto/store/store_meth.c b/crypto/store/store_meth.c +index db13f62c66..a472b15bb6 100644 +--- a/crypto/store/store_meth.c ++++ b/crypto/store/store_meth.c +@@ -395,6 +395,25 @@ OSSL_STORE_LOADER *ossl_store_loader_fetch_by_number(OSSL_LIB_CTX *libctx, + return method; + } + ++int ossl_store_loader_store_cache_flush(OSSL_LIB_CTX *libctx) ++{ ++ OSSL_METHOD_STORE *store = get_loader_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_cache_flush_all(store); ++ return 1; ++} ++ ++int ossl_store_loader_store_remove_all_provided(const OSSL_PROVIDER *prov) ++{ ++ OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov); ++ OSSL_METHOD_STORE *store = get_loader_store(libctx); ++ ++ if (store != NULL) ++ return ossl_method_store_remove_all_provided(store, prov); ++ return 1; ++} ++ + /* + * Library of basic method functions + */ +diff --git a/include/crypto/decoder.h b/include/crypto/decoder.h +index cc06ef2926..95afd25b0b 100644 +--- a/include/crypto/decoder.h ++++ b/include/crypto/decoder.h +@@ -38,5 +38,7 @@ int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx, + const char *propquery); + + int ossl_decoder_get_number(const OSSL_DECODER *encoder); ++int ossl_decoder_store_cache_flush(OSSL_LIB_CTX *libctx); ++int ossl_decoder_store_remove_all_provided(const OSSL_PROVIDER *prov); + + #endif +diff --git a/include/crypto/encoder.h b/include/crypto/encoder.h +index 09d445d210..ae56131eb3 100644 +--- a/include/crypto/encoder.h ++++ b/include/crypto/encoder.h +@@ -7,8 +7,16 @@ + * https://www.openssl.org/source/license.html + */ + +-#include ++#ifndef OSSL_CRYPTO_ENCODER_H ++# define OSSL_CRYPTO_ENCODER_H ++# pragma once ++ ++# include + + OSSL_ENCODER *ossl_encoder_fetch_by_number(OSSL_LIB_CTX *libctx, int id, + const char *properties); + int ossl_encoder_get_number(const OSSL_ENCODER *encoder); ++int ossl_encoder_store_cache_flush(OSSL_LIB_CTX *libctx); ++int ossl_encoder_store_remove_all_provided(const OSSL_PROVIDER *prov); ++ ++#endif +diff --git a/include/crypto/store.h b/include/crypto/store.h +index 13d2646bba..9b7be71acd 100644 +--- a/include/crypto/store.h ++++ b/include/crypto/store.h +@@ -17,5 +17,7 @@ + + void ossl_store_cleanup_int(void); + int ossl_store_loader_get_number(const OSSL_STORE_LOADER *loader); ++int ossl_store_loader_store_cache_flush(OSSL_LIB_CTX *libctx); ++int ossl_store_loader_store_remove_all_provided(const OSSL_PROVIDER *prov); + + #endif +-- +2.39.2 + diff -Nru openssl-3.0.2/debian/patches/series openssl-3.0.2/debian/patches/series --- openssl-3.0.2/debian/patches/series 2023-05-24 19:12:55.000000000 +0200 +++ openssl-3.0.2/debian/patches/series 2023-09-30 16:34:05.000000000 +0200 @@ -75,3 +75,25 @@ CVE-2023-0466.patch CVE-2023-1255.patch CVE-2023-2650.patch + +# September 2023 SRU for Jammy with the large series for performance + +# LP #1990216 (Blowfish OFB/CFB wrong default key length) +lp1990216-0001-Fix-regression-in-default-key-length-for-Blowfish-CF.patch +lp1990216-0002-Test-the-default-key-length-of-the-Blowfish-ciphers.patch + +# LP #2023545 (Ignored S/MIME signature errors) +lp2023545-0001-Release-the-drbg-in-the-global-default-context-befor.patch + +# LP #1994165 (ibmca engine dumps core) +lp1994165-0001-REGRESSION-CMS_final-do-not-ignore-CMS_dataFinal-res.patch +lp1994165-0002-Handle-SMIME_crlf_copy-return-code.patch + +# LP #2033422 (performance series) +lp2033422-0001-Drop-ossl_provider_clear_all_operation_bits-and-all-.patch +lp2033422-0002-Refactor-method-construction-pre-and-post-condition.patch +lp2033422-0003-Don-t-empty-the-method-store-when-flushing-the-query.patch +lp2033422-0004-Make-it-possible-to-remove-methods-by-the-provider-t.patch +lp2033422-0005-Complete-the-cleanup-of-an-algorithm-in-OSSL_METHOD_.patch +lp2033422-0006-For-child-libctx-provider-don-t-count-self-reference.patch +lp2033422-0007-Add-method-store-cache-flush-and-method-removal-to-n.patch