diff -Nru openssl-3.0.2/apps/ca.c openssl-3.0.3/apps/ca.c
--- openssl-3.0.2/apps/ca.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/ca.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -2367,7 +2367,7 @@
 
     case REV_CRL_REASON:
         for (i = 0; i < 8; i++) {
-            if (strcasecmp(rev_arg, crl_reasons[i]) == 0) {
+            if (OPENSSL_strcasecmp(rev_arg, crl_reasons[i]) == 0) {
                 reason = crl_reasons[i];
                 break;
             }
@@ -2584,7 +2584,7 @@
     }
     if (reason_str) {
         for (i = 0; i < NUM_REASONS; i++) {
-            if (strcasecmp(reason_str, crl_reasons[i]) == 0) {
+            if (OPENSSL_strcasecmp(reason_str, crl_reasons[i]) == 0) {
                 reason_code = i;
                 break;
             }
diff -Nru openssl-3.0.2/apps/cmp.c openssl-3.0.3/apps/cmp.c
--- openssl-3.0.2/apps/cmp.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/cmp.c	2022-05-03 15:32:01.000000000 +0200
@@ -1745,7 +1745,7 @@
     valptr[0] = '\0';
     valptr++;
 
-    if (strncasecmp(valptr, "int:", 4) != 0) {
+    if (OPENSSL_strncasecmp(valptr, "int:", 4) != 0) {
         CMP_err("missing 'int:' in -geninfo option");
         return 0;
     }
diff -Nru openssl-3.0.2/apps/ecparam.c openssl-3.0.3/apps/ecparam.c
--- openssl-3.0.2/apps/ecparam.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/ecparam.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -229,7 +229,7 @@
                        point_format, 0);
         *p = OSSL_PARAM_construct_end();
 
-        if (strcasecmp(curve_name, "SM2") == 0)
+        if (OPENSSL_strcasecmp(curve_name, "SM2") == 0)
             gctx_params = EVP_PKEY_CTX_new_from_name(NULL, "sm2", NULL);
         else
             gctx_params = EVP_PKEY_CTX_new_from_name(NULL, "ec", NULL);
diff -Nru openssl-3.0.2/apps/lib/apps.c openssl-3.0.3/apps/lib/apps.c
--- openssl-3.0.2/apps/lib/apps.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/lib/apps.c	2022-05-03 15:32:01.000000000 +0200
@@ -688,8 +688,8 @@
     int ret = 0;
     char *pass_string;
 
-    if (exclude_http && (strncasecmp(uri, "http://", 7) == 0
-                         || strncasecmp(uri, "https://", 8) == 0)) {
+    if (exclude_http && (OPENSSL_strncasecmp(uri, "http://", 7) == 0
+                         || OPENSSL_strncasecmp(uri, "https://", 8) == 0)) {
         BIO_printf(bio_err, "error: HTTP retrieval not allowed for %s\n", desc);
         return ret;
     }
@@ -1182,20 +1182,20 @@
 
 int set_dateopt(unsigned long *dateopt, const char *arg)
 {
-    if (strcasecmp(arg, "rfc_822") == 0)
+    if (OPENSSL_strcasecmp(arg, "rfc_822") == 0)
         *dateopt = ASN1_DTFLGS_RFC822;
-    else if (strcasecmp(arg, "iso_8601") == 0)
+    else if (OPENSSL_strcasecmp(arg, "iso_8601") == 0)
         *dateopt = ASN1_DTFLGS_ISO8601;
     return 0;
 }
 
 int set_ext_copy(int *copy_type, const char *arg)
 {
-    if (strcasecmp(arg, "none") == 0)
+    if (OPENSSL_strcasecmp(arg, "none") == 0)
         *copy_type = EXT_COPY_NONE;
-    else if (strcasecmp(arg, "copy") == 0)
+    else if (OPENSSL_strcasecmp(arg, "copy") == 0)
         *copy_type = EXT_COPY_ADD;
-    else if (strcasecmp(arg, "copyall") == 0)
+    else if (OPENSSL_strcasecmp(arg, "copyall") == 0)
         *copy_type = EXT_COPY_ALL;
     else
         return 0;
@@ -1275,7 +1275,7 @@
     }
 
     for (ptbl = in_tbl; ptbl->name; ptbl++) {
-        if (strcasecmp(arg, ptbl->name) == 0) {
+        if (OPENSSL_strcasecmp(arg, ptbl->name) == 0) {
             *flags &= ~ptbl->mask;
             if (c)
                 *flags |= ptbl->flag;
diff -Nru openssl-3.0.2/apps/lib/engine_loader.c openssl-3.0.3/apps/lib/engine_loader.c
--- openssl-3.0.2/apps/lib/engine_loader.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/lib/engine_loader.c	2022-05-03 15:32:01.000000000 +0200
@@ -71,7 +71,7 @@
     char *keyid = NULL;
     OSSL_STORE_LOADER_CTX *ctx = NULL;
 
-    if (strncasecmp(p, ENGINE_SCHEME_COLON, sizeof(ENGINE_SCHEME_COLON) - 1)
+    if (OPENSSL_strncasecmp(p, ENGINE_SCHEME_COLON, sizeof(ENGINE_SCHEME_COLON) - 1)
         != 0)
         return NULL;
     p += sizeof(ENGINE_SCHEME_COLON) - 1;
diff -Nru openssl-3.0.2/apps/lib/http_server.c openssl-3.0.3/apps/lib/http_server.c
--- openssl-3.0.2/apps/lib/http_server.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/lib/http_server.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -453,10 +453,11 @@
         }
         *line_end = '\0';
         /* https://tools.ietf.org/html/rfc7230#section-6.3 Persistence */
-        if (found_keep_alive != NULL && strcasecmp(key, "Connection") == 0) {
-            if (strcasecmp(value, "keep-alive") == 0)
+        if (found_keep_alive != NULL
+            && OPENSSL_strcasecmp(key, "Connection") == 0) {
+            if (OPENSSL_strcasecmp(value, "keep-alive") == 0)
                 *found_keep_alive = 1;
-            else if (strcasecmp(value, "close") == 0)
+            else if (OPENSSL_strcasecmp(value, "close") == 0)
                 *found_keep_alive = 0;
         }
     }
diff -Nru openssl-3.0.2/apps/lib/names.c openssl-3.0.3/apps/lib/names.c
--- openssl-3.0.2/apps/lib/names.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/lib/names.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,14 +11,11 @@
 #include <openssl/bio.h>
 #include <openssl/safestack.h>
 #include "names.h"
-
-#ifdef _WIN32
-# define strcasecmp _stricmp
-#endif
+#include "openssl/crypto.h"
 
 int name_cmp(const char * const *a, const char * const *b)
 {
-    return strcasecmp(*a, *b);
+    return OPENSSL_strcasecmp(*a, *b);
 }
 
 void collect_names(const char *name, void *vdata)
diff -Nru openssl-3.0.2/apps/lib/vms_term_sock.c openssl-3.0.3/apps/lib/vms_term_sock.c
--- openssl-3.0.2/apps/lib/vms_term_sock.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/lib/vms_term_sock.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2016 VMS Software, Inc. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -132,7 +132,7 @@
         len;
 
     LogMessage ("Enter 'q' or 'Q' to quit ...");
-    while (strcasecmp (TermBuff, "Q")) {
+    while (OPENSSL_strcasecmp (TermBuff, "Q")) {
         /*
         ** Create the terminal socket
         */
diff -Nru openssl-3.0.2/apps/list.c openssl-3.0.3/apps/list.c
--- openssl-3.0.2/apps/list.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/list.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -71,7 +71,7 @@
 {
     if (select_name != NULL
         && (c == NULL
-            || strcasecmp(select_name,  EVP_CIPHER_get0_name(c)) != 0))
+            || OPENSSL_strcasecmp(select_name,  EVP_CIPHER_get0_name(c)) != 0))
         return;
     if (c != NULL) {
         BIO_printf(arg, "  %s\n", EVP_CIPHER_get0_name(c));
@@ -370,7 +370,7 @@
 
 static int rand_cmp(const EVP_RAND * const *a, const EVP_RAND * const *b)
 {
-    int ret = strcasecmp(EVP_RAND_get0_name(*a), EVP_RAND_get0_name(*b));
+    int ret = OPENSSL_strcasecmp(EVP_RAND_get0_name(*a), EVP_RAND_get0_name(*b));
 
     if (ret == 0)
         ret = strcmp(OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(*a)),
@@ -404,7 +404,7 @@
         const EVP_RAND *m = sk_EVP_RAND_value(rands, i);
 
         if (select_name != NULL
-            && strcasecmp(EVP_RAND_get0_name(m), select_name) != 0)
+            && OPENSSL_strcasecmp(EVP_RAND_get0_name(m), select_name) != 0)
             continue;
         BIO_printf(bio_out, "  %s", EVP_RAND_get0_name(m));
         BIO_printf(bio_out, " @ %s\n",
@@ -463,7 +463,7 @@
         if (gettables != NULL)
             for (; gettables->key != NULL; gettables++) {
                 /* State has been dealt with already, so ignore */
-                if (strcasecmp(gettables->key, OSSL_RAND_PARAM_STATE) == 0)
+                if (OPENSSL_strcasecmp(gettables->key, OSSL_RAND_PARAM_STATE) == 0)
                     continue;
                 /* Outside of verbose mode, we skip non-string values */
                 if (gettables->data_type != OSSL_PARAM_UTF8_STRING
diff -Nru openssl-3.0.2/apps/ocsp.c openssl-3.0.3/apps/ocsp.c
--- openssl-3.0.2/apps/ocsp.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/ocsp.c	2022-05-03 15:32:01.000000000 +0200
@@ -1115,6 +1115,11 @@
             single = OCSP_basic_add1_status(bs, cid,
                                             V_OCSP_CERTSTATUS_REVOKED,
                                             reason, revtm, thisupd, nextupd);
+            if (single == NULL) {
+                *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
+                                             NULL);
+                goto end;
+            }
             if (invtm != NULL)
                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date,
                                              invtm, 0, 0);
diff -Nru openssl-3.0.2/apps/rehash.c openssl-3.0.3/apps/rehash.c
--- openssl-3.0.2/apps/rehash.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/rehash.c	2022-05-03 15:32:01.000000000 +0200
@@ -214,7 +214,7 @@
         return -1;
     for (type = OSSL_NELEM(suffixes) - 1; type > 0; type--) {
         const char *suffix = suffixes[type];
-        if (strncasecmp(suffix, &filename[i], strlen(suffix)) == 0)
+        if (OPENSSL_strncasecmp(suffix, &filename[i], strlen(suffix)) == 0)
             break;
     }
     i += strlen(suffixes[type]);
@@ -249,7 +249,7 @@
     if ((ext = strrchr(filename, '.')) == NULL)
         goto end;
     for (i = 0; i < OSSL_NELEM(extensions); i++) {
-        if (strcasecmp(extensions[i], ext + 1) == 0)
+        if (OPENSSL_strcasecmp(extensions[i], ext + 1) == 0)
             break;
     }
     if (i >= OSSL_NELEM(extensions))
diff -Nru openssl-3.0.2/apps/req.c openssl-3.0.3/apps/req.c
--- openssl-3.0.2/apps/req.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/req.c	2022-05-03 15:32:01.000000000 +0200
@@ -992,7 +992,7 @@
             goto end;
         }
         fprintf(stdout, "Modulus=");
-        if (EVP_PKEY_is_a(tpubkey, "RSA")) {
+        if (EVP_PKEY_is_a(tpubkey, "RSA") || EVP_PKEY_is_a(tpubkey, "RSA-PSS")) {
             BIGNUM *n = NULL;
 
             if (!EVP_PKEY_get_bn_param(tpubkey, "n", &n))
diff -Nru openssl-3.0.2/apps/rsa.c openssl-3.0.3/apps/rsa.c
--- openssl-3.0.2/apps/rsa.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/rsa.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -257,7 +257,7 @@
         ERR_print_errors(bio_err);
         goto end;
     }
-    if (!EVP_PKEY_is_a(pkey, "RSA")) {
+    if (!EVP_PKEY_is_a(pkey, "RSA") && !EVP_PKEY_is_a(pkey, "RSA-PSS")) {
         BIO_printf(bio_err, "Not an RSA key\n");
         goto end;
     }
diff -Nru openssl-3.0.2/apps/s_server.c openssl-3.0.3/apps/s_server.c
--- openssl-3.0.2/apps/s_server.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/s_server.c	2022-05-03 15:32:01.000000000 +0200
@@ -432,7 +432,7 @@
         return SSL_TLSEXT_ERR_NOACK;
 
     if (servername != NULL) {
-        if (strcasecmp(servername, p->servername))
+        if (OPENSSL_strcasecmp(servername, p->servername))
             return p->extension_error;
         if (ctx2 != NULL) {
             BIO_printf(p->biodebug, "Switching server context.\n");
diff -Nru openssl-3.0.2/apps/ts.c openssl-3.0.3/apps/ts.c
--- openssl-3.0.2/apps/ts.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/ts.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -976,6 +976,10 @@
     const char *propq = app_get0_propq();
 
     cert_ctx = X509_STORE_new();
+    if (cert_ctx == NULL) {
+        BIO_printf(bio_err, "memory allocation failure\n");
+        return NULL;
+    }
     X509_STORE_set_verify_cb(cert_ctx, verify_cb);
     if (CApath != NULL) {
         lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_hash_dir());
diff -Nru openssl-3.0.2/apps/x509.c openssl-3.0.3/apps/x509.c
--- openssl-3.0.2/apps/x509.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/apps/x509.c	2022-05-03 15:32:01.000000000 +0200
@@ -954,7 +954,7 @@
                 purpose_print(out, x, X509_PURPOSE_get0(j));
         } else if (i == modulus) {
             BIO_printf(out, "Modulus=");
-            if (EVP_PKEY_is_a(pkey, "RSA")) {
+            if (EVP_PKEY_is_a(pkey, "RSA") || EVP_PKEY_is_a(pkey, "RSA-PSS")) {
                 BIGNUM *n = NULL;
 
                 /* Every RSA key has an 'n' */
diff -Nru openssl-3.0.2/CHANGES.md openssl-3.0.3/CHANGES.md
--- openssl-3.0.2/CHANGES.md	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/CHANGES.md	2022-05-03 15:32:01.000000000 +0200
@@ -28,6 +28,114 @@
 
 [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
 
+### Changes between 3.0.2 and 3.0.3 [3 May 2022]
+
+ * Fixed a bug in the c_rehash script which was not properly sanitising shell
+   metacharacters to prevent command injection.  This script is distributed by
+   some operating systems in a manner where it is automatically executed.  On
+   such operating systems, an attacker could execute arbitrary commands with the
+   privileges of the script.
+
+   Use of the c_rehash script is considered obsolete and should be replaced
+   by the OpenSSL rehash command line tool.
+   (CVE-2022-1292)
+
+   *Tomáš Mráz*
+
+ * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer
+   certificate on an OCSP response. The bug caused the function in the case
+   where the (non-default) flag OCSP_NOCHECKS is used to return a postivie
+   response (meaning a successful verification) even in the case where the
+   response signing certificate fails to verify.
+
+   It is anticipated that most users of `OCSP_basic_verify` will not use the
+   OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return
+   a negative value (indicating a fatal error) in the case of a certificate
+   verification failure. The normal expected return value in this case would be
+   0.
+
+   This issue also impacts the command line OpenSSL "ocsp" application. When
+   verifying an ocsp response with the "-no_cert_checks" option the command line
+   application will report that the verification is successful even though it
+   has in fact failed. In this case the incorrect successful response will also
+   be accompanied by error messages showing the failure and contradicting the
+   apparently successful result.
+   ([CVE-2022-1343])
+
+   *Matt Caswell*
+
+ * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the
+   AAD data as the MAC key. This made the MAC key trivially predictable.
+
+   An attacker could exploit this issue by performing a man-in-the-middle attack
+   to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such
+   that the modified data would still pass the MAC integrity check.
+
+   Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0
+   endpoint will always be rejected by the recipient and the connection will
+   fail at that point. Many application protocols require data to be sent from
+   the client to the server first. Therefore, in such a case, only an OpenSSL
+   3.0 server would be impacted when talking to a non-OpenSSL 3.0 client.
+
+   If both endpoints are OpenSSL 3.0 then the attacker could modify data being
+   sent in both directions. In this case both clients and servers could be
+   affected, regardless of the application protocol.
+
+   Note that in the absence of an attacker this bug means that an OpenSSL 3.0
+   endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete
+   the handshake when using this ciphersuite.
+
+   The confidentiality of data is not impacted by this issue, i.e. an attacker
+   cannot decrypt data that has been encrypted using this ciphersuite - they can
+   only modify it.
+
+   In order for this attack to work both endpoints must legitimately negotiate
+   the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in
+   OpenSSL 3.0, and is not available within the default provider or the default
+   ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been
+   negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the
+   following must have occurred:
+
+   1) OpenSSL must have been compiled with the (non-default) compile time option
+      enable-weak-ssl-ciphers
+
+   2) OpenSSL must have had the legacy provider explicitly loaded (either
+      through application code or via configuration)
+
+   3) The ciphersuite must have been explicitly added to the ciphersuite list
+
+   4) The libssl security level must have been set to 0 (default is 1)
+
+   5) A version of SSL/TLS below TLSv1.3 must have been negotiated
+
+   6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any
+      others that both endpoints have in common
+   (CVE-2022-1434)
+
+   *Matt Caswell*
+
+ * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory
+   occuppied by the removed hash table entries.
+
+   This function is used when decoding certificates or keys. If a long lived
+   process periodically decodes certificates or keys its memory usage will
+   expand without bounds and the process might be terminated by the operating
+   system causing a denial of service. Also traversing the empty hash table
+   entries will take increasingly more time.
+
+   Typically such long lived processes might be TLS clients or TLS servers
+   configured to accept client certificate authentication.
+   (CVE-2022-1473)
+
+   *Hugo Landau, Aliaksei Levin*
+
+ * The functions `OPENSSL_LH_stats` and `OPENSSL_LH_stats_bio` now only report
+   the `num_items`, `num_nodes` and `num_alloc_nodes` statistics. All other
+   statistics are no longer supported. For compatibility, these statistics are
+   still listed in the output but are now always reported as zero.
+
+   *Hugo Landau*
+
 ### Changes between 3.0.1 and 3.0.2 [15 Mar 2022]
 
  * Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
diff -Nru openssl-3.0.2/Configurations/platform/AIX.pm openssl-3.0.3/Configurations/platform/AIX.pm
--- openssl-3.0.2/Configurations/platform/AIX.pm	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/Configurations/platform/AIX.pm	2022-05-03 15:32:01.000000000 +0200
@@ -25,5 +25,5 @@
     return $in_libname
         if $unified_info{attributes}->{libraries}->{$_[1]}->{noinst};
 
-    return platform::BASE->staticname($_[1]) . '_a';
+    return platform::BASE->staticname($_[1]) . ($disabled{shared} ? '' : '_a');
 }
diff -Nru openssl-3.0.2/CONTRIBUTING.md openssl-3.0.3/CONTRIBUTING.md
--- openssl-3.0.2/CONTRIBUTING.md	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/CONTRIBUTING.md	2022-05-03 15:32:01.000000000 +0200
@@ -60,7 +60,7 @@
     GitHub Actions and AppVeyor are required, and they are started automatically
     whenever a PR is created or updated.
 
-    [coding style]: https://www.openssl.org/policies/codingstyle.html
+    [coding style]: https://www.openssl.org/policies/technical/coding-style.html
 
  5. When at all possible, patches should include tests. These can
     either be added to an existing test, or completely new.  Please see
diff -Nru openssl-3.0.2/crypto/asn1/ameth_lib.c openssl-3.0.3/crypto/asn1/ameth_lib.c
--- openssl-3.0.2/crypto/asn1/ameth_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/asn1/ameth_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,7 +10,6 @@
 /* We need to use some engine deprecated APIs */
 #define OPENSSL_SUPPRESS_DEPRECATED
 
-#include "e_os.h"               /* for strncasecmp */
 #include "internal/cryptlib.h"
 #include <stdio.h>
 #include <openssl/asn1t.h>
@@ -134,7 +133,7 @@
         if (ameth->pkey_flags & ASN1_PKEY_ALIAS)
             continue;
         if ((int)strlen(ameth->pem_str) == len
-            && strncasecmp(ameth->pem_str, str, len) == 0)
+            && OPENSSL_strncasecmp(ameth->pem_str, str, len) == 0)
             return ameth;
     }
     return NULL;
diff -Nru openssl-3.0.2/crypto/asn1/asn1_gen.c openssl-3.0.3/crypto/asn1/asn1_gen.c
--- openssl-3.0.2/crypto/asn1/asn1_gen.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/asn1/asn1_gen.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,7 +10,6 @@
 #include "internal/cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/x509v3.h>
-#include "e_os.h" /* strncasecmp() */
 
 #define ASN1_GEN_FLAG           0x10000
 #define ASN1_GEN_FLAG_IMP       (ASN1_GEN_FLAG|1)
@@ -565,7 +564,8 @@
 
     tntmp = tnst;
     for (i = 0; i < OSSL_NELEM(tnst); i++, tntmp++) {
-        if ((len == tntmp->len) && (strncasecmp(tntmp->strnam, tagstr, len) == 0))
+        if ((len == tntmp->len)
+            && (OPENSSL_strncasecmp(tntmp->strnam, tagstr, len) == 0))
             return tntmp->tag;
     }
 
diff -Nru openssl-3.0.2/crypto/bn/bn_div.c openssl-3.0.3/crypto/bn/bn_div.c
--- openssl-3.0.2/crypto/bn/bn_div.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/bn/bn_div.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -446,8 +446,10 @@
     snum->neg = num_neg;
     snum->top = div_n;
     snum->flags |= BN_FLG_FIXED_TOP;
-    if (rm != NULL)
-        bn_rshift_fixed_top(rm, snum, norm_shift);
+
+    if (rm != NULL && bn_rshift_fixed_top(rm, snum, norm_shift) == 0)
+        goto err;
+
     BN_CTX_end(ctx);
     return 1;
  err:
diff -Nru openssl-3.0.2/crypto/bn/bn_exp.c openssl-3.0.3/crypto/bn/bn_exp.c
--- openssl-3.0.2/crypto/bn/bn_exp.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/bn/bn_exp.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -187,13 +187,14 @@
         return ret;
     }
 
+    BN_RECP_CTX_init(&recp);
+
     BN_CTX_start(ctx);
     aa = BN_CTX_get(ctx);
     val[0] = BN_CTX_get(ctx);
     if (val[0] == NULL)
         goto err;
 
-    BN_RECP_CTX_init(&recp);
     if (m->neg) {
         /* ignore sign of 'm' */
         if (!BN_copy(aa, m))
diff -Nru openssl-3.0.2/crypto/camellia/camellia.c openssl-3.0.3/crypto/camellia/camellia.c
--- openssl-3.0.2/crypto/camellia/camellia.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/camellia/camellia.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -499,9 +499,9 @@
     PUTU32(plaintext + 12, s1);
 }
 
-void Camellia_DecryptBlock(int keyBitLength, const u8 plaintext[],
-                           const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
+void Camellia_DecryptBlock(int keyBitLength, const u8 ciphertext[],
+                           const KEY_TABLE_TYPE keyTable, u8 plaintext[])
 {
     Camellia_DecryptBlock_Rounds(keyBitLength == 128 ? 3 : 4,
-                                 plaintext, keyTable, ciphertext);
+                                 ciphertext, keyTable, plaintext);
 }
diff -Nru openssl-3.0.2/crypto/chacha/build.info openssl-3.0.3/crypto/chacha/build.info
--- openssl-3.0.2/crypto/chacha/build.info	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/chacha/build.info	2022-05-03 15:32:01.000000000 +0200
@@ -5,7 +5,7 @@
   $CHACHAASM_x86=chacha-x86.s
   $CHACHAASM_x86_64=chacha-x86_64.s
 
-  $CHACHAASM_ia64=chacha-ia64.S
+  $CHACHAASM_ia64=chacha-ia64.s
 
   $CHACHAASM_s390x=chacha-s390x.S
 
@@ -36,4 +36,4 @@
 INCLUDE[chacha-s390x.o]=..
 GENERATE[chacha-c64xplus.S]=asm/chacha-c64xplus.pl
 GENERATE[chacha-s390x.S]=asm/chacha-s390x.pl
-GENERATE[chacha-ia64.S]=asm/chacha-ia64.pl
+GENERATE[chacha-ia64.s]=asm/chacha-ia64.pl
diff -Nru openssl-3.0.2/crypto/cms/cms_io.c openssl-3.0.3/crypto/cms/cms_io.c
--- openssl-3.0.2/crypto/cms/cms_io.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/cms/cms_io.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -41,8 +41,11 @@
     ci = ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(CMS_ContentInfo), bp, cms,
                               ossl_cms_ctx_get0_libctx(ctx),
                               ossl_cms_ctx_get0_propq(ctx));
-    if (ci != NULL)
+    if (ci != NULL) {
+        ERR_set_mark();
         ossl_cms_resolve_libctx(ci);
+        ERR_pop_to_mark();
+    }
     return ci;
 }
 
@@ -104,8 +107,11 @@
                                                (ASN1_VALUE **)cms,
                                                ossl_cms_ctx_get0_libctx(ctx),
                                                ossl_cms_ctx_get0_propq(ctx));
-    if (ci != NULL)
+    if (ci != NULL) {
+        ERR_set_mark();
         ossl_cms_resolve_libctx(ci);
+        ERR_pop_to_mark();
+    }
     return ci;
 }
 
diff -Nru openssl-3.0.2/crypto/conf/conf_def.c openssl-3.0.3/crypto/conf/conf_def.c
--- openssl-3.0.2/crypto/conf/conf_def.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/conf/conf_def.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
 
 #include <stdio.h>
 #include <string.h>
-#include "e_os.h" /* strcasecmp and struct stat */
+#include "e_os.h" /* struct stat */
 #ifdef __TANDEM
 # include <sys/types.h> /* needed for stat.h */
 # include <sys/stat.h> /* struct stat */
@@ -192,11 +192,11 @@
 /* Parse a boolean value and fill in *flag. Return 0 on error. */
 static int parsebool(const char *pval, int *flag)
 {
-    if (strcasecmp(pval, "on") == 0
-            || strcasecmp(pval, "true") == 0) {
+    if (OPENSSL_strcasecmp(pval, "on") == 0
+            || OPENSSL_strcasecmp(pval, "true") == 0) {
         *flag = 1;
-    } else if (strcasecmp(pval, "off") == 0
-            || strcasecmp(pval, "false") == 0) {
+    } else if (OPENSSL_strcasecmp(pval, "off") == 0
+            || OPENSSL_strcasecmp(pval, "false") == 0) {
         *flag = 0;
     } else {
         ERR_raise(ERR_LIB_CONF, CONF_R_INVALID_PRAGMA);
@@ -839,8 +839,10 @@
         namelen = strlen(filename);
 
 
-        if ((namelen > 5 && strcasecmp(filename + namelen - 5, ".conf") == 0)
-            || (namelen > 4 && strcasecmp(filename + namelen - 4, ".cnf") == 0)) {
+        if ((namelen > 5
+             && OPENSSL_strcasecmp(filename + namelen - 5, ".conf") == 0)
+             || (namelen > 4
+                 && OPENSSL_strcasecmp(filename + namelen - 4, ".cnf") == 0)) {
             size_t newlen;
             char *newpath;
             BIO *bio;
diff -Nru openssl-3.0.2/crypto/context.c openssl-3.0.3/crypto/context.c
--- openssl-3.0.2/crypto/context.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/context.c	2022-05-03 15:32:01.000000000 +0200
@@ -14,6 +14,7 @@
 #include "internal/core.h"
 #include "internal/bio.h"
 #include "internal/provider.h"
+#include "crypto/ctype.h"
 
 struct ossl_lib_ctx_onfree_list_st {
     ossl_lib_ctx_onfree_fn *fn;
@@ -150,7 +151,8 @@
 DEFINE_RUN_ONCE_STATIC(default_context_do_init)
 {
     return CRYPTO_THREAD_init_local(&default_context_thread_local, NULL)
-        && context_init(&default_context_int);
+        && context_init(&default_context_int)
+        && ossl_init_casecmp();
 }
 
 void ossl_lib_ctx_default_deinit(void)
diff -Nru openssl-3.0.2/crypto/core_namemap.c openssl-3.0.3/crypto/core_namemap.c
--- openssl-3.0.2/crypto/core_namemap.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/core_namemap.c	2022-05-03 15:32:01.000000000 +0200
@@ -7,7 +7,6 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "e_os.h"                /* strcasecmp */
 #include "internal/namemap.h"
 #include <openssl/lhash.h>
 #include "crypto/lhash.h"      /* ossl_lh_strcasehash */
@@ -49,7 +48,7 @@
 
 static int namenum_cmp(const NAMENUM_ENTRY *a, const NAMENUM_ENTRY *b)
 {
-    return strcasecmp(a->name, b->name);
+    return OPENSSL_strcasecmp(a->name, b->name);
 }
 
 static void namenum_free(NAMENUM_ENTRY *n)
diff -Nru openssl-3.0.2/crypto/ctype.c openssl-3.0.3/crypto/ctype.c
--- openssl-3.0.2/crypto/ctype.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ctype.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -12,6 +12,19 @@
 #include "crypto/ctype.h"
 #include <openssl/ebcdic.h>
 
+#include <openssl/crypto.h>
+#include "internal/core.h"
+#include "internal/thread_once.h"
+
+#ifndef OPENSSL_SYS_WINDOWS
+#include <strings.h>
+#endif
+#include <locale.h>
+
+#ifdef OPENSSL_SYS_MACOSX
+#include <xlocale.h>
+#endif
+
 /*
  * Define the character classes for each character in the seven bit ASCII
  * character set.  This is independent of the host's character set, characters
@@ -278,3 +291,90 @@
         return 1;
     return 0;
 }
+
+/* str[n]casecmp_l is defined in POSIX 2008-01. Value is taken accordingly
+ * https://www.gnu.org/software/libc/manual/html_node/Feature-Test-Macros.html */
+
+#if (defined OPENSSL_SYS_WINDOWS) || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200809L)
+
+# if defined OPENSSL_SYS_WINDOWS
+# define locale_t _locale_t
+# define freelocale _free_locale
+# define strcasecmp_l _stricmp_l
+# define strncasecmp_l _strnicmp_l
+# endif
+
+# ifndef FIPS_MODULE
+static locale_t loc;
+
+static int locale_base_inited = 0;
+static CRYPTO_ONCE locale_base = CRYPTO_ONCE_STATIC_INIT;
+static CRYPTO_ONCE locale_base_deinit = CRYPTO_ONCE_STATIC_INIT;
+
+void *ossl_c_locale() {
+    return (void *)loc;
+}
+
+DEFINE_RUN_ONCE_STATIC(ossl_init_locale_base)
+{
+# ifdef OPENSSL_SYS_WINDOWS
+    loc = _create_locale(LC_COLLATE, "C");
+# else
+    loc = newlocale(LC_COLLATE_MASK, "C", (locale_t) 0);
+# endif
+    locale_base_inited = 1;
+    return (loc == (locale_t) 0) ? 0 : 1;
+}
+
+DEFINE_RUN_ONCE_STATIC(ossl_deinit_locale_base)
+{
+    if (locale_base_inited && loc) {
+        freelocale(loc);
+        loc = NULL;
+    }
+    return 1;
+}
+
+int ossl_init_casecmp()
+{
+   return RUN_ONCE(&locale_base, ossl_init_locale_base);
+}
+
+void ossl_deinit_casecmp() {
+    (void)RUN_ONCE(&locale_base_deinit, ossl_deinit_locale_base);
+}
+# endif
+
+int OPENSSL_strcasecmp(const char *s1, const char *s2)
+{
+    return strcasecmp_l(s1, s2, (locale_t)ossl_c_locale());
+}
+
+int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n)
+{
+    return strncasecmp_l(s1, s2, n, (locale_t)ossl_c_locale());
+}
+#else
+# ifndef FIPS_MODULE
+void *ossl_c_locale() {
+    return NULL;
+}
+# endif
+
+int ossl_init_casecmp() {
+    return 1;
+}
+
+void ossl_deinit_casecmp() {
+}
+
+int OPENSSL_strcasecmp(const char *s1, const char *s2)
+{
+    return strcasecmp(s1, s2);
+}
+
+int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n)
+{
+    return strncasecmp(s1, s2, n);
+}
+#endif
diff -Nru openssl-3.0.2/crypto/dh/dh_group_params.c openssl-3.0.3/crypto/dh/dh_group_params.c
--- openssl-3.0.2/crypto/dh/dh_group_params.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/dh/dh_group_params.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -23,7 +23,6 @@
 #include <openssl/objects.h>
 #include "internal/nelem.h"
 #include "crypto/dh.h"
-#include "e_os.h" /* strcasecmp */
 
 static DH *dh_param_init(OSSL_LIB_CTX *libctx, const DH_NAMED_GROUP *group)
 {
diff -Nru openssl-3.0.2/crypto/dh/dh_kdf.c openssl-3.0.3/crypto/dh/dh_kdf.c
--- openssl-3.0.2/crypto/dh/dh_kdf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/dh/dh_kdf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -39,6 +39,8 @@
     const char *mdname = EVP_MD_get0_name(md);
 
     kdf = EVP_KDF_fetch(libctx, OSSL_KDF_NAME_X942KDF_ASN1, propq);
+    if (kdf == NULL)
+        return 0;
     kctx = EVP_KDF_CTX_new(kdf);
     if (kctx == NULL)
         goto err;
diff -Nru openssl-3.0.2/crypto/ec/curve448/curve448.c openssl-3.0.3/crypto/ec/curve448/curve448.c
--- openssl-3.0.2/crypto/ec/curve448/curve448.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ec/curve448/curve448.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2015-2016 Cryptography Research, Inc.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -586,6 +586,7 @@
             int32_t delta = odd & mask;
 
             assert(position >= 0);
+            assert(pos < 32);       /* can't fail since current & 0xFFFF != 0 */
             if (odd & (1 << (table_bits + 1)))
                 delta -= (1 << (table_bits + 1));
             current -= delta * (1 << pos);
diff -Nru openssl-3.0.2/crypto/ec/ec_backend.c openssl-3.0.3/crypto/ec/ec_backend.c
--- openssl-3.0.2/crypto/ec/ec_backend.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ec/ec_backend.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -54,7 +54,7 @@
         return OPENSSL_EC_NAMED_CURVE;
 
     for (i = 0, sz = OSSL_NELEM(encoding_nameid_map); i < sz; i++) {
-        if (strcasecmp(name, encoding_nameid_map[i].ptr) == 0)
+        if (OPENSSL_strcasecmp(name, encoding_nameid_map[i].ptr) == 0)
             return encoding_nameid_map[i].id;
     }
     return -1;
@@ -91,7 +91,7 @@
         return 0;
 
     for (i = 0, sz = OSSL_NELEM(check_group_type_nameid_map); i < sz; i++) {
-        if (strcasecmp(name, check_group_type_nameid_map[i].ptr) == 0)
+        if (OPENSSL_strcasecmp(name, check_group_type_nameid_map[i].ptr) == 0)
             return check_group_type_nameid_map[i].id;
     }
     return -1;
@@ -136,7 +136,7 @@
         return (int)POINT_CONVERSION_UNCOMPRESSED;
 
     for (i = 0, sz = OSSL_NELEM(format_nameid_map); i < sz; i++) {
-        if (strcasecmp(name, format_nameid_map[i].ptr) == 0)
+        if (OPENSSL_strcasecmp(name, format_nameid_map[i].ptr) == 0)
             return format_nameid_map[i].id;
     }
     return -1;
diff -Nru openssl-3.0.2/crypto/ec/ec_err.c openssl-3.0.3/crypto/ec/ec_err.c
--- openssl-3.0.2/crypto/ec/ec_err.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ec/ec_err.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -35,6 +35,8 @@
     "discriminant is zero"},
     {ERR_PACK(ERR_LIB_EC, 0, EC_R_EC_GROUP_NEW_BY_NAME_FAILURE),
     "ec group new by name failure"},
+    {ERR_PACK(ERR_LIB_EC, 0, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED),
+    "explicit params not supported"},
     {ERR_PACK(ERR_LIB_EC, 0, EC_R_FAILED_MAKING_PUBLIC_KEY),
     "failed making public key"},
     {ERR_PACK(ERR_LIB_EC, 0, EC_R_FIELD_TOO_LARGE), "field too large"},
diff -Nru openssl-3.0.2/crypto/ec/ec_lib.c openssl-3.0.3/crypto/ec/ec_lib.c
--- openssl-3.0.2/crypto/ec/ec_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ec/ec_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -22,7 +22,6 @@
 #include "crypto/ec.h"
 #include "internal/nelem.h"
 #include "ec_local.h"
-#include "e_os.h" /* strcasecmp */
 
 /* functions for EC_GROUP objects */
 
@@ -1387,6 +1386,7 @@
 }
 #endif
 
+#ifndef FIPS_MODULE
 /*
  * Check if the explicit parameters group matches any built-in curves.
  *
@@ -1424,7 +1424,7 @@
          * parameters with one created from a named group.
          */
 
-#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
         /*
          * NID_wap_wsg_idm_ecid_wtls12 and NID_secp224r1 are both aliases for
          * the same curve, we prefer the SECP nid when matching explicit
@@ -1432,7 +1432,7 @@
          */
         if (curve_name_nid == NID_wap_wsg_idm_ecid_wtls12)
             curve_name_nid = NID_secp224r1;
-#endif /* !def(OPENSSL_NO_EC_NISTP_64_GCC_128) */
+# endif /* !def(OPENSSL_NO_EC_NISTP_64_GCC_128) */
 
         ret_group = EC_GROUP_new_by_curve_name_ex(libctx, propq, curve_name_nid);
         if (ret_group == NULL)
@@ -1467,6 +1467,7 @@
     EC_GROUP_free(ret_group);
     return NULL;
 }
+#endif /* FIPS_MODULE */
 
 static EC_GROUP *group_new_from_name(const OSSL_PARAM *p,
                                      OSSL_LIB_CTX *libctx, const char *propq)
@@ -1536,9 +1537,13 @@
 EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
                                    OSSL_LIB_CTX *libctx, const char *propq)
 {
-    const OSSL_PARAM *ptmp, *pa, *pb;
+    const OSSL_PARAM *ptmp;
+    EC_GROUP *group = NULL;
+
+#ifndef FIPS_MODULE
+    const OSSL_PARAM *pa, *pb;
     int ok = 0;
-    EC_GROUP *group = NULL, *named_group = NULL;
+    EC_GROUP *named_group = NULL;
     BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL, *cofactor = NULL;
     EC_POINT *point = NULL;
     int field_bits = 0;
@@ -1546,6 +1551,7 @@
     BN_CTX *bnctx = NULL;
     const unsigned char *buf = NULL;
     int encoding_flag = -1;
+#endif
 
     /* This is the simple named group case */
     ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_GROUP_NAME);
@@ -1559,6 +1565,10 @@
         }
         return group;
     }
+#ifdef FIPS_MODULE
+    ERR_raise(ERR_LIB_EC, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED);
+    return NULL;
+#else
     /* If it gets here then we are trying explicit parameters */
     bnctx = BN_CTX_new_ex(libctx);
     if (bnctx == NULL) {
@@ -1581,9 +1591,10 @@
         ERR_raise(ERR_LIB_EC, EC_R_INVALID_FIELD);
         goto err;
     }
-    if (strcasecmp(ptmp->data, SN_X9_62_prime_field) == 0) {
+    if (OPENSSL_strcasecmp(ptmp->data, SN_X9_62_prime_field) == 0) {
         is_prime_field = 1;
-    } else if (strcasecmp(ptmp->data, SN_X9_62_characteristic_two_field) == 0) {
+    } else if (OPENSSL_strcasecmp(ptmp->data,
+                                  SN_X9_62_characteristic_two_field) == 0) {
         is_prime_field = 0;
     } else {
         /* Invalid field */
@@ -1623,10 +1634,10 @@
         /* create the EC_GROUP structure */
         group = EC_GROUP_new_curve_GFp(p, a, b, bnctx);
     } else {
-#ifdef OPENSSL_NO_EC2M
+# ifdef OPENSSL_NO_EC2M
         ERR_raise(ERR_LIB_EC, EC_R_GF2M_NOT_SUPPORTED);
         goto err;
-#else
+# else
         /* create the EC_GROUP structure */
         group = EC_GROUP_new_curve_GF2m(p, a, b, NULL);
         if (group != NULL) {
@@ -1636,7 +1647,7 @@
                 goto err;
             }
         }
-#endif /* OPENSSL_NO_EC2M */
+# endif /* OPENSSL_NO_EC2M */
     }
 
     if (group == NULL) {
@@ -1733,4 +1744,5 @@
     BN_CTX_free(bnctx);
 
     return group;
+#endif /* FIPS_MODULE */
 }
diff -Nru openssl-3.0.2/crypto/ec/ecp_nistz256.c openssl-3.0.3/crypto/ec/ecp_nistz256.c
--- openssl-3.0.2/crypto/ec/ecp_nistz256.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ec/ecp_nistz256.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2014, Intel Corporation. All Rights Reserved.
  * Copyright (c) 2015, CloudFlare, Inc.
  *
@@ -978,6 +978,7 @@
         return 0;
     }
 
+    memset(&p, 0, sizeof(p));
     BN_CTX_start(ctx);
 
     if (scalar) {
diff -Nru openssl-3.0.2/crypto/encode_decode/decoder_lib.c openssl-3.0.3/crypto/encode_decode/decoder_lib.c
--- openssl-3.0.2/crypto/encode_decode/decoder_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/encode_decode/decoder_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -789,7 +789,7 @@
          */
         trace_data_structure = data_structure;
         if (data_type != NULL && data_structure != NULL
-            && strcasecmp(data_structure, "type-specific") == 0)
+            && OPENSSL_strcasecmp(data_structure, "type-specific") == 0)
             data_structure = NULL;
 
         OSSL_TRACE_BEGIN(DECODER) {
@@ -850,7 +850,7 @@
          * that's the case, we do this extra check.
          */
         if (decoder == NULL && ctx->start_input_type != NULL
-            && strcasecmp(ctx->start_input_type, new_input_type) != 0) {
+            && OPENSSL_strcasecmp(ctx->start_input_type, new_input_type) != 0) {
             OSSL_TRACE_BEGIN(DECODER) {
                 BIO_printf(trc_out,
                            "(ctx %p) %s [%u] the start input type '%s' doesn't match the input type of the considered decoder, skipping...\n",
@@ -896,7 +896,8 @@
          */
         if (data_structure != NULL
             && (new_input_structure == NULL
-                || strcasecmp(data_structure, new_input_structure) != 0)) {
+                || OPENSSL_strcasecmp(data_structure,
+                                      new_input_structure) != 0)) {
             OSSL_TRACE_BEGIN(DECODER) {
                 BIO_printf(trc_out,
                            "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure of the considered decoder, skipping...\n",
@@ -915,7 +916,8 @@
             && ctx->input_structure != NULL
             && new_input_structure != NULL) {
             data->flag_input_structure_checked = 1;
-            if (strcasecmp(new_input_structure, ctx->input_structure) != 0) {
+            if (OPENSSL_strcasecmp(new_input_structure,
+                                   ctx->input_structure) != 0) {
                 OSSL_TRACE_BEGIN(DECODER) {
                     BIO_printf(trc_out,
                                "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure given by the user, skipping...\n",
diff -Nru openssl-3.0.2/crypto/encode_decode/decoder_pkey.c openssl-3.0.3/crypto/encode_decode/decoder_pkey.c
--- openssl-3.0.2/crypto/encode_decode/decoder_pkey.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/encode_decode/decoder_pkey.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -18,7 +18,6 @@
 #include "crypto/evp.h"
 #include "crypto/decoder.h"
 #include "encoder_local.h"
-#include "e_os.h"                /* strcasecmp on Windows */
 
 int OSSL_DECODER_CTX_set_passphrase(OSSL_DECODER_CTX *ctx,
                                     const unsigned char *kstr,
diff -Nru openssl-3.0.2/crypto/encode_decode/encoder_lib.c openssl-3.0.3/crypto/encode_decode/encoder_lib.c
--- openssl-3.0.2/crypto/encode_decode/encoder_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/encode_decode/encoder_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -7,7 +7,6 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "e_os.h"                /* strcasecmp on Windows */
 #include <openssl/core_names.h>
 #include <openssl/bio.h>
 #include <openssl/encoder.h>
@@ -453,8 +452,8 @@
          */
         if (top) {
             if (data->ctx->output_type != NULL
-                && strcasecmp(current_output_type,
-                              data->ctx->output_type) != 0) {
+                && OPENSSL_strcasecmp(current_output_type,
+                                      data->ctx->output_type) != 0) {
                 OSSL_TRACE_BEGIN(ENCODER) {
                     BIO_printf(trc_out,
                                "[%d]    Skipping because current encoder output type (%s) != desired output type (%s)\n",
@@ -482,8 +481,8 @@
          */
         if (data->ctx->output_structure != NULL
             && current_output_structure != NULL) {
-            if (strcasecmp(data->ctx->output_structure,
-                           current_output_structure) != 0) {
+            if (OPENSSL_strcasecmp(data->ctx->output_structure,
+                                   current_output_structure) != 0) {
                 OSSL_TRACE_BEGIN(ENCODER) {
                     BIO_printf(trc_out,
                                "[%d]    Skipping because current encoder output structure (%s) != ctx output structure (%s)\n",
diff -Nru openssl-3.0.2/crypto/encode_decode/encoder_pkey.c openssl-3.0.3/crypto/encode_decode/encoder_pkey.c
--- openssl-3.0.2/crypto/encode_decode/encoder_pkey.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/encode_decode/encoder_pkey.c	2022-05-03 15:32:01.000000000 +0200
@@ -7,7 +7,6 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "e_os.h"                /* strcasecmp on Windows */
 #include <openssl/err.h>
 #include <openssl/ui.h>
 #include <openssl/params.h>
diff -Nru openssl-3.0.2/crypto/engine/eng_dyn.c openssl-3.0.3/crypto/engine/eng_dyn.c
--- openssl-3.0.2/crypto/engine/eng_dyn.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/engine/eng_dyn.c	2022-05-03 15:32:01.000000000 +0200
@@ -401,6 +401,26 @@
     return 0;
 }
 
+/*
+ * Unfortunately the version checker does not distinguish between
+ * engines built for openssl 1.1.x and openssl 3.x, but loading
+ * an engine that is built for openssl 1.1.x will cause a fatal
+ * error.  Detect such engines, since EVP_PKEY_base_id is exported
+ * as a function in openssl 1.1.x, while it is named EVP_PKEY_get_base_id
+ * in openssl 3.x.  Therefore we take the presence of that symbol
+ * as an indication that the engine will be incompatible.
+ */
+static int using_libcrypto_11(dynamic_data_ctx *ctx)
+{
+    int ret;
+
+    ERR_set_mark();
+    ret = DSO_bind_func(ctx->dynamic_dso, "EVP_PKEY_base_id") != NULL;
+    ERR_pop_to_mark();
+
+    return ret;
+}
+
 static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx)
 {
     ENGINE cpy;
@@ -450,18 +470,9 @@
         /*
          * We fail if the version checker veto'd the load *or* if it is
          * deferring to us (by returning its version) and we think it is too
-         * old.
-         * Unfortunately the version checker does not distinguish between
-         * engines built for openssl 1.1.x and openssl 3.x, but loading
-         * an engine that is built for openssl 1.1.x will cause a fatal
-         * error.  Detect such engines, since EVP_PKEY_base_id is exported
-         * as a function in openssl 1.1.x, while it is a macro in openssl 3.x,
-         * and therefore only the symbol EVP_PKEY_get_base_id is available
-         * in openssl 3.x.
+         * old. Also fail if this is engine for openssl 1.1.x.
          */
-        if (vcheck_res < OSSL_DYNAMIC_OLDEST
-                || DSO_bind_func(ctx->dynamic_dso,
-                                 "EVP_PKEY_base_id") != NULL) {
+        if (vcheck_res < OSSL_DYNAMIC_OLDEST || using_libcrypto_11(ctx)) {
             /* Fail */
             ctx->bind_engine = NULL;
             ctx->v_check = NULL;
diff -Nru openssl-3.0.2/crypto/engine/tb_asnmth.c openssl-3.0.3/crypto/engine/tb_asnmth.c
--- openssl-3.0.2/crypto/engine/tb_asnmth.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/engine/tb_asnmth.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -152,7 +152,7 @@
         e->pkey_asn1_meths(e, &ameth, NULL, nids[i]);
         if (ameth != NULL
             && ((int)strlen(ameth->pem_str) == len)
-            && strncasecmp(ameth->pem_str, str, len) == 0)
+            && OPENSSL_strncasecmp(ameth->pem_str, str, len) == 0)
             return ameth;
     }
     return NULL;
@@ -177,7 +177,7 @@
         e->pkey_asn1_meths(e, &ameth, NULL, nid);
         if (ameth != NULL
                 && ((int)strlen(ameth->pem_str) == lk->len)
-                && strncasecmp(ameth->pem_str, lk->str, lk->len) == 0) {
+                && OPENSSL_strncasecmp(ameth->pem_str, lk->str, lk->len) == 0) {
             lk->e = e;
             lk->ameth = ameth;
             return;
diff -Nru openssl-3.0.2/crypto/err/openssl.txt openssl-3.0.3/crypto/err/openssl.txt
--- openssl-3.0.2/crypto/err/openssl.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/err/openssl.txt	2022-05-03 15:32:01.000000000 +0200
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -537,6 +537,7 @@
 EC_R_DECODE_ERROR:142:decode error
 EC_R_DISCRIMINANT_IS_ZERO:118:discriminant is zero
 EC_R_EC_GROUP_NEW_BY_NAME_FAILURE:119:ec group new by name failure
+EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED:127:explicit params not supported
 EC_R_FAILED_MAKING_PUBLIC_KEY:166:failed making public key
 EC_R_FIELD_TOO_LARGE:143:field too large
 EC_R_GF2M_NOT_SUPPORTED:147:gf2m not supported
diff -Nru openssl-3.0.2/crypto/evp/ctrl_params_translate.c openssl-3.0.3/crypto/evp/ctrl_params_translate.c
--- openssl-3.0.2/crypto/evp/ctrl_params_translate.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/ctrl_params_translate.c	2022-05-03 15:32:01.000000000 +0200
@@ -37,8 +37,6 @@
 #include "crypto/dh.h"
 #include "crypto/ec.h"
 
-#include "e_os.h"                /* strcasecmp() for Windows */
-
 struct translation_ctx_st;       /* Forwarding */
 struct translation_st;           /* Forwarding */
 
@@ -905,7 +903,7 @@
 
         /* Convert KDF type strings to numbers */
         for (; kdf_type_map->kdf_type_str != NULL; kdf_type_map++)
-            if (strcasecmp(ctx->p2, kdf_type_map->kdf_type_str) == 0) {
+            if (OPENSSL_strcasecmp(ctx->p2, kdf_type_map->kdf_type_str) == 0) {
                 ctx->p1 = kdf_type_map->kdf_type_num;
                 ret = 1;
                 break;
@@ -1074,7 +1072,11 @@
         return 0;
 
     if (state == PRE_CTRL_STR_TO_PARAMS) {
-        ctx->p2 = (char *)ossl_dh_gen_type_id2name(atoi(ctx->p2));
+        if ((ctx->p2 = (char *)ossl_dh_gen_type_id2name(atoi(ctx->p2)))
+             == NULL) {
+            ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_VALUE);
+            return 0;
+        }
         ctx->p1 = strlen(ctx->p2);
     }
 
@@ -2469,10 +2471,11 @@
              * cmd name in the template.
              */
             if (item->ctrl_str != NULL
-                && strcasecmp(tmpl->ctrl_str, item->ctrl_str) == 0)
+                && OPENSSL_strcasecmp(tmpl->ctrl_str, item->ctrl_str) == 0)
                 ctrl_str = tmpl->ctrl_str;
             else if (item->ctrl_hexstr != NULL
-                     && strcasecmp(tmpl->ctrl_hexstr, item->ctrl_hexstr) == 0)
+                     && OPENSSL_strcasecmp(tmpl->ctrl_hexstr,
+                                           item->ctrl_hexstr) == 0)
                 ctrl_hexstr = tmpl->ctrl_hexstr;
             else
                 continue;
@@ -2500,7 +2503,8 @@
             if ((item->action_type != NONE
                  && tmpl->action_type != item->action_type)
                 || (item->param_key != NULL
-                    && strcasecmp(tmpl->param_key, item->param_key) != 0))
+                    && OPENSSL_strcasecmp(tmpl->param_key,
+                                          item->param_key) != 0))
                 continue;
         } else {
             return NULL;
diff -Nru openssl-3.0.2/crypto/evp/ec_support.c openssl-3.0.3/crypto/evp/ec_support.c
--- openssl-3.0.2/crypto/evp/ec_support.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/ec_support.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,7 +10,7 @@
 #include <string.h>
 #include <openssl/ec.h>
 #include "crypto/ec.h"
-#include "e_os.h" /* strcasecmp required by windows */
+#include "internal/nelem.h"
 
 typedef struct ec_name2nid_st {
     const char *name;
@@ -139,7 +139,7 @@
             return nid;
 
         for (i = 0; i < OSSL_NELEM(curve_list); i++) {
-            if (strcasecmp(curve_list[i].name, name) == 0)
+            if (OPENSSL_strcasecmp(curve_list[i].name, name) == 0)
                 return curve_list[i].nid;
         }
     }
diff -Nru openssl-3.0.2/crypto/evp/evp_enc.c openssl-3.0.3/crypto/evp/evp_enc.c
--- openssl-3.0.2/crypto/evp/evp_enc.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/evp_enc.c	2022-05-03 15:32:01.000000000 +0200
@@ -344,8 +344,10 @@
 
         case EVP_CIPH_CBC_MODE:
             n = EVP_CIPHER_CTX_get_iv_length(ctx);
-            if (!ossl_assert(n >= 0 && n <= (int)sizeof(ctx->iv)))
-                    return 0;
+            if (n < 0 || n > (int)sizeof(ctx->iv)) {
+                ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH);
+                return 0;
+            }
             if (iv != NULL)
                 memcpy(ctx->oiv, iv, n);
             memcpy(ctx->iv, ctx->oiv, n);
@@ -355,8 +357,11 @@
             ctx->num = 0;
             /* Don't reuse IV for CTR mode */
             if (iv != NULL) {
-                if ((n = EVP_CIPHER_CTX_get_iv_length(ctx)) <= 0)
+                n = EVP_CIPHER_CTX_get_iv_length(ctx);
+                if (n <= 0 || n > (int)sizeof(ctx->iv)) {
+                    ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH);
                     return 0;
+                }
                 memcpy(ctx->iv, iv, n);
             }
             break;
diff -Nru openssl-3.0.2/crypto/evp/evp_lib.c openssl-3.0.3/crypto/evp/evp_lib.c
--- openssl-3.0.2/crypto/evp/evp_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/evp_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -15,7 +15,6 @@
 
 #include <stdio.h>
 #include <string.h>
-#include "e_os.h" /* strcasecmp */
 #include "internal/cryptlib.h"
 #include <openssl/evp.h>
 #include <openssl/objects.h>
@@ -1170,17 +1169,17 @@
 
     va_start(args, type);
 
-    if (strcasecmp(type, "RSA") == 0) {
+    if (OPENSSL_strcasecmp(type, "RSA") == 0) {
         bits = va_arg(args, size_t);
         params[0] = OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_RSA_BITS, &bits);
-    } else if (strcasecmp(type, "EC") == 0) {
+    } else if (OPENSSL_strcasecmp(type, "EC") == 0) {
         name = va_arg(args, char *);
         params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
                                                      name, 0);
-    } else if (strcasecmp(type, "ED25519") != 0
-               && strcasecmp(type, "X25519") != 0
-               && strcasecmp(type, "ED448") != 0
-               && strcasecmp(type, "X448") != 0) {
+    } else if (OPENSSL_strcasecmp(type, "ED25519") != 0
+               && OPENSSL_strcasecmp(type, "X25519") != 0
+               && OPENSSL_strcasecmp(type, "ED448") != 0
+               && OPENSSL_strcasecmp(type, "X448") != 0) {
         ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_INVALID_ARGUMENT);
         goto end;
     }
diff -Nru openssl-3.0.2/crypto/evp/p5_crpt2.c openssl-3.0.3/crypto/evp/p5_crpt2.c
--- openssl-3.0.2/crypto/evp/p5_crpt2.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/p5_crpt2.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -42,6 +42,8 @@
         salt = (unsigned char *)empty;
 
     kdf = EVP_KDF_fetch(libctx, OSSL_KDF_NAME_PBKDF2, propq);
+    if (kdf == NULL)
+         return 0;
     kctx = EVP_KDF_CTX_new(kdf);
     EVP_KDF_free(kdf);
     if (kctx == NULL)
diff -Nru openssl-3.0.2/crypto/evp/p_lib.c openssl-3.0.3/crypto/evp/p_lib.c
--- openssl-3.0.2/crypto/evp/p_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/p_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -50,8 +50,6 @@
 #include "internal/provider.h"
 #include "evp_local.h"
 
-#include "e_os.h"                /* strcasecmp on Windows */
-
 static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
                          int len, EVP_KEYMGMT *keymgmt);
 static void evp_pkey_free_it(EVP_PKEY *key);
@@ -1018,7 +1016,7 @@
     size_t i;
 
     for (i = 0; i < OSSL_NELEM(standard_name2type); i++) {
-        if (strcasecmp(name, standard_name2type[i].ptr) == 0)
+        if (OPENSSL_strcasecmp(name, standard_name2type[i].ptr) == 0)
             return (int)standard_name2type[i].id;
     }
 
diff -Nru openssl-3.0.2/crypto/evp/pmeth_lib.c openssl-3.0.3/crypto/evp/pmeth_lib.c
--- openssl-3.0.2/crypto/evp/pmeth_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/evp/pmeth_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -27,6 +27,7 @@
 #ifndef FIPS_MODULE
 # include "crypto/asn1.h"
 #endif
+#include "crypto/ctype.h"
 #include "crypto/evp.h"
 #include "crypto/dh.h"
 #include "crypto/ec.h"
@@ -199,6 +200,7 @@
             }
 #ifndef FIPS_MODULE
             if (keytype != NULL) {
+                ossl_init_casecmp();
                 id = evp_pkey_name2type(keytype);
                 if (id == NID_undef)
                     id = -1;
diff -Nru openssl-3.0.2/crypto/ffc/ffc_dh.c openssl-3.0.3/crypto/ffc/ffc_dh.c
--- openssl-3.0.2/crypto/ffc/ffc_dh.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ffc/ffc_dh.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,7 +10,6 @@
 #include "internal/ffc.h"
 #include "internal/nelem.h"
 #include "crypto/bn_dh.h"
-#include "e_os.h" /* strcasecmp */
 
 #ifndef OPENSSL_NO_DH
 
@@ -84,7 +83,7 @@
     size_t i;
 
     for (i = 0; i < OSSL_NELEM(dh_named_groups); ++i) {
-        if (strcasecmp(dh_named_groups[i].name, name) == 0)
+        if (OPENSSL_strcasecmp(dh_named_groups[i].name, name) == 0)
             return &dh_named_groups[i];
     }
     return NULL;
diff -Nru openssl-3.0.2/crypto/ffc/ffc_params.c openssl-3.0.3/crypto/ffc/ffc_params.c
--- openssl-3.0.2/crypto/ffc/ffc_params.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ffc/ffc_params.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -12,7 +12,6 @@
 #include "internal/ffc.h"
 #include "internal/param_build_set.h"
 #include "internal/nelem.h"
-#include "e_os.h" /* strcasecmp */
 
 #ifndef FIPS_MODULE
 # include <openssl/asn1.h> /* ossl_ffc_params_print */
diff -Nru openssl-3.0.2/crypto/http/http_client.c openssl-3.0.3/crypto/http/http_client.c
--- openssl-3.0.2/crypto/http/http_client.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/http/http_client.c	2022-05-03 15:32:01.000000000 +0200
@@ -322,7 +322,7 @@
 
     for (i = 0; i < sk_CONF_VALUE_num(headers); i++) {
         hdr = sk_CONF_VALUE_value(headers, i);
-        if (add_host && strcasecmp("host", hdr->name) == 0)
+        if (add_host && OPENSSL_strcasecmp("host", hdr->name) == 0)
             add_host = 0;
         if (!OSSL_HTTP_REQ_CTX_add1_header(rctx, hdr->name, hdr->value))
             return 0;
@@ -666,13 +666,13 @@
         }
         if (value != NULL && line_end != NULL) {
             if (rctx->state == OHS_REDIRECT
-                    && strcasecmp(key, "Location") == 0) {
+                    && OPENSSL_strcasecmp(key, "Location") == 0) {
                 rctx->redirection_url = value;
                 return 0;
             }
-            if (rctx->expected_ct != NULL
-                    && strcasecmp(key, "Content-Type") == 0) {
-                if (strcasecmp(rctx->expected_ct, value) != 0) {
+            if (rctx->state == OHS_HEADERS && rctx->expected_ct != NULL
+                    && OPENSSL_strcasecmp(key, "Content-Type") == 0) {
+                if (OPENSSL_strcasecmp(rctx->expected_ct, value) != 0) {
                     ERR_raise_data(ERR_LIB_HTTP, HTTP_R_UNEXPECTED_CONTENT_TYPE,
                                    "expected=%s, actual=%s",
                                    rctx->expected_ct, value);
@@ -682,12 +682,12 @@
             }
 
             /* https://tools.ietf.org/html/rfc7230#section-6.3 Persistence */
-            if (strcasecmp(key, "Connection") == 0) {
-                if (strcasecmp(value, "keep-alive") == 0)
+            if (OPENSSL_strcasecmp(key, "Connection") == 0) {
+                if (OPENSSL_strcasecmp(value, "keep-alive") == 0)
                     found_keep_alive = 1;
-                else if (strcasecmp(value, "close") == 0)
+                else if (OPENSSL_strcasecmp(value, "close") == 0)
                     found_keep_alive = 0;
-            } else if (strcasecmp(key, "Content-Length") == 0) {
+            } else if (OPENSSL_strcasecmp(key, "Content-Length") == 0) {
                 resp_len = (size_t)strtoul(value, &line_end, 10);
                 if (line_end == value || *line_end != '\0') {
                     ERR_raise_data(ERR_LIB_HTTP,
diff -Nru openssl-3.0.2/crypto/init.c openssl-3.0.3/crypto/init.c
--- openssl-3.0.2/crypto/init.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/init.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -32,6 +32,7 @@
 #include "crypto/store.h"
 #include <openssl/cmp_util.h> /* for OSSL_CMP_log_close() */
 #include <openssl/trace.h>
+#include "crypto/ctype.h"
 
 static int stopped = 0;
 static uint64_t optsdone = 0;
@@ -447,6 +448,9 @@
     OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_trace_cleanup()\n");
     ossl_trace_cleanup();
 
+    OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_deinit_casecmp()\n");
+    ossl_deinit_casecmp();
+
     base_inited = 0;
 }
 
@@ -460,6 +464,9 @@
     uint64_t tmp;
     int aloaddone = 0;
 
+    if (!ossl_init_casecmp())
+        return 0;
+
    /* Applications depend on 0 being returned when cleanup was already done */
     if (stopped) {
         if (!(opts & OPENSSL_INIT_BASE_ONLY))
diff -Nru openssl-3.0.2/crypto/lhash/lhash.c openssl-3.0.3/crypto/lhash/lhash.c
--- openssl-3.0.2/crypto/lhash/lhash.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/lhash/lhash.c	2022-05-03 15:32:01.000000000 +0200
@@ -44,22 +44,6 @@
 static void contract(OPENSSL_LHASH *lh);
 static OPENSSL_LH_NODE **getrn(OPENSSL_LHASH *lh, const void *data, unsigned long *rhash);
 
-static ossl_inline int tsan_lock(const OPENSSL_LHASH *lh)
-{
-#ifdef TSAN_REQUIRES_LOCKING
-    if (!CRYPTO_THREAD_write_lock(lh->tsan_lock))
-        return 0;
-#endif
-    return 1;
-}
-
-static ossl_inline void tsan_unlock(const OPENSSL_LHASH *lh)
-{
-#ifdef TSAN_REQUIRES_LOCKING
-    CRYPTO_THREAD_unlock(lh->tsan_lock);
-#endif
-}
-
 OPENSSL_LHASH *OPENSSL_LH_new(OPENSSL_LH_HASHFUNC h, OPENSSL_LH_COMPFUNC c)
 {
     OPENSSL_LHASH *ret;
@@ -74,10 +58,6 @@
     }
     if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)
         goto err;
-#ifdef TSAN_REQUIRES_LOCKING
-    if ((ret->tsan_lock = CRYPTO_THREAD_lock_new()) == NULL)
-        goto err;
-#endif
     ret->comp = ((c == NULL) ? (OPENSSL_LH_COMPFUNC)strcmp : c);
     ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
     ret->num_nodes = MIN_NODES / 2;
@@ -99,9 +79,6 @@
         return;
 
     OPENSSL_LH_flush(lh);
-#ifdef TSAN_REQUIRES_LOCKING
-    CRYPTO_THREAD_lock_free(lh->tsan_lock);
-#endif
     OPENSSL_free(lh->b);
     OPENSSL_free(lh);
 }
@@ -123,6 +100,8 @@
         }
         lh->b[i] = NULL;
     }
+
+    lh->num_items = 0;
 }
 
 void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
@@ -147,12 +126,10 @@
         nn->hash = hash;
         *rn = nn;
         ret = NULL;
-        lh->num_insert++;
         lh->num_items++;
     } else {                    /* replace same key */
         ret = (*rn)->data;
         (*rn)->data = data;
-        lh->num_replace++;
     }
     return ret;
 }
@@ -167,14 +144,12 @@
     rn = getrn(lh, data, &hash);
 
     if (*rn == NULL) {
-        lh->num_no_delete++;
         return NULL;
     } else {
         nn = *rn;
         *rn = nn->next;
         ret = nn->data;
         OPENSSL_free(nn);
-        lh->num_delete++;
     }
 
     lh->num_items--;
@@ -190,18 +165,11 @@
     unsigned long hash;
     OPENSSL_LH_NODE **rn;
 
-    /*-
-     * This should be atomic without tsan.
-     * It's not clear why it was done this way and not elsewhere.
-     */
-    tsan_store((TSAN_QUALIFIER int *)&lh->error, 0);
+    if (lh->error != 0)
+        lh->error = 0;
 
     rn = getrn(lh, data, &hash);
 
-    if (tsan_lock(lh)) {
-        tsan_counter(*rn == NULL ? &lh->num_retrieve_miss : &lh->num_retrieve);
-        tsan_unlock(lh);
-    }
     return *rn == NULL ? NULL : (*rn)->data;
 }
 
@@ -262,14 +230,12 @@
         memset(n + nni, 0, sizeof(*n) * (j - nni));
         lh->pmax = nni;
         lh->num_alloc_nodes = j;
-        lh->num_expand_reallocs++;
         lh->p = 0;
     } else {
         lh->p++;
     }
 
     lh->num_nodes++;
-    lh->num_expands++;
     n1 = &(lh->b[p]);
     n2 = &(lh->b[p + pmax]);
     *n2 = NULL;
@@ -302,7 +268,6 @@
             lh->error++;
             return;
         }
-        lh->num_contract_reallocs++;
         lh->num_alloc_nodes /= 2;
         lh->pmax /= 2;
         lh->p = lh->pmax - 1;
@@ -311,7 +276,6 @@
         lh->p--;
 
     lh->num_nodes--;
-    lh->num_contracts++;
 
     n1 = lh->b[(int)lh->p];
     if (n1 == NULL)
@@ -329,14 +293,8 @@
     OPENSSL_LH_NODE **ret, *n1;
     unsigned long hash, nn;
     OPENSSL_LH_COMPFUNC cf;
-    int do_tsan = 1;
 
-#ifdef TSAN_REQUIRES_LOCKING
-    do_tsan = tsan_lock(lh);
-#endif
     hash = (*(lh->hash)) (data);
-    if (do_tsan)
-        tsan_counter(&lh->num_hash_calls);
     *rhash = hash;
 
     nn = hash % lh->pmax;
@@ -346,20 +304,14 @@
     cf = lh->comp;
     ret = &(lh->b[(int)nn]);
     for (n1 = *ret; n1 != NULL; n1 = n1->next) {
-        if (do_tsan)
-            tsan_counter(&lh->num_hash_comps);
         if (n1->hash != hash) {
             ret = &(n1->next);
             continue;
         }
-        if (do_tsan)
-            tsan_counter(&lh->num_comp_calls);
         if (cf(n1->data, data) == 0)
             break;
         ret = &(n1->next);
     }
-    if (do_tsan)
-        tsan_unlock(lh);
     return ret;
 }
 
diff -Nru openssl-3.0.2/crypto/lhash/lhash_local.h openssl-3.0.3/crypto/lhash/lhash_local.h
--- openssl-3.0.2/crypto/lhash/lhash_local.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/lhash/lhash_local.h	2022-05-03 15:32:01.000000000 +0200
@@ -27,21 +27,5 @@
     unsigned long up_load;      /* load times 256 */
     unsigned long down_load;    /* load times 256 */
     unsigned long num_items;
-    unsigned long num_expands;
-    unsigned long num_expand_reallocs;
-    unsigned long num_contracts;
-    unsigned long num_contract_reallocs;
-    TSAN_QUALIFIER unsigned long num_hash_calls;
-    TSAN_QUALIFIER unsigned long num_comp_calls;
-    unsigned long num_insert;
-    unsigned long num_replace;
-    unsigned long num_delete;
-    unsigned long num_no_delete;
-    TSAN_QUALIFIER unsigned long num_retrieve;
-    TSAN_QUALIFIER unsigned long num_retrieve_miss;
-    TSAN_QUALIFIER unsigned long num_hash_comps;
     int error;
-#ifdef TSAN_REQUIRES_LOCKING
-    CRYPTO_RWLOCK *tsan_lock;
-#endif
 };
diff -Nru openssl-3.0.2/crypto/lhash/lh_stats.c openssl-3.0.3/crypto/lhash/lh_stats.c
--- openssl-3.0.2/crypto/lhash/lh_stats.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/lhash/lh_stats.c	2022-05-03 15:32:01.000000000 +0200
@@ -61,37 +61,22 @@
 
 void OPENSSL_LH_stats_bio(const OPENSSL_LHASH *lh, BIO *out)
 {
-    int omit_tsan = 0;
-
-#ifdef TSAN_REQUIRES_LOCKING
-    if (!CRYPTO_THREAD_read_lock(lh->tsan_lock)) {
-        BIO_printf(out, "unable to lock table, omitting TSAN counters\n");
-        omit_tsan = 1;
-    }
-#endif
     BIO_printf(out, "num_items             = %lu\n", lh->num_items);
     BIO_printf(out, "num_nodes             = %u\n",  lh->num_nodes);
     BIO_printf(out, "num_alloc_nodes       = %u\n",  lh->num_alloc_nodes);
-    BIO_printf(out, "num_expands           = %lu\n", lh->num_expands);
-    BIO_printf(out, "num_expand_reallocs   = %lu\n", lh->num_expand_reallocs);
-    BIO_printf(out, "num_contracts         = %lu\n", lh->num_contracts);
-    BIO_printf(out, "num_contract_reallocs = %lu\n", lh->num_contract_reallocs);
-    if (!omit_tsan) {
-        BIO_printf(out, "num_hash_calls        = %lu\n", lh->num_hash_calls);
-        BIO_printf(out, "num_comp_calls        = %lu\n", lh->num_comp_calls);
-    }
-    BIO_printf(out, "num_insert            = %lu\n", lh->num_insert);
-    BIO_printf(out, "num_replace           = %lu\n", lh->num_replace);
-    BIO_printf(out, "num_delete            = %lu\n", lh->num_delete);
-    BIO_printf(out, "num_no_delete         = %lu\n", lh->num_no_delete);
-    if (!omit_tsan) {
-        BIO_printf(out, "num_retrieve          = %lu\n", lh->num_retrieve);
-        BIO_printf(out, "num_retrieve_miss     = %lu\n", lh->num_retrieve_miss);
-        BIO_printf(out, "num_hash_comps        = %lu\n", lh->num_hash_comps);
-#ifdef TSAN_REQUIRES_LOCKING
-        CRYPTO_THREAD_unlock(lh->tsan_lock);
-#endif
-    }
+    BIO_printf(out, "num_expands           = 0\n");
+    BIO_printf(out, "num_expand_reallocs   = 0\n");
+    BIO_printf(out, "num_contracts         = 0\n");
+    BIO_printf(out, "num_contract_reallocs = 0\n");
+    BIO_printf(out, "num_hash_calls        = 0\n");
+    BIO_printf(out, "num_comp_calls        = 0\n");
+    BIO_printf(out, "num_insert            = 0\n");
+    BIO_printf(out, "num_replace           = 0\n");
+    BIO_printf(out, "num_delete            = 0\n");
+    BIO_printf(out, "num_no_delete         = 0\n");
+    BIO_printf(out, "num_retrieve          = 0\n");
+    BIO_printf(out, "num_retrieve_miss     = 0\n");
+    BIO_printf(out, "num_hash_comps        = 0\n");
 }
 
 void OPENSSL_LH_node_stats_bio(const OPENSSL_LHASH *lh, BIO *out)
diff -Nru openssl-3.0.2/crypto/LPdir_unix.c openssl-3.0.3/crypto/LPdir_unix.c
--- openssl-3.0.2/crypto/LPdir_unix.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/LPdir_unix.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2004-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -141,7 +141,8 @@
             p--;
         if (p > (*ctx)->entry_name && p[-1] == ';')
             p[-1] = '\0';
-        if (strcasecmp((*ctx)->entry_name, (*ctx)->previous_entry_name) == 0)
+        if (OPENSSL_strcasecmp((*ctx)->entry_name,
+                               (*ctx)->previous_entry_name) == 0)
             goto again;
     }
 #endif
diff -Nru openssl-3.0.2/crypto/objects/o_names.c openssl-3.0.3/crypto/objects/o_names.c
--- openssl-3.0.2/crypto/objects/o_names.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/objects/o_names.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1998-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1998-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -22,23 +22,6 @@
 #include "e_os.h"
 
 /*
- * We define this wrapper for two reasons. Firstly, later versions of
- * DEC C add linkage information to certain functions, which makes it
- * tricky to use them as values to regular function pointers.
- * Secondly, in the EDK2 build environment, the strcasecmp function is
- * actually an external function with the Microsoft ABI, so we can't
- * transparently assign function pointers to it.
- */
-#if defined(OPENSSL_SYS_VMS_DECC) || defined(OPENSSL_SYS_UEFI)
-static int obj_strcasecmp(const char *a, const char *b)
-{
-    return strcasecmp(a, b);
-}
-#else
-#define obj_strcasecmp strcasecmp
-#endif
-
-/*
  * I use the ex_data stuff to manage the identifiers for the obj_name_types
  * that applications may define.  I only really use the free function field.
  */
@@ -111,7 +94,7 @@
             goto out;
         }
         name_funcs->hash_func = ossl_lh_strcasehash;
-        name_funcs->cmp_func = obj_strcasecmp;
+        name_funcs->cmp_func = OPENSSL_strcasecmp;
         push = sk_NAME_FUNCS_push(name_funcs_stack, name_funcs);
 
         if (!push) {
@@ -145,7 +128,7 @@
             ret = sk_NAME_FUNCS_value(name_funcs_stack,
                                       a->type)->cmp_func(a->name, b->name);
         } else
-            ret = strcasecmp(a->name, b->name);
+            ret = OPENSSL_strcasecmp(a->name, b->name);
     }
     return ret;
 }
diff -Nru openssl-3.0.2/crypto/ocsp/ocsp_vfy.c openssl-3.0.3/crypto/ocsp/ocsp_vfy.c
--- openssl-3.0.2/crypto/ocsp/ocsp_vfy.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/ocsp/ocsp_vfy.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -59,9 +59,10 @@
 
     ret = X509_verify_cert(ctx);
     if (ret <= 0) {
-        ret = X509_STORE_CTX_get_error(ctx);
+        int err = X509_STORE_CTX_get_error(ctx);
+
         ERR_raise_data(ERR_LIB_OCSP, OCSP_R_CERTIFICATE_VERIFY_ERROR,
-                       "Verify error: %s", X509_verify_cert_error_string(ret));
+                       "Verify error: %s", X509_verify_cert_error_string(err));
         goto end;
     }
     if (chain != NULL)
diff -Nru openssl-3.0.2/crypto/params_dup.c openssl-3.0.3/crypto/params_dup.c
--- openssl-3.0.2/crypto/params_dup.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/params_dup.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,6 @@
 #include <openssl/params.h>
 #include <openssl/param_build.h>
 #include "internal/param_build_set.h"
-#include "e_os.h" /* strcasecmp */
 
 #define OSSL_PARAM_ALLOCATED_END    127
 #define OSSL_PARAM_MERGE_LIST_MAX   128
@@ -142,7 +141,7 @@
     const OSSL_PARAM *l = *(const OSSL_PARAM **)left;
     const OSSL_PARAM *r = *(const OSSL_PARAM **)right;
 
-    return strcasecmp(l->key, r->key);
+    return OPENSSL_strcasecmp(l->key, r->key);
 }
 
 OSSL_PARAM *OSSL_PARAM_merge(const OSSL_PARAM *p1, const OSSL_PARAM *p2)
@@ -205,7 +204,7 @@
             break;
         }
         /* consume the list element with the smaller key */
-        diff = strcasecmp((*p1cur)->key, (*p2cur)->key);
+        diff = OPENSSL_strcasecmp((*p1cur)->key, (*p2cur)->key);
         if (diff == 0) {
             /* If the keys are the same then throw away the list1 element */
             *dst++ = **p2cur;
diff -Nru openssl-3.0.2/crypto/poly1305/asm/poly1305-ia64.s openssl-3.0.3/crypto/poly1305/asm/poly1305-ia64.s
--- openssl-3.0.2/crypto/poly1305/asm/poly1305-ia64.s	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/crypto/poly1305/asm/poly1305-ia64.s	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,365 @@
+// ====================================================================
+// Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL
+// project.
+// ====================================================================
+//
+// Poly1305 for Itanium.
+//
+// January 2019
+//
+// Performance was reported to be ~2.1 cycles per byte on Itanium 2.
+// With exception for processors in 95xx family, which have higher
+// floating-point instructions' latencies and deliver ~2.6 cpb.
+// Comparison to compiler-generated code is not exactly fair, because
+// of different radixes. But just for reference, it was observed to be
+// >3x faster. Originally it was argued that floating-point base 2^32
+// implementation would be optimal. Upon closer look estimate for below
+// integer base 2^64 implementation turned to be approximately same on
+// Itanium 2. But floating-point code would be larger, and have higher
+// overhead, which would negatively affect small-block performance...
+
+#if defined(_HPUX_SOURCE)
+# if !defined(_LP64)
+#  define ADDP  addp4
+# else
+#  define ADDP  add
+# endif
+# define RUM    rum
+# define SUM    sum
+#else
+# define ADDP   add
+# define RUM    nop
+# define SUM    nop
+#endif
+
+.text
+.explicit
+
+.global	poly1305_init#
+.proc	poly1305_init#
+.align	64
+poly1305_init:
+	.prologue
+	.save		ar.pfs,r2
+{ .mmi;	alloc		r2=ar.pfs,2,0,0,0
+	cmp.eq		p6,p7=0,r33		}	// key == NULL?
+{ .mmi;	ADDP		r9=8,r32
+	ADDP		r10=16,r32
+	ADDP		r32=0,r32		};;
+	.body
+{ .mmi;	st8		[r32]=r0,24			// ctx->h0 = 0
+	st8		[r9]=r0				// ctx->h1 = 0
+(p7)	ADDP		r8=0,r33		}
+{ .mib;	st8		[r10]=r0			// ctx->h2 = 0
+(p6)	mov		r8=0
+(p6)	br.ret.spnt	b0			};;
+
+{ .mmi;	ADDP		r9=1,r33
+	ADDP		r10=2,r33
+	ADDP		r11=3,r33		};;
+{ .mmi;	ld1		r16=[r8],4			// load key, little-endian
+	ld1		r17=[r9],4		}
+{ .mmi;	ld1		r18=[r10],4
+	ld1		r19=[r11],4		};;
+{ .mmi;	ld1		r20=[r8],4
+	ld1		r21=[r9],4		}
+{ .mmi;	ld1		r22=[r10],4
+	ld1		r23=[r11],4
+	and		r19=15,r19		};;
+{ .mmi;	ld1		r24=[r8],4
+	ld1		r25=[r9],4
+	and		r20=-4,r20		}
+{ .mmi;	ld1		r26=[r10],4
+	ld1		r27=[r11],4
+	and		r23=15,r23		};;
+{ .mmi;	ld1		r28=[r8],4
+	ld1		r29=[r9],4
+	and		r24=-4,r24		}
+{ .mmi;	ld1		r30=[r10],4
+	ld1		r31=[r11],4
+	and		r27=15,r27		};;
+
+{ .mii;	and		r28=-4,r28
+	dep		r16=r17,r16,8,8
+	dep		r18=r19,r18,8,8		};;
+{ .mii;	and		r31=15,r31
+	dep		r16=r18,r16,16,16
+	dep		r20=r21,r20,8,8		};;
+{ .mii;	dep		r16=r20,r16,32,16
+	dep		r22=r23,r22,8,8		};;
+{ .mii;	dep		r16=r22,r16,48,16
+	dep		r24=r25,r24,8,8		};;
+{ .mii;	dep		r26=r27,r26,8,8
+	dep		r28=r29,r28,8,8		};;
+{ .mii;	dep		r24=r26,r24,16,16
+	dep		r30=r31,r30,8,8		};;
+{ .mii;	st8		[r32]=r16,8			// ctx->r0
+	dep		r24=r28,r24,32,16;;
+	dep		r24=r30,r24,48,16	};;
+{ .mii;	st8		[r32]=r24,8			// ctx->r1
+	shr.u		r25=r24,2;;
+	add		r25=r25,r24		};;
+{ .mib; st8		[r32]=r25			// ctx->s1
+	mov		r8=0
+	br.ret.sptk	b0			};;
+.endp	poly1305_init#
+
+h0=r17;  h1=r18;  h2=r19;
+i0=r20;  i1=r21;
+HF0=f8;  HF1=f9;  HF2=f10;
+RF0=f11; RF1=f12; SF1=f13;
+
+.global	poly1305_blocks#
+.proc	poly1305_blocks#
+.align	64
+poly1305_blocks:
+	.prologue
+	.save		ar.pfs,r2
+{ .mii;	alloc		r2=ar.pfs,4,1,0,0
+	.save		ar.lc,r3
+	mov		r3=ar.lc
+	.save		pr,r36
+	mov		r36=pr			}
+
+	.body
+{ .mmi;	ADDP		r8=0,r32
+	ADDP		r9=8,r32
+	and		r29=7,r33		};;
+{ .mmi;	ld8		h0=[r8],16
+	ld8		h1=[r9],16
+	and		r33=-8,r33		};;
+{ .mmi;	ld8		h2=[r8],16
+	ldf8		RF0=[r9],16
+	shr.u		r34=r34,4		};;
+{ .mmi;	ldf8		RF1=[r8],-32
+	ldf8		SF1=[r9],-32
+	cmp.ltu		p16,p17=1,r34		};;
+{ .mmi;
+(p16)	add		r34=-2,r34
+(p17)	mov		r34=0
+	ADDP		r10=0,r33		}
+{ .mii;	ADDP		r11=8,r33
+(p16)	mov		ar.ec=2
+(p17)	mov		ar.ec=1			};;
+{ .mib;	RUM		1<<1				// go little-endian
+	mov		ar.lc=r34
+	brp.loop.imp	.Loop,.Lcend-16		}
+
+{ .mmi;	cmp.eq		p8,p7=0,r29
+	cmp.eq		p9,p0=1,r29
+	cmp.eq		p10,p0=2,r29		}
+{ .mmi;	cmp.eq		p11,p0=3,r29
+	cmp.eq		p12,p0=4,r29
+	cmp.eq		p13,p0=5,r29		}
+{ .mmi;	cmp.eq		p14,p0=6,r29
+	cmp.eq		p15,p0=7,r29
+	add		r16=16,r10		};;
+
+{ .mmb;
+(p8)	ld8		i0=[r10],16			// aligned input
+(p8)	ld8		i1=[r11],16
+(p8)	br.cond.sptk	.Loop			};;
+
+	// align first block
+	.pred.rel	"mutex",p8,p9,p10,p11,p12,p13,p14,p15
+{ .mmi;	(p7)	ld8		r14=[r10],24
+	(p7)	ld8		r15=[r11],24		}
+
+{ .mii;	(p7)	ld8		r16=[r16]
+		nop.i		0;;
+	(p15)	shrp		i0=r15,r14,56		}
+{ .mii;	(p15)	shrp		i1=r16,r15,56
+	(p14)	shrp		i0=r15,r14,48		}
+{ .mii;	(p14)	shrp		i1=r16,r15,48
+	(p13)	shrp		i0=r15,r14,40		}
+{ .mii;	(p13)	shrp		i1=r16,r15,40
+	(p12)	shrp		i0=r15,r14,32		}
+{ .mii;	(p12)	shrp		i1=r16,r15,32
+	(p11)	shrp		i0=r15,r14,24		}
+{ .mii;	(p11)	shrp		i1=r16,r15,24
+	(p10)	shrp		i0=r15,r14,16		}
+{ .mii;	(p10)	shrp		i1=r16,r15,16
+	(p9)	shrp		i0=r15,r14,8		}
+{ .mii;	(p9)	shrp		i1=r16,r15,8
+		mov		r14=r16			};;
+
+.Loop:
+		.pred.rel	"mutex",p8,p9,p10,p11,p12,p13,p14,p15
+{ .mmi;		add		h0=h0,i0
+		add		h1=h1,i1
+		add		h2=h2,r35		};;
+{ .mmi;		setf.sig	HF0=h0
+		cmp.ltu		p6,p0=h0,i0
+		cmp.ltu		p7,p0=h1,i1		};;
+{ .mmi;	(p6)	add		h1=1,h1;;
+		setf.sig	HF1=h1
+	(p6)	cmp.eq.or	p7,p0=0,h1		};;
+{ .mmi;	(p7)	add		h2=1,h2;;
+		setf.sig	HF2=h2			};;
+
+{ .mfi;	(p16)	ld8		r15=[r10],16
+		xmpy.lu		f32=HF0,RF0		}
+{ .mfi;	(p16)	ld8		r16=[r11],16
+		xmpy.hu		f33=HF0,RF0		}
+{ .mfi;		xmpy.lu		f36=HF0,RF1		}
+{ .mfi;		xmpy.hu		f37=HF0,RF1		};;
+{ .mfi;		xmpy.lu		f34=HF1,SF1
+	(p15)	shrp		i0=r15,r14,56		}
+{ .mfi;		xmpy.hu		f35=HF1,SF1		}
+{ .mfi;		xmpy.lu		f38=HF1,RF0
+	(p15)	shrp		i1=r16,r15,56		}
+{ .mfi;		xmpy.hu		f39=HF1,RF0		}
+{ .mfi;		xmpy.lu		f40=HF2,SF1
+	(p14)	shrp		i0=r15,r14,48		}
+{ .mfi;		xmpy.lu		f41=HF2,RF0		};;
+
+{ .mmi;		getf.sig	r22=f32
+		getf.sig	r23=f33
+	(p14)	shrp		i1=r16,r15,48		}
+{ .mmi;		getf.sig	r24=f34
+		getf.sig	r25=f35
+	(p13)	shrp		i0=r15,r14,40		}
+{ .mmi;		getf.sig	r26=f36
+		getf.sig	r27=f37
+	(p13)	shrp		i1=r16,r15,40		}
+{ .mmi;		getf.sig	r28=f38
+		getf.sig	r29=f39
+	(p12)	shrp		i0=r15,r14,32		}
+{ .mmi;		getf.sig	r30=f40
+		getf.sig	r31=f41			};;
+
+{ .mmi;		add		h0=r22,r24
+		add		r23=r23,r25
+	(p12)	shrp		i1=r16,r15,32		}
+{ .mmi;		add		h1=r26,r28
+		add		r27=r27,r29
+	(p11)	shrp		i0=r15,r14,24		};;
+{ .mmi;		cmp.ltu		p6,p0=h0,r24
+		cmp.ltu		p7,p0=h1,r28
+		add		r23=r23,r30		};;
+{ .mmi;	(p6)	add		r23=1,r23
+	(p7)	add		r27=1,r27
+	(p11)	shrp		i1=r16,r15,24		};;
+{ .mmi;		add		h1=h1,r23;;
+		cmp.ltu		p6,p7=h1,r23
+	(p10)	shrp		i0=r15,r14,16		};;
+{ .mmi;	(p6)	add		h2=r31,r27,1
+	(p7)	add		h2=r31,r27
+	(p10)	shrp		i1=r16,r15,16		};;
+
+{ .mmi;	(p8)	mov		i0=r15
+		and		r22=-4,h2
+		shr.u		r23=h2,2		};;
+{ .mmi;		add		r22=r22,r23
+		and		h2=3,h2
+	(p9)	shrp		i0=r15,r14,8		};;
+
+{ .mmi;		add		h0=h0,r22;;
+		cmp.ltu		p6,p0=h0,r22
+	(p9)	shrp		i1=r16,r15,8		};;
+{ .mmi;	(p8)	mov		i1=r16
+	(p6)	cmp.eq.unc	p7,p0=-1,h1
+	(p6)	add		h1=1,h1			};;
+{ .mmb;	(p7)	add		h2=1,h2
+		mov		r14=r16
+		br.ctop.sptk	.Loop			};;
+.Lcend:
+
+{ .mii;	SUM		1<<1				// back to big-endian
+	mov		ar.lc=r3		};;
+
+{ .mmi;	st8		[r8]=h0,16
+	st8		[r9]=h1
+	mov		pr=r36,0x1ffff		};;
+{ .mmb;	st8		[r8]=h2
+	rum		1<<5
+	br.ret.sptk	b0			};;
+.endp	poly1305_blocks#
+
+.global	poly1305_emit#
+.proc	poly1305_emit#
+.align	64
+poly1305_emit:
+	.prologue
+	.save		ar.pfs,r2
+{ .mmi;	alloc		r2=ar.pfs,3,0,0,0
+	ADDP		r8=0,r32
+	ADDP		r9=8,r32		};;
+
+	.body
+{ .mmi;	ld8		r16=[r8],16			// load hash
+	ld8		r17=[r9]
+	ADDP		r10=0,r34		};;
+{ .mmi;	ld8		r18=[r8]
+	ld4		r24=[r10],8			// load nonce
+	ADDP		r11=4,r34		};;
+
+{ .mmi;	ld4		r25=[r11],8
+	ld4		r26=[r10]
+	add		r20=5,r16		};;
+
+{ .mmi;	ld4		r27=[r11]
+	cmp.ltu		p6,p7=r20,r16
+	shl		r25=r25,32		};;
+{ .mmi;
+(p6)	add		r21=1,r17
+(p7)	add		r21=0,r17
+(p6)	cmp.eq.or.andcm	p6,p7=-1,r17		};;
+{ .mmi;
+(p6)	add		r22=1,r18
+(p7)	add		r22=0,r18
+	shl		r27=r27,32		};;
+{ .mmi;	or		r24=r24,r25
+	or		r26=r26,r27
+	cmp.leu		p6,p7=4,r22		};;
+{ .mmi;
+(p6)	add		r16=r20,r24
+(p7)	add		r16=r16,r24
+(p6)	add		r17=r21,r26		};;
+{ .mii;
+(p7)	add		r17=r17,r26
+	cmp.ltu		p6,p7=r16,r24;;
+(p6)	add		r17=1,r17		};;
+
+{ .mmi;	ADDP		r8=0,r33
+	ADDP		r9=4,r33
+	shr.u		r20=r16,32		}
+{ .mmi;	ADDP		r10=8,r33
+	ADDP		r11=12,r33
+	shr.u		r21=r17,32		};;
+
+{ .mmi;	st1		[r8]=r16,1			// write mac, little-endian
+	st1		[r9]=r20,1
+	shr.u		r16=r16,8		}
+{ .mii;	st1		[r10]=r17,1
+	shr.u		r20=r20,8
+	shr.u		r17=r17,8		}
+{ .mmi;	st1		[r11]=r21,1
+	shr.u		r21=r21,8		};;
+
+{ .mmi;	st1		[r8]=r16,1
+	st1		[r9]=r20,1
+	shr.u		r16=r16,8		}
+{ .mii;	st1		[r10]=r17,1
+	shr.u		r20=r20,8
+	shr.u		r17=r17,8		}
+{ .mmi;	st1		[r11]=r21,1
+	shr.u		r21=r21,8		};;
+
+{ .mmi;	st1		[r8]=r16,1
+	st1		[r9]=r20,1
+	shr.u		r16=r16,8		}
+{ .mii;	st1		[r10]=r17,1
+	shr.u		r20=r20,8
+	shr.u		r17=r17,8		}
+{ .mmi;	st1		[r11]=r21,1
+	shr.u		r21=r21,8		};;
+
+{ .mmi;	st1		[r8]=r16
+	st1		[r9]=r20		}
+{ .mmb;	st1		[r10]=r17
+	st1		[r11]=r21
+	br.ret.sptk	b0			};;
+.endp	poly1305_emit#
+
+stringz	"Poly1305 for IA64, CRYPTOGAMS by \@dot-asm"
diff -Nru openssl-3.0.2/crypto/poly1305/asm/poly1305-ia64.S openssl-3.0.3/crypto/poly1305/asm/poly1305-ia64.S
--- openssl-3.0.2/crypto/poly1305/asm/poly1305-ia64.S	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/poly1305/asm/poly1305-ia64.S	1970-01-01 01:00:00.000000000 +0100
@@ -1,365 +0,0 @@
-// ====================================================================
-// Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL
-// project.
-// ====================================================================
-//
-// Poly1305 for Itanium.
-//
-// January 2019
-//
-// Performance was reported to be ~2.1 cycles per byte on Itanium 2.
-// With exception for processors in 95xx family, which have higher
-// floating-point instructions' latencies and deliver ~2.6 cpb.
-// Comparison to compiler-generated code is not exactly fair, because
-// of different radixes. But just for reference, it was observed to be
-// >3x faster. Originally it was argued that floating-point base 2^32
-// implementation would be optimal. Upon closer look estimate for below
-// integer base 2^64 implementation turned to be approximately same on
-// Itanium 2. But floating-point code would be larger, and have higher
-// overhead, which would negatively affect small-block performance...
-
-#if defined(_HPUX_SOURCE)
-# if !defined(_LP64)
-#  define ADDP  addp4
-# else
-#  define ADDP  add
-# endif
-# define RUM    rum
-# define SUM    sum
-#else
-# define ADDP   add
-# define RUM    nop
-# define SUM    nop
-#endif
-
-.text
-.explicit
-
-.global	poly1305_init#
-.proc	poly1305_init#
-.align	64
-poly1305_init:
-	.prologue
-	.save		ar.pfs,r2
-{ .mmi;	alloc		r2=ar.pfs,2,0,0,0
-	cmp.eq		p6,p7=0,r33		}	// key == NULL?
-{ .mmi;	ADDP		r9=8,r32
-	ADDP		r10=16,r32
-	ADDP		r32=0,r32		};;
-	.body
-{ .mmi;	st8		[r32]=r0,24			// ctx->h0 = 0
-	st8		[r9]=r0				// ctx->h1 = 0
-(p7)	ADDP		r8=0,r33		}
-{ .mib;	st8		[r10]=r0			// ctx->h2 = 0
-(p6)	mov		r8=0
-(p6)	br.ret.spnt	b0			};;
-
-{ .mmi;	ADDP		r9=1,r33
-	ADDP		r10=2,r33
-	ADDP		r11=3,r33		};;
-{ .mmi;	ld1		r16=[r8],4			// load key, little-endian
-	ld1		r17=[r9],4		}
-{ .mmi;	ld1		r18=[r10],4
-	ld1		r19=[r11],4		};;
-{ .mmi;	ld1		r20=[r8],4
-	ld1		r21=[r9],4		}
-{ .mmi;	ld1		r22=[r10],4
-	ld1		r23=[r11],4
-	and		r19=15,r19		};;
-{ .mmi;	ld1		r24=[r8],4
-	ld1		r25=[r9],4
-	and		r20=-4,r20		}
-{ .mmi;	ld1		r26=[r10],4
-	ld1		r27=[r11],4
-	and		r23=15,r23		};;
-{ .mmi;	ld1		r28=[r8],4
-	ld1		r29=[r9],4
-	and		r24=-4,r24		}
-{ .mmi;	ld1		r30=[r10],4
-	ld1		r31=[r11],4
-	and		r27=15,r27		};;
-
-{ .mii;	and		r28=-4,r28
-	dep		r16=r17,r16,8,8
-	dep		r18=r19,r18,8,8		};;
-{ .mii;	and		r31=15,r31
-	dep		r16=r18,r16,16,16
-	dep		r20=r21,r20,8,8		};;
-{ .mii;	dep		r16=r20,r16,32,16
-	dep		r22=r23,r22,8,8		};;
-{ .mii;	dep		r16=r22,r16,48,16
-	dep		r24=r25,r24,8,8		};;
-{ .mii;	dep		r26=r27,r26,8,8
-	dep		r28=r29,r28,8,8		};;
-{ .mii;	dep		r24=r26,r24,16,16
-	dep		r30=r31,r30,8,8		};;
-{ .mii;	st8		[r32]=r16,8			// ctx->r0
-	dep		r24=r28,r24,32,16;;
-	dep		r24=r30,r24,48,16	};;
-{ .mii;	st8		[r32]=r24,8			// ctx->r1
-	shr.u		r25=r24,2;;
-	add		r25=r25,r24		};;
-{ .mib; st8		[r32]=r25			// ctx->s1
-	mov		r8=0
-	br.ret.sptk	b0			};;
-.endp	poly1305_init#
-
-h0=r17;  h1=r18;  h2=r19;
-i0=r20;  i1=r21;
-HF0=f8;  HF1=f9;  HF2=f10;
-RF0=f11; RF1=f12; SF1=f13;
-
-.global	poly1305_blocks#
-.proc	poly1305_blocks#
-.align	64
-poly1305_blocks:
-	.prologue
-	.save		ar.pfs,r2
-{ .mii;	alloc		r2=ar.pfs,4,1,0,0
-	.save		ar.lc,r3
-	mov		r3=ar.lc
-	.save		pr,r36
-	mov		r36=pr			}
-
-	.body
-{ .mmi;	ADDP		r8=0,r32
-	ADDP		r9=8,r32
-	and		r29=7,r33		};;
-{ .mmi;	ld8		h0=[r8],16
-	ld8		h1=[r9],16
-	and		r33=-8,r33		};;
-{ .mmi;	ld8		h2=[r8],16
-	ldf8		RF0=[r9],16
-	shr.u		r34=r34,4		};;
-{ .mmi;	ldf8		RF1=[r8],-32
-	ldf8		SF1=[r9],-32
-	cmp.ltu		p16,p17=1,r34		};;
-{ .mmi;
-(p16)	add		r34=-2,r34
-(p17)	mov		r34=0
-	ADDP		r10=0,r33		}
-{ .mii;	ADDP		r11=8,r33
-(p16)	mov		ar.ec=2
-(p17)	mov		ar.ec=1			};;
-{ .mib;	RUM		1<<1				// go little-endian
-	mov		ar.lc=r34
-	brp.loop.imp	.Loop,.Lcend-16		}
-
-{ .mmi;	cmp.eq		p8,p7=0,r29
-	cmp.eq		p9,p0=1,r29
-	cmp.eq		p10,p0=2,r29		}
-{ .mmi;	cmp.eq		p11,p0=3,r29
-	cmp.eq		p12,p0=4,r29
-	cmp.eq		p13,p0=5,r29		}
-{ .mmi;	cmp.eq		p14,p0=6,r29
-	cmp.eq		p15,p0=7,r29
-	add		r16=16,r10		};;
-
-{ .mmb;
-(p8)	ld8		i0=[r10],16			// aligned input
-(p8)	ld8		i1=[r11],16
-(p8)	br.cond.sptk	.Loop			};;
-
-	// align first block
-	.pred.rel	"mutex",p8,p9,p10,p11,p12,p13,p14,p15
-{ .mmi;	(p7)	ld8		r14=[r10],24
-	(p7)	ld8		r15=[r11],24		}
-
-{ .mii;	(p7)	ld8		r16=[r16]
-		nop.i		0;;
-	(p15)	shrp		i0=r15,r14,56		}
-{ .mii;	(p15)	shrp		i1=r16,r15,56
-	(p14)	shrp		i0=r15,r14,48		}
-{ .mii;	(p14)	shrp		i1=r16,r15,48
-	(p13)	shrp		i0=r15,r14,40		}
-{ .mii;	(p13)	shrp		i1=r16,r15,40
-	(p12)	shrp		i0=r15,r14,32		}
-{ .mii;	(p12)	shrp		i1=r16,r15,32
-	(p11)	shrp		i0=r15,r14,24		}
-{ .mii;	(p11)	shrp		i1=r16,r15,24
-	(p10)	shrp		i0=r15,r14,16		}
-{ .mii;	(p10)	shrp		i1=r16,r15,16
-	(p9)	shrp		i0=r15,r14,8		}
-{ .mii;	(p9)	shrp		i1=r16,r15,8
-		mov		r14=r16			};;
-
-.Loop:
-		.pred.rel	"mutex",p8,p9,p10,p11,p12,p13,p14,p15
-{ .mmi;		add		h0=h0,i0
-		add		h1=h1,i1
-		add		h2=h2,r35		};;
-{ .mmi;		setf.sig	HF0=h0
-		cmp.ltu		p6,p0=h0,i0
-		cmp.ltu		p7,p0=h1,i1		};;
-{ .mmi;	(p6)	add		h1=1,h1;;
-		setf.sig	HF1=h1
-	(p6)	cmp.eq.or	p7,p0=0,h1		};;
-{ .mmi;	(p7)	add		h2=1,h2;;
-		setf.sig	HF2=h2			};;
-
-{ .mfi;	(p16)	ld8		r15=[r10],16
-		xmpy.lu		f32=HF0,RF0		}
-{ .mfi;	(p16)	ld8		r16=[r11],16
-		xmpy.hu		f33=HF0,RF0		}
-{ .mfi;		xmpy.lu		f36=HF0,RF1		}
-{ .mfi;		xmpy.hu		f37=HF0,RF1		};;
-{ .mfi;		xmpy.lu		f34=HF1,SF1
-	(p15)	shrp		i0=r15,r14,56		}
-{ .mfi;		xmpy.hu		f35=HF1,SF1		}
-{ .mfi;		xmpy.lu		f38=HF1,RF0
-	(p15)	shrp		i1=r16,r15,56		}
-{ .mfi;		xmpy.hu		f39=HF1,RF0		}
-{ .mfi;		xmpy.lu		f40=HF2,SF1
-	(p14)	shrp		i0=r15,r14,48		}
-{ .mfi;		xmpy.lu		f41=HF2,RF0		};;
-
-{ .mmi;		getf.sig	r22=f32
-		getf.sig	r23=f33
-	(p14)	shrp		i1=r16,r15,48		}
-{ .mmi;		getf.sig	r24=f34
-		getf.sig	r25=f35
-	(p13)	shrp		i0=r15,r14,40		}
-{ .mmi;		getf.sig	r26=f36
-		getf.sig	r27=f37
-	(p13)	shrp		i1=r16,r15,40		}
-{ .mmi;		getf.sig	r28=f38
-		getf.sig	r29=f39
-	(p12)	shrp		i0=r15,r14,32		}
-{ .mmi;		getf.sig	r30=f40
-		getf.sig	r31=f41			};;
-
-{ .mmi;		add		h0=r22,r24
-		add		r23=r23,r25
-	(p12)	shrp		i1=r16,r15,32		}
-{ .mmi;		add		h1=r26,r28
-		add		r27=r27,r29
-	(p11)	shrp		i0=r15,r14,24		};;
-{ .mmi;		cmp.ltu		p6,p0=h0,r24
-		cmp.ltu		p7,p0=h1,r28
-		add		r23=r23,r30		};;
-{ .mmi;	(p6)	add		r23=1,r23
-	(p7)	add		r27=1,r27
-	(p11)	shrp		i1=r16,r15,24		};;
-{ .mmi;		add		h1=h1,r23;;
-		cmp.ltu		p6,p7=h1,r23
-	(p10)	shrp		i0=r15,r14,16		};;
-{ .mmi;	(p6)	add		h2=r31,r27,1
-	(p7)	add		h2=r31,r27
-	(p10)	shrp		i1=r16,r15,16		};;
-
-{ .mmi;	(p8)	mov		i0=r15
-		and		r22=-4,h2
-		shr.u		r23=h2,2		};;
-{ .mmi;		add		r22=r22,r23
-		and		h2=3,h2
-	(p9)	shrp		i0=r15,r14,8		};;
-
-{ .mmi;		add		h0=h0,r22;;
-		cmp.ltu		p6,p0=h0,r22
-	(p9)	shrp		i1=r16,r15,8		};;
-{ .mmi;	(p8)	mov		i1=r16
-	(p6)	cmp.eq.unc	p7,p0=-1,h1
-	(p6)	add		h1=1,h1			};;
-{ .mmb;	(p7)	add		h2=1,h2
-		mov		r14=r16
-		br.ctop.sptk	.Loop			};;
-.Lcend:
-
-{ .mii;	SUM		1<<1				// back to big-endian
-	mov		ar.lc=r3		};;
-
-{ .mmi;	st8		[r8]=h0,16
-	st8		[r9]=h1
-	mov		pr=r36,0x1ffff		};;
-{ .mmb;	st8		[r8]=h2
-	rum		1<<5
-	br.ret.sptk	b0			};;
-.endp	poly1305_blocks#
-
-.global	poly1305_emit#
-.proc	poly1305_emit#
-.align	64
-poly1305_emit:
-	.prologue
-	.save		ar.pfs,r2
-{ .mmi;	alloc		r2=ar.pfs,3,0,0,0
-	ADDP		r8=0,r32
-	ADDP		r9=8,r32		};;
-
-	.body
-{ .mmi;	ld8		r16=[r8],16			// load hash
-	ld8		r17=[r9]
-	ADDP		r10=0,r34		};;
-{ .mmi;	ld8		r18=[r8]
-	ld4		r24=[r10],8			// load nonce
-	ADDP		r11=4,r34		};;
-
-{ .mmi;	ld4		r25=[r11],8
-	ld4		r26=[r10]
-	add		r20=5,r16		};;
-
-{ .mmi;	ld4		r27=[r11]
-	cmp.ltu		p6,p7=r20,r16
-	shl		r25=r25,32		};;
-{ .mmi;
-(p6)	add		r21=1,r17
-(p7)	add		r21=0,r17
-(p6)	cmp.eq.or.andcm	p6,p7=-1,r17		};;
-{ .mmi;
-(p6)	add		r22=1,r18
-(p7)	add		r22=0,r18
-	shl		r27=r27,32		};;
-{ .mmi;	or		r24=r24,r25
-	or		r26=r26,r27
-	cmp.leu		p6,p7=4,r22		};;
-{ .mmi;
-(p6)	add		r16=r20,r24
-(p7)	add		r16=r16,r24
-(p6)	add		r17=r21,r26		};;
-{ .mii;
-(p7)	add		r17=r17,r26
-	cmp.ltu		p6,p7=r16,r24;;
-(p6)	add		r17=1,r17		};;
-
-{ .mmi;	ADDP		r8=0,r33
-	ADDP		r9=4,r33
-	shr.u		r20=r16,32		}
-{ .mmi;	ADDP		r10=8,r33
-	ADDP		r11=12,r33
-	shr.u		r21=r17,32		};;
-
-{ .mmi;	st1		[r8]=r16,1			// write mac, little-endian
-	st1		[r9]=r20,1
-	shr.u		r16=r16,8		}
-{ .mii;	st1		[r10]=r17,1
-	shr.u		r20=r20,8
-	shr.u		r17=r17,8		}
-{ .mmi;	st1		[r11]=r21,1
-	shr.u		r21=r21,8		};;
-
-{ .mmi;	st1		[r8]=r16,1
-	st1		[r9]=r20,1
-	shr.u		r16=r16,8		}
-{ .mii;	st1		[r10]=r17,1
-	shr.u		r20=r20,8
-	shr.u		r17=r17,8		}
-{ .mmi;	st1		[r11]=r21,1
-	shr.u		r21=r21,8		};;
-
-{ .mmi;	st1		[r8]=r16,1
-	st1		[r9]=r20,1
-	shr.u		r16=r16,8		}
-{ .mii;	st1		[r10]=r17,1
-	shr.u		r20=r20,8
-	shr.u		r17=r17,8		}
-{ .mmi;	st1		[r11]=r21,1
-	shr.u		r21=r21,8		};;
-
-{ .mmi;	st1		[r8]=r16
-	st1		[r9]=r20		}
-{ .mmb;	st1		[r10]=r17
-	st1		[r11]=r21
-	br.ret.sptk	b0			};;
-.endp	poly1305_emit#
-
-stringz	"Poly1305 for IA64, CRYPTOGAMS by \@dot-asm"
diff -Nru openssl-3.0.2/crypto/poly1305/build.info openssl-3.0.3/crypto/poly1305/build.info
--- openssl-3.0.2/crypto/poly1305/build.info	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/poly1305/build.info	2022-05-03 15:32:01.000000000 +0200
@@ -5,7 +5,7 @@
   $POLY1305ASM_x86=poly1305-x86.s
   $POLY1305ASM_x86_64=poly1305-x86_64.s
 
-  $POLY1305ASM_ia64=asm/poly1305-ia64.S
+  $POLY1305ASM_ia64=asm/poly1305-ia64.s
 
   $POLY1305ASM_sparcv9=poly1305-sparcv9.S
 
diff -Nru openssl-3.0.2/crypto/property/property_parse.c openssl-3.0.3/crypto/property/property_parse.c
--- openssl-3.0.2/crypto/property/property_parse.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/property/property_parse.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -45,7 +45,7 @@
 {
     const char *s = *t;
 
-    if (strncasecmp(s, m, m_len) == 0) {
+    if (OPENSSL_strncasecmp(s, m, m_len) == 0) {
         *t = skip_space(s + m_len);
         return 1;
     }
diff -Nru openssl-3.0.2/crypto/rand/rand_lib.c openssl-3.0.3/crypto/rand/rand_lib.c
--- openssl-3.0.2/crypto/rand/rand_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/rand/rand_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -768,22 +768,22 @@
 
     for (i = 0; i < sk_CONF_VALUE_num(elist); i++) {
         cval = sk_CONF_VALUE_value(elist, i);
-        if (strcasecmp(cval->name, "random") == 0) {
+        if (OPENSSL_strcasecmp(cval->name, "random") == 0) {
             if (!random_set_string(&dgbl->rng_name, cval->value))
                 return 0;
-        } else if (strcasecmp(cval->name, "cipher") == 0) {
+        } else if (OPENSSL_strcasecmp(cval->name, "cipher") == 0) {
             if (!random_set_string(&dgbl->rng_cipher, cval->value))
                 return 0;
-        } else if (strcasecmp(cval->name, "digest") == 0) {
+        } else if (OPENSSL_strcasecmp(cval->name, "digest") == 0) {
             if (!random_set_string(&dgbl->rng_digest, cval->value))
                 return 0;
-        } else if (strcasecmp(cval->name, "properties") == 0) {
+        } else if (OPENSSL_strcasecmp(cval->name, "properties") == 0) {
             if (!random_set_string(&dgbl->rng_propq, cval->value))
                 return 0;
-        } else if (strcasecmp(cval->name, "seed") == 0) {
+        } else if (OPENSSL_strcasecmp(cval->name, "seed") == 0) {
             if (!random_set_string(&dgbl->seed_name, cval->value))
                 return 0;
-        } else if (strcasecmp(cval->name, "seed_properties") == 0) {
+        } else if (OPENSSL_strcasecmp(cval->name, "seed_properties") == 0) {
             if (!random_set_string(&dgbl->seed_propq, cval->value))
                 return 0;
         } else {
diff -Nru openssl-3.0.2/crypto/rsa/rsa_backend.c openssl-3.0.3/crypto/rsa/rsa_backend.c
--- openssl-3.0.2/crypto/rsa/rsa_backend.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/rsa/rsa_backend.c	2022-05-03 15:32:01.000000000 +0200
@@ -27,8 +27,6 @@
 #include "crypto/rsa.h"
 #include "rsa_local.h"
 
-#include "e_os.h"                /* strcasecmp for Windows() */
-
 /*
  * The intention with the "backend" source file is to offer backend support
  * for legacy backends (EVP_PKEY_ASN1_METHOD and EVP_PKEY_METHOD) and provider
@@ -275,8 +273,8 @@
         else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgfname))
             return 0;
 
-        if (strcasecmp(param_mgf->data,
-                       ossl_rsa_mgf_nid2name(default_maskgenalg_nid)) != 0)
+        if (OPENSSL_strcasecmp(param_mgf->data,
+                               ossl_rsa_mgf_nid2name(default_maskgenalg_nid)) != 0)
             return 0;
     }
 
diff -Nru openssl-3.0.2/crypto/s390x_arch.h openssl-3.0.3/crypto/s390x_arch.h
--- openssl-3.0.2/crypto/s390x_arch.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/s390x_arch.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -72,6 +72,9 @@
     unsigned long long kdsa[2];
 };
 
+#if defined(__GNUC__) && defined(__linux)
+__attribute__ ((visibility("hidden")))
+#endif
 extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
 
 /* Max number of 64-bit words currently returned by STFLE */
diff -Nru openssl-3.0.2/crypto/s390xcap.c openssl-3.0.3/crypto/s390xcap.c
--- openssl-3.0.2/crypto/s390xcap.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/s390xcap.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2010-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -74,6 +74,9 @@
 
 struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
 
+#if defined(__GNUC__) && defined(__linux)
+__attribute__ ((visibility("hidden")))
+#endif
 void OPENSSL_cpuid_setup(void)
 {
     struct OPENSSL_s390xcap_st cap;
diff -Nru openssl-3.0.2/crypto/siphash/siphash.c openssl-3.0.3/crypto/siphash/siphash.c
--- openssl-3.0.2/crypto/siphash/siphash.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/siphash/siphash.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -204,7 +204,7 @@
     uint64_t v2 = ctx->v2;
     uint64_t v3 = ctx->v3;
 
-    if (outlen != (size_t)ctx->hash_size)
+    if (ctx->crounds == 0 || outlen == 0 || outlen != (size_t)ctx->hash_size)
         return 0;
 
     switch (ctx->len) {
diff -Nru openssl-3.0.2/crypto/sparse_array.c openssl-3.0.3/crypto/sparse_array.c
--- openssl-3.0.2/crypto/sparse_array.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/sparse_array.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -19,24 +19,19 @@
  * depth of the tree but potentially wastes more memory.  That is, this is a
  * direct space versus time tradeoff.
  *
- * The large memory model uses twelve bits which means that the are 4096
- * pointers in each tree node.  This is more than sufficient to hold the
- * largest defined NID (as of Feb 2019).  This means that using a NID to
- * index a sparse array becomes a constant time single array look up.
- *
- * The small memory model uses four bits which means the tree nodes contain
- * sixteen pointers.  This reduces the amount of unused space significantly
- * at a cost in time.
+ * The default is to use four bits which means that the are 16
+ * pointers in each tree node.
  *
  * The library builder is also permitted to define other sizes in the closed
- * interval [2, sizeof(ossl_uintmax_t) * 8].
+ * interval [2, sizeof(ossl_uintmax_t) * 8].  Space use generally scales
+ * exponentially with the block size, although the implementation only
+ * creates enough blocks to support the largest used index.  The depth is:
+ *      ceil(log_2(largest index) / 2^{block size})
+ * E.g. with a block size of 4, and a largest index of 1000, the depth
+ * will be three.
  */
 #ifndef OPENSSL_SA_BLOCK_BITS
-# ifdef OPENSSL_SMALL_FOOTPRINT
-#  define OPENSSL_SA_BLOCK_BITS           4
-# else
-#  define OPENSSL_SA_BLOCK_BITS           12
-# endif
+# define OPENSSL_SA_BLOCK_BITS           4
 #elif OPENSSL_SA_BLOCK_BITS < 2 || OPENSSL_SA_BLOCK_BITS > (BN_BITS2 - 1)
 # error OPENSSL_SA_BLOCK_BITS is out of range
 #endif
diff -Nru openssl-3.0.2/crypto/store/store_lib.c openssl-3.0.3/crypto/store/store_lib.c
--- openssl-3.0.2/crypto/store/store_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/store/store_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -93,7 +93,7 @@
     OPENSSL_strlcpy(scheme_copy, uri, sizeof(scheme_copy));
     if ((p = strchr(scheme_copy, ':')) != NULL) {
         *p++ = '\0';
-        if (strcasecmp(scheme_copy, "file") != 0) {
+        if (OPENSSL_strcasecmp(scheme_copy, "file") != 0) {
             if (strncmp(p, "//", 2) == 0)
                 schemes_n--;         /* Invalidate the file scheme */
             schemes[schemes_n++] = scheme_copy;
diff -Nru openssl-3.0.2/crypto/store/store_result.c openssl-3.0.3/crypto/store/store_result.c
--- openssl-3.0.2/crypto/store/store_result.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/store/store_result.c	2022-05-03 15:32:01.000000000 +0200
@@ -457,7 +457,7 @@
 
         /* If we have a data type, it should be a PEM name */
         if (data->data_type != NULL
-            && (strcasecmp(data->data_type, PEM_STRING_X509_TRUSTED) == 0))
+            && (OPENSSL_strcasecmp(data->data_type, PEM_STRING_X509_TRUSTED) == 0))
             ignore_trusted = 0;
 
         if (d2i_X509_AUX(&cert, (const unsigned char **)&data->octet_data,
diff -Nru openssl-3.0.2/crypto/threads_pthread.c openssl-3.0.3/crypto/threads_pthread.c
--- openssl-3.0.2/crypto/threads_pthread.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/threads_pthread.c	2022-05-03 15:32:01.000000000 +0200
@@ -17,6 +17,18 @@
 # include <atomic.h>
 #endif
 
+#if defined(__apple_build_version__) && __apple_build_version__ < 6000000
+/*
+ * OS/X 10.7 and 10.8 had a weird version of clang which has __ATOMIC_ACQUIRE and
+ * __ATOMIC_ACQ_REL but which expects only one parameter for __atomic_is_lock_free()
+ * rather than two which has signature __atomic_is_lock_free(sizeof(_Atomic(T))).
+ * All of this makes impossible to use __atomic_is_lock_free here.
+ *
+ * See: https://github.com/llvm/llvm-project/commit/a4c2602b714e6c6edb98164550a5ae829b2de760
+ */
+#define BROKEN_CLANG_ATOMICS
+#endif
+
 #if defined(OPENSSL_THREADS) && !defined(CRYPTO_TDEBUG) && !defined(OPENSSL_SYS_WINDOWS)
 
 # if defined(OPENSSL_SYS_UNIX)
@@ -188,7 +200,7 @@
 
 int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock)
 {
-# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL)
+# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS)
     if (__atomic_is_lock_free(sizeof(*val), val)) {
         *ret = __atomic_add_fetch(val, amount, __ATOMIC_ACQ_REL);
         return 1;
@@ -215,7 +227,7 @@
 int CRYPTO_atomic_or(uint64_t *val, uint64_t op, uint64_t *ret,
                      CRYPTO_RWLOCK *lock)
 {
-# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL)
+# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS)
     if (__atomic_is_lock_free(sizeof(*val), val)) {
         *ret = __atomic_or_fetch(val, op, __ATOMIC_ACQ_REL);
         return 1;
@@ -240,7 +252,7 @@
 
 int CRYPTO_atomic_load(uint64_t *val, uint64_t *ret, CRYPTO_RWLOCK *lock)
 {
-# if defined(__GNUC__) && defined(__ATOMIC_ACQUIRE)
+# if defined(__GNUC__) && defined(__ATOMIC_ACQUIRE) && !defined(BROKEN_CLANG_ATOMICS)
     if (__atomic_is_lock_free(sizeof(*val), val)) {
         __atomic_load(val, ret, __ATOMIC_ACQUIRE);
         return 1;
diff -Nru openssl-3.0.2/crypto/trace.c openssl-3.0.3/crypto/trace.c
--- openssl-3.0.2/crypto/trace.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/trace.c	2022-05-03 15:32:01.000000000 +0200
@@ -19,8 +19,6 @@
 #include "internal/refcount.h"
 #include "crypto/cryptlib.h"
 
-#include "e_os.h"                /* strcasecmp for Windows */
-
 #ifndef OPENSSL_NO_TRACE
 
 static CRYPTO_RWLOCK *trace_lock = NULL;
@@ -158,7 +156,7 @@
     size_t i;
 
     for (i = 0; i < OSSL_NELEM(trace_categories); i++)
-        if (strcasecmp(name, trace_categories[i].name) == 0)
+        if (OPENSSL_strcasecmp(name, trace_categories[i].name) == 0)
             return trace_categories[i].num;
     return -1; /* not found */
 }
diff -Nru openssl-3.0.2/crypto/x509/v3_tlsf.c openssl-3.0.3/crypto/x509/v3_tlsf.c
--- openssl-3.0.2/crypto/x509/v3_tlsf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/x509/v3_tlsf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -108,7 +108,7 @@
             extval = val->name;
 
         for (j = 0; j < OSSL_NELEM(tls_feature_tbl); j++)
-            if (strcasecmp(extval, tls_feature_tbl[j].name) == 0)
+            if (OPENSSL_strcasecmp(extval, tls_feature_tbl[j].name) == 0)
                 break;
         if (j < OSSL_NELEM(tls_feature_tbl))
             tlsextid = tls_feature_tbl[j].num;
diff -Nru openssl-3.0.2/crypto/x509/v3_utl.c openssl-3.0.3/crypto/x509/v3_utl.c
--- openssl-3.0.2/crypto/x509/v3_utl.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/crypto/x509/v3_utl.c	2022-05-03 15:32:01.000000000 +0200
@@ -349,7 +349,9 @@
                     ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_EMPTY_NAME);
                     goto err;
                 }
-                X509V3_add_value(ntmp, NULL, &values);
+                if (!X509V3_add_value(ntmp, NULL, &values)) {
+                    goto err;
+                }
             }
             break;
 
@@ -362,7 +364,9 @@
                     ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NULL_VALUE);
                     goto err;
                 }
-                X509V3_add_value(ntmp, vtmp, &values);
+                if (!X509V3_add_value(ntmp, vtmp, &values)) {
+                    goto err;
+                }
                 ntmp = NULL;
                 q = p + 1;
             }
@@ -376,14 +380,18 @@
             ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NULL_VALUE);
             goto err;
         }
-        X509V3_add_value(ntmp, vtmp, &values);
+        if (!X509V3_add_value(ntmp, vtmp, &values)) {
+            goto err;
+        }
     } else {
         ntmp = strip_spaces(q);
         if (!ntmp) {
             ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_EMPTY_NAME);
             goto err;
         }
-        X509V3_add_value(ntmp, NULL, &values);
+        if (!X509V3_add_value(ntmp, NULL, &values)) {
+            goto err;
+        }
     }
     OPENSSL_free(linebuf);
     return values;
@@ -707,7 +715,7 @@
     }
     /* IDNA labels cannot match partial wildcards */
     if (!allow_idna &&
-        subject_len >= 4 && strncasecmp((char *)subject, "xn--", 4) == 0)
+        subject_len >= 4 && OPENSSL_strncasecmp((char *)subject, "xn--", 4) == 0)
         return 0;
     /* The wildcard may match a literal '*' */
     if (wildcard_end == wildcard_start + 1 && *wildcard_start == '*')
@@ -767,7 +775,7 @@
                    || ('A' <= p[i] && p[i] <= 'Z')
                    || ('0' <= p[i] && p[i] <= '9')) {
             if ((state & LABEL_START) != 0
-                && len - i >= 4 && strncasecmp((char *)&p[i], "xn--", 4) == 0)
+                && len - i >= 4 && OPENSSL_strncasecmp((char *)&p[i], "xn--", 4) == 0)
                 state |= LABEL_IDNA;
             state &= ~(LABEL_HYPHEN | LABEL_START);
         } else if (p[i] == '.') {
diff -Nru openssl-3.0.2/debian/changelog openssl-3.0.3/debian/changelog
--- openssl-3.0.2/debian/changelog	2022-05-03 18:01:34.000000000 +0200
+++ openssl-3.0.3/debian/changelog	2022-05-05 10:56:04.000000000 +0200
@@ -1,3 +1,10 @@
+openssl (3.0.3-0ubuntu1) kinetic; urgency=medium
+
+  * New upstream release (LP: #1968997):
+    - d/p/CVE-2022-*: dropped, present upstream
+
+ -- Simon Chopin <simon.chopin@canonical.com>  Thu, 05 May 2022 10:56:04 +0200
+
 openssl (3.0.2-0ubuntu2) kinetic; urgency=medium
 
   * SECURITY UPDATE: c_rehash script allows command injection
diff -Nru openssl-3.0.2/debian/libssl3.symbols openssl-3.0.3/debian/libssl3.symbols
--- openssl-3.0.2/debian/libssl3.symbols	2021-12-07 17:15:51.000000000 +0100
+++ openssl-3.0.3/debian/libssl3.symbols	2022-05-05 10:56:04.000000000 +0200
@@ -1,6 +1,7 @@
 libcrypto.so.3 libssl3 #MINVER#
 * Build-Depends-Package: libssl-dev
  *@OPENSSL_3.0.0 3.0.0~~alpha1
+ *@OPENSSL_3.0.3 3.0.3-0ubuntu1
 libssl.so.3 libssl3 #MINVER#
 * Build-Depends-Package: libssl-dev
  *@OPENSSL_3.0.0 3.0.0~~alpha1
diff -Nru openssl-3.0.2/debian/patches/c_rehash-compat.patch openssl-3.0.3/debian/patches/c_rehash-compat.patch
--- openssl-3.0.2/debian/patches/c_rehash-compat.patch	2021-12-16 09:10:48.000000000 +0100
+++ openssl-3.0.3/debian/patches/c_rehash-compat.patch	2022-05-05 10:56:04.000000000 +0200
@@ -39,15 +39,15 @@
      }
  }
  
-@@ -161,6 +158,7 @@
+@@ -178,6 +175,7 @@
  
  sub link_hash_cert {
      my $fname = $_[0];
 +    my $x509hash = $_[1] || '-subject_hash';
-     $fname =~ s/\"/\\\"/g;
-     my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;
-     chomp $hash;
-@@ -198,10 +196,20 @@
+     my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash,
+                                        "-fingerprint", "-noout",
+                                        "-in", $fname);
+@@ -217,10 +215,20 @@
      $hashlist{$hash} = $fprint;
  }
  
@@ -65,6 +65,6 @@
  sub link_hash_crl {
      my $fname = $_[0];
 +    my $crlhash = $_[1] || "-hash";
-     $fname =~ s/'/'\\''/g;
-     my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;
-     chomp $hash;
+     my ($hash, $fprint) = compute_hash($openssl, "crl", $crlhash,
+                                        "-fingerprint", "-noout",
+                                        "-in", $fname);
diff -Nru openssl-3.0.2/debian/patches/CVE-2022-1292.patch openssl-3.0.3/debian/patches/CVE-2022-1292.patch
--- openssl-3.0.2/debian/patches/CVE-2022-1292.patch	2022-05-03 17:49:15.000000000 +0200
+++ openssl-3.0.3/debian/patches/CVE-2022-1292.patch	1970-01-01 01:00:00.000000000 +0100
@@ -1,73 +0,0 @@
-Backport of:
-
-From 1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2 Mon Sep 17 00:00:00 2001
-From: Tomas Mraz <tomas@openssl.org>
-Date: Tue, 26 Apr 2022 12:40:24 +0200
-Subject: [PATCH] c_rehash: Do not use shell to invoke openssl
-
-Except on VMS where it is safe.
-
-This fixes CVE-2022-1292.
-
-Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
-Reviewed-by: Matt Caswell <matt@openssl.org>
----
- tools/c_rehash.in | 29 +++++++++++++++++++++++++----
- 1 file changed, 25 insertions(+), 4 deletions(-)
-
---- a/tools/c_rehash.in
-+++ b/tools/c_rehash.in
-@@ -149,6 +149,23 @@ sub check_file {
-     return ($is_cert, $is_crl);
- }
- 
-+sub compute_hash {
-+    my $fh;
-+    if ( $^O eq "VMS" ) {
-+        # VMS uses the open through shell
-+        # The file names are safe there and list form is unsupported
-+        if (!open($fh, "-|", join(' ', @_))) {
-+            print STDERR "Cannot compute hash on '$fname'\n";
-+            return;
-+        }
-+    } else {
-+        if (!open($fh, "-|", @_)) {
-+            print STDERR "Cannot compute hash on '$fname'\n";
-+            return;
-+        }
-+    }
-+    return (<$fh>, <$fh>);
-+}
- 
- # Link a certificate to its subject name hash value, each hash is of
- # the form <hash>.<n> where n is an integer. If the hash value already exists
-@@ -159,10 +176,12 @@ sub check_file {
- sub link_hash_cert {
-     my $fname = $_[0];
-     my $x509hash = $_[1] || '-subject_hash';
--    $fname =~ s/\"/\\\"/g;
--    my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;
-+    my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash,
-+                                       "-fingerprint", "-noout",
-+                                       "-in", $fname);
-     chomp $hash;
-     chomp $fprint;
-+    return if !$hash;
-     $fprint =~ s/^.*=//;
-     $fprint =~ tr/://d;
-     my $suffix = 0;
-@@ -210,10 +229,12 @@ sub link_hash_crl_old {
- sub link_hash_crl {
-     my $fname = $_[0];
-     my $crlhash = $_[1] || "-hash";
--    $fname =~ s/'/'\\''/g;
--    my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;
-+    my ($hash, $fprint) = compute_hash($openssl, "crl", $crlhash,
-+                                       "-fingerprint", "-noout",
-+                                       "-in", $fname);
-     chomp $hash;
-     chomp $fprint;
-+    return if !$hash;
-     $fprint =~ s/^.*=//;
-     $fprint =~ tr/://d;
-     my $suffix = 0;
diff -Nru openssl-3.0.2/debian/patches/CVE-2022-1343-1.patch openssl-3.0.3/debian/patches/CVE-2022-1343-1.patch
--- openssl-3.0.2/debian/patches/CVE-2022-1343-1.patch	2022-05-03 17:50:38.000000000 +0200
+++ openssl-3.0.3/debian/patches/CVE-2022-1343-1.patch	1970-01-01 01:00:00.000000000 +0100
@@ -1,51 +0,0 @@
-From 2eda98790c5c2741d76d23cc1e74b0dc4f4b391a Mon Sep 17 00:00:00 2001
-From: Matt Caswell <matt@openssl.org>
-Date: Wed, 13 Apr 2022 16:36:54 +0100
-Subject: [PATCH] Fix OCSP_basic_verify signer certificate validation
-
-The function `OCSP_basic_verify` validates the signer certificate on an OCSP
-response. The internal function, ocsp_verify_signer, is responsible for this
-and is expected to return a 0 value in the event of a failure to verify.
-Unfortunately, due to a bug, it actually returns with a postive success
-response in this case. In the normal course of events OCSP_basic_verify
-will then continue and will fail anyway in the ocsp_check_issuer function
-because the supplied "chain" value will be empty in the case that
-ocsp_verify_signer failed to verify the chain. This will cause
-OCSP_basic_verify to return with a negative result (fatal error). Normally
-in the event of a failure to verify it should return with 0.
-
-However, in the case of the OCSP_NOCHECKS flag being used, OCSP_basic_verify
-will return with a positvie result. This could lead to callers trusting an
-OCSP Basic response when it should not be.
-
-CVE-2022-1343
-
-Fixes #18053
-
-Reviewed-by: Paul Dale <pauli@openssl.org>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
----
- crypto/ocsp/ocsp_vfy.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c
-index 7a4a45d537..3c5f48ec0a 100644
---- a/crypto/ocsp/ocsp_vfy.c
-+++ b/crypto/ocsp/ocsp_vfy.c
-@@ -59,9 +59,10 @@ static int ocsp_verify_signer(X509 *signer, int response,
- 
-     ret = X509_verify_cert(ctx);
-     if (ret <= 0) {
--        ret = X509_STORE_CTX_get_error(ctx);
-+        int err = X509_STORE_CTX_get_error(ctx);
-+
-         ERR_raise_data(ERR_LIB_OCSP, OCSP_R_CERTIFICATE_VERIFY_ERROR,
--                       "Verify error: %s", X509_verify_cert_error_string(ret));
-+                       "Verify error: %s", X509_verify_cert_error_string(err));
-         goto end;
-     }
-     if (chain != NULL)
--- 
-2.25.1
-
diff -Nru openssl-3.0.2/debian/patches/CVE-2022-1343-2.patch openssl-3.0.3/debian/patches/CVE-2022-1343-2.patch
--- openssl-3.0.2/debian/patches/CVE-2022-1343-2.patch	2022-05-03 17:50:42.000000000 +0200
+++ openssl-3.0.3/debian/patches/CVE-2022-1343-2.patch	1970-01-01 01:00:00.000000000 +0100
@@ -1,268 +0,0 @@
-From 55c80c222293a972587004c185dc5653ae207a0e Mon Sep 17 00:00:00 2001
-From: Matt Caswell <matt@openssl.org>
-Date: Wed, 13 Apr 2022 16:47:35 +0100
-Subject: [PATCH] Test ocsp with invalid responses and the "-no_cert_checks"
- option
-
-The "-no_cert_checks" option causes the flag OCSP_NOCHECKS to be set.
-The bug fixed in the previous commit will cause the ocsp app to respond with
-a success result in the case when the OCSP response signing certificate
-fails to verify and -no_cert_checks is used - so we test that it fails in
-this case.
-
-Reviewed-by: Paul Dale <pauli@openssl.org>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
----
- test/recipes/80-test_ocsp.t | 122 +++++++++++++++++++-----------------
- 1 file changed, 65 insertions(+), 57 deletions(-)
-
-diff --git a/test/recipes/80-test_ocsp.t b/test/recipes/80-test_ocsp.t
-index d42030cb89..34fdfcbccc 100644
---- a/test/recipes/80-test_ocsp.t
-+++ b/test/recipes/80-test_ocsp.t
-@@ -35,6 +35,7 @@ sub test_ocsp {
-         $untrusted = $CAfile;
-     }
-     my $expected_exit = shift;
-+    my $nochecks = shift;
-     my $outputfile = basename($inputfile, '.ors') . '.dat';
- 
-     run(app(["openssl", "base64", "-d",
-@@ -45,7 +46,8 @@ sub test_ocsp {
-                            "-partial_chain", @check_time,
-                            "-CAfile", catfile($ocspdir, $CAfile),
-                            "-verify_other", catfile($ocspdir, $untrusted),
--                           "-no-CApath", "-no-CAstore"])),
-+                           "-no-CApath", "-no-CAstore",
-+                           $nochecks ? "-no_cert_checks" : ()])),
-                   $title); });
- }
- 
-@@ -55,143 +57,149 @@ subtest "=== VALID OCSP RESPONSES ===" => sub {
-     plan tests => 7;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
-+              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "ND2.ors", "ND2_Issuer_Root.pem", "", 0);
-+              "ND2.ors", "ND2_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "ND3.ors", "ND3_Issuer_Root.pem", "", 0);
-+              "ND3.ors", "ND3_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
--              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
-+              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "D1.ors", "D1_Issuer_ICA.pem", "", 0);
-+              "D1.ors", "D1_Issuer_ICA.pem", "", 0, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "D2.ors", "D2_Issuer_Root.pem", "", 0);
-+              "D2.ors", "D2_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "D3.ors", "D3_Issuer_Root.pem", "", 0);
-+              "D3.ors", "D3_Issuer_Root.pem", "", 0, 0);
- };
- 
- subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
-+              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
-+              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
-+              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
-+              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
-+              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
-+              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
-+              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
-+              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
-+              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
-+              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
-+              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
-+              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
-     plan tests => 3;
- 
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
--    plan tests => 3;
-+    plan tests => 6;
- 
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
-+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
-+    test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
-+    test_ocsp("DELEGATED; Root CA -> EE",
-+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
-+    test_ocsp("DELEGATED; Intermediate CA -> EE",
-+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 1);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
-+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 1);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
-+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 1);
- };
- 
- subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
-+              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
-+              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
-+              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
-+              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
-+              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
-+              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
-     plan tests => 6;
- 
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
-+              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
-+              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
-+              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
-+              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
-+              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
-+              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1, 0);
- };
- 
- subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
-@@ -199,17 +207,17 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
- 
-     # Expect success, because we're explicitly trusting the issuer certificate.
-     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
--              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
-+              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
--              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
-+              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("NON-DELEGATED; Root CA -> EE",
--              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
-+              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("DELEGATED; Intermediate CA -> EE",
--              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
-+              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0, 0);
-     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
--              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
-+              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0, 0);
-     test_ocsp("DELEGATED; Root CA -> EE",
--              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
-+              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0);
- };
- 
- subtest "=== OCSP API TESTS===" => sub {
--- 
-2.25.1
-
diff -Nru openssl-3.0.2/debian/patches/CVE-2022-1434.patch openssl-3.0.3/debian/patches/CVE-2022-1434.patch
--- openssl-3.0.2/debian/patches/CVE-2022-1434.patch	2022-05-03 17:50:50.000000000 +0200
+++ openssl-3.0.3/debian/patches/CVE-2022-1434.patch	1970-01-01 01:00:00.000000000 +0100
@@ -1,87 +0,0 @@
-From 7d56a74a96828985db7354a55227a511615f732b Mon Sep 17 00:00:00 2001
-From: Matt Caswell <matt@openssl.org>
-Date: Fri, 15 Apr 2022 10:22:59 +0100
-Subject: [PATCH] Fix the RC4-MD5 cipher
-
-A copy&paste error meant that the RC4-MD5 cipher (used in TLS) used the TLS
-AAD data as the MAC key.
-
-CVE-2022-1434
-
-Fixes #18112
-
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
-Reviewed-by: Matt Caswell <matt@openssl.org>
----
- .../ciphers/cipher_rc4_hmac_md5.c             |  2 +-
- .../30-test_evp_data/evpciph_aes_stitched.txt | 22 -------------------
- .../30-test_evp_data/evpciph_rc4_stitched.txt |  4 ++--
- 3 files changed, 3 insertions(+), 25 deletions(-)
-
-diff --git a/providers/implementations/ciphers/cipher_rc4_hmac_md5.c b/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
-index b915122a39..fc11c80a86 100644
---- a/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
-+++ b/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
-@@ -183,7 +183,7 @@ static int rc4_hmac_md5_set_ctx_params(void *vctx, const OSSL_PARAM params[])
-         }
-         ctx->tls_aad_pad_sz = sz;
-     }
--    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
-+    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_MAC_KEY);
-     if (p != NULL) {
-         if (p->data_type != OSSL_PARAM_OCTET_STRING) {
-             ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
-diff --git a/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt b/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt
-index 40e2695fb2..ef2d1a27f9 100644
---- a/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt
-+++ b/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt
-@@ -124,25 +124,3 @@ TLSVersion = 0x0302
- Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f
- Ciphertext = 261cd0c88a4d4e6db7fc263257a9f6d0ce83c1ff5f2680dc57ffd8eefdbb9c00d3d507672d105a990b2b78509978625b9d93c2bd41e3fb721abd1496553c583c67dad9b662b3d58c8540e10ed9c5ed1a7f33ce9e9a41c30836651d73ee2c003af03a919eb41a6d70ef814e184e740f8a96221b924d9d025ef5e7150d4ca76921a025dd146fef87da738877313f11ec8f4c558b878c28ce6a9a5011d70f58c5dbd3412cf0a32154f5a4286958a5a50a86f15119835ceccf432601e4cc688cdd682ac9620500b60c0760bb93209859823778a7f2b5bab1af259bda13d84f952af9d2f07f500dadedc41a2b6a737a1296e0b2fb96ac4da4bf71fe2f0c4a1b6fc4dd251087e4c03d2e28c85a9b4a835ef166b48e5b7690f332a1d8db7bd9380221891f31ee82f4b8dd9ebf540cab583a0f33
- NextIV = 1f31ee82f4b8dd9ebf540cab583a0f33
--
--Title = RC4-HMAC-MD5 test vectors
--
--Availablein = legacy
--Cipher = RC4-HMAC-MD5
--Key = d48ecc0a163a06626bd1b7e172dfb5b3
--MACKey = 5973581f63768353af37d3f51ec9f6ef
--TLSAAD = 90a1b2c3e4f506172803010050
--TLSVersion = 0x0301
--Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
--Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
--Operation = ENCRYPT
--
--Availablein = legacy
--Cipher = RC4-HMAC-MD5
--Key = d48ecc0a163a06626bd1b7e172dfb5b3
--MACKey = 5973581f63768353af37d3f51ec9f6ef
--TLSAAD = 90a1b2c3e4f506172803010060
--TLSVersion = 0x0301
--Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
--Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
--Operation = DECRYPT
-diff --git a/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt b/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt
-index a41ddab0f2..e421c5e97d 100644
---- a/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt
-+++ b/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt
-@@ -7,7 +7,7 @@ MACKey = 5973581f63768353af37d3f51ec9f6ef
- TLSAAD = 90a1b2c3e4f506172803010050
- TLSVersion = 0x0301
- Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
--Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
-+Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716
- # DECRYPT must be a separate entry due to change in TLSAAD value
- Operation = ENCRYPT
- 
-@@ -18,5 +18,5 @@ MACKey = 5973581f63768353af37d3f51ec9f6ef
- TLSAAD = 90a1b2c3e4f506172803010060
- TLSVersion = 0x0301
- Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
--Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
-+Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716
- Operation = DECRYPT
--- 
-2.25.1
-
diff -Nru openssl-3.0.2/debian/patches/CVE-2022-1473.patch openssl-3.0.3/debian/patches/CVE-2022-1473.patch
--- openssl-3.0.2/debian/patches/CVE-2022-1473.patch	2022-05-03 17:51:00.000000000 +0200
+++ openssl-3.0.3/debian/patches/CVE-2022-1473.patch	1970-01-01 01:00:00.000000000 +0100
@@ -1,27 +0,0 @@
-From 64c85430f95200b6b51fe9475bd5203f7c19daf1 Mon Sep 17 00:00:00 2001
-From: Hugo Landau <hlandau@openssl.org>
-Date: Thu, 21 Apr 2022 16:10:33 +0100
-Subject: [PATCH] Fix bug in OPENSSL_LH_flush
-
-Fixes #18139.
-
-Reviewed-by: Richard Levitte <levitte@openssl.org>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/18141)
-
-(cherry picked from commit e5da68183410c06f7b350a0721bc2bd6057e438e)
----
- crypto/lhash/lhash.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/crypto/lhash/lhash.c
-+++ b/crypto/lhash/lhash.c
-@@ -123,6 +123,8 @@ void OPENSSL_LH_flush(OPENSSL_LHASH *lh)
-         }
-         lh->b[i] = NULL;
-     }
-+
-+    lh->num_items = 0;
- }
- 
- void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
diff -Nru openssl-3.0.2/debian/patches/series openssl-3.0.3/debian/patches/series
--- openssl-3.0.2/debian/patches/series	2022-05-03 17:50:56.000000000 +0200
+++ openssl-3.0.3/debian/patches/series	2022-05-05 10:56:04.000000000 +0200
@@ -11,8 +11,3 @@
 tests-use-seclevel-1.patch
 tls1.2-min-seclevel2.patch
 skip_tls1.1_seclevel3_tests.patch
-CVE-2022-1292.patch
-CVE-2022-1343-1.patch
-CVE-2022-1343-2.patch
-CVE-2022-1434.patch
-CVE-2022-1473.patch
diff -Nru openssl-3.0.2/doc/build.info openssl-3.0.3/doc/build.info
--- openssl-3.0.2/doc/build.info	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/build.info	2022-05-03 15:32:01.000000000 +0200
@@ -1531,6 +1531,10 @@
 GENERATE[html/man3/OPENSSL_secure_malloc.html]=man3/OPENSSL_secure_malloc.pod
 DEPEND[man/man3/OPENSSL_secure_malloc.3]=man3/OPENSSL_secure_malloc.pod
 GENERATE[man/man3/OPENSSL_secure_malloc.3]=man3/OPENSSL_secure_malloc.pod
+DEPEND[html/man3/OPENSSL_strcasecmp.html]=man3/OPENSSL_strcasecmp.pod
+GENERATE[html/man3/OPENSSL_strcasecmp.html]=man3/OPENSSL_strcasecmp.pod
+DEPEND[man/man3/OPENSSL_strcasecmp.3]=man3/OPENSSL_strcasecmp.pod
+GENERATE[man/man3/OPENSSL_strcasecmp.3]=man3/OPENSSL_strcasecmp.pod
 DEPEND[html/man3/OSSL_CMP_CTX_new.html]=man3/OSSL_CMP_CTX_new.pod
 GENERATE[html/man3/OSSL_CMP_CTX_new.html]=man3/OSSL_CMP_CTX_new.pod
 DEPEND[man/man3/OSSL_CMP_CTX_new.3]=man3/OSSL_CMP_CTX_new.pod
@@ -3110,6 +3114,7 @@
 html/man3/OPENSSL_malloc.html \
 html/man3/OPENSSL_s390xcap.html \
 html/man3/OPENSSL_secure_malloc.html \
+html/man3/OPENSSL_strcasecmp.html \
 html/man3/OSSL_CMP_CTX_new.html \
 html/man3/OSSL_CMP_HDR_get0_transactionID.html \
 html/man3/OSSL_CMP_ITAV_set0.html \
@@ -3704,6 +3709,7 @@
 man/man3/OPENSSL_malloc.3 \
 man/man3/OPENSSL_s390xcap.3 \
 man/man3/OPENSSL_secure_malloc.3 \
+man/man3/OPENSSL_strcasecmp.3 \
 man/man3/OSSL_CMP_CTX_new.3 \
 man/man3/OSSL_CMP_HDR_get0_transactionID.3 \
 man/man3/OSSL_CMP_ITAV_set0.3 \
diff -Nru openssl-3.0.2/doc/fingerprints.txt openssl-3.0.3/doc/fingerprints.txt
--- openssl-3.0.2/doc/fingerprints.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/fingerprints.txt	2022-05-03 15:32:01.000000000 +0200
@@ -19,4 +19,7 @@
 8657 ABB2 60F0 56B1 E519 0839 D9C4 D26D 0E60 4491
 
 Paul Dale:
-1B72 6772 1033 CC88 A531 5EF5 5359 C4D8 443B 383B
+B7C1 C143 60F3 53A3 6862 E4D5 231C 84CD DCC6 9C45
+
+Tomáš Mráz:
+A21F AB74 B008 8AA3 6115 2586 B8EF 1A6B A9DA 2D5C
diff -Nru openssl-3.0.2/doc/man3/BIO_meth_new.pod openssl-3.0.3/doc/man3/BIO_meth_new.pod
--- openssl-3.0.2/doc/man3/BIO_meth_new.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/BIO_meth_new.pod	2022-05-03 15:32:01.000000000 +0200
@@ -118,7 +118,10 @@
 called in response to the application calling BIO_new() and passing
 in a pointer to the current BIO_METHOD. The BIO_new() function will allocate the
 memory for the new BIO, and a pointer to this newly allocated structure will
-be passed as a parameter to the function.
+be passed as a parameter to the function. If a create function is set,
+BIO_new() will not mark the BIO as initialised on allocation.
+L<BIO_set_init(3)> must then be called either by the create function, or later,
+by a BIO ctrl function, once BIO initialisation is complete.
 
 BIO_meth_get_destroy() and BIO_meth_set_destroy() get and set the function used
 for destroying an instance of a BIO respectively. This function will be
@@ -154,7 +157,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_blake2b512.pod openssl-3.0.3/doc/man3/EVP_blake2b512.pod
--- openssl-3.0.2/doc/man3/EVP_blake2b512.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_blake2b512.pod	2022-05-03 15:32:01.000000000 +0200
@@ -34,7 +34,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -54,7 +54,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_md2.pod openssl-3.0.3/doc/man3/EVP_md2.pod
--- openssl-3.0.2/doc/man3/EVP_md2.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_md2.pod	2022-05-03 15:32:01.000000000 +0200
@@ -28,7 +28,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -43,7 +43,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_md4.pod openssl-3.0.3/doc/man3/EVP_md4.pod
--- openssl-3.0.2/doc/man3/EVP_md4.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_md4.pod	2022-05-03 15:32:01.000000000 +0200
@@ -29,7 +29,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -44,7 +44,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_md5.pod openssl-3.0.3/doc/man3/EVP_md5.pod
--- openssl-3.0.2/doc/man3/EVP_md5.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_md5.pod	2022-05-03 15:32:01.000000000 +0200
@@ -40,7 +40,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -54,7 +54,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_mdc2.pod openssl-3.0.3/doc/man3/EVP_mdc2.pod
--- openssl-3.0.2/doc/man3/EVP_mdc2.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_mdc2.pod	2022-05-03 15:32:01.000000000 +0200
@@ -29,7 +29,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -44,7 +44,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_ripemd160.pod openssl-3.0.3/doc/man3/EVP_ripemd160.pod
--- openssl-3.0.2/doc/man3/EVP_ripemd160.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_ripemd160.pod	2022-05-03 15:32:01.000000000 +0200
@@ -28,7 +28,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -43,7 +43,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_sha1.pod openssl-3.0.3/doc/man3/EVP_sha1.pod
--- openssl-3.0.2/doc/man3/EVP_sha1.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_sha1.pod	2022-05-03 15:32:01.000000000 +0200
@@ -29,7 +29,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -43,7 +43,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_sha224.pod openssl-3.0.3/doc/man3/EVP_sha224.pod
--- openssl-3.0.2/doc/man3/EVP_sha224.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_sha224.pod	2022-05-03 15:32:01.000000000 +0200
@@ -49,7 +49,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -63,7 +63,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_sha3_224.pod openssl-3.0.3/doc/man3/EVP_sha3_224.pod
--- openssl-3.0.2/doc/man3/EVP_sha3_224.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_sha3_224.pod	2022-05-03 15:32:01.000000000 +0200
@@ -54,7 +54,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -68,7 +68,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/EVP_sm3.pod openssl-3.0.3/doc/man3/EVP_sm3.pod
--- openssl-3.0.2/doc/man3/EVP_sm3.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_sm3.pod	2022-05-03 15:32:01.000000000 +0200
@@ -28,7 +28,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -42,7 +42,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 Copyright 2017 Ribose Inc. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
diff -Nru openssl-3.0.2/doc/man3/EVP_whirlpool.pod openssl-3.0.3/doc/man3/EVP_whirlpool.pod
--- openssl-3.0.2/doc/man3/EVP_whirlpool.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/EVP_whirlpool.pod	2022-05-03 15:32:01.000000000 +0200
@@ -30,7 +30,7 @@
 =head1 RETURN VALUES
 
 These functions return a B<EVP_MD> structure that contains the
-implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for
+implementation of the message digest. See L<EVP_MD_meth_new(3)> for
 details of the B<EVP_MD> structure.
 
 =head1 CONFORMING TO
@@ -45,7 +45,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/OPENSSL_LH_stats.pod openssl-3.0.3/doc/man3/OPENSSL_LH_stats.pod
--- openssl-3.0.2/doc/man3/OPENSSL_LH_stats.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/OPENSSL_LH_stats.pod	2022-05-03 15:32:01.000000000 +0200
@@ -23,9 +23,10 @@
 The B<LHASH> structure records statistics about most aspects of
 accessing the hash table.
 
-OPENSSL_LH_stats() prints out statistics on the size of the hash table, how
-many entries are in it, and the number and result of calls to the
-routines in this library.
+OPENSSL_LH_stats() prints out statistics on the size of the hash table and how
+many entries are in it. For historical reasons, this function also outputs a
+number of additional statistics, but the tracking of these statistics is no
+longer supported and these statistics are always reported as zero.
 
 OPENSSL_LH_node_stats() prints the number of entries for each 'bucket' in the
 hash table.
@@ -58,7 +59,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/OPENSSL_strcasecmp.pod openssl-3.0.3/doc/man3/OPENSSL_strcasecmp.pod
--- openssl-3.0.2/doc/man3/OPENSSL_strcasecmp.pod	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/doc/man3/OPENSSL_strcasecmp.pod	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,47 @@
+=pod
+
+=head1 NAME
+
+OPENSSL_strcasecmp, OPENSSL_strncasecmp - compare two strings ignoring case
+
+=head1 SYNOPSIS
+
+ #include <openssl/crypto.h>
+
+ int OPENSSL_strcasecmp(const char *s1, const char *s2);
+ int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n);
+
+=head1 DESCRIPTION
+
+The OPENSSL_strcasecmp function performs a byte-by-byte comparison of the strings
+B<s1> and B<s2>, ignoring the case of the characters.
+
+The OPENSSL_strncasecmp function is similar, except that it compares no more than
+B<n> bytes of B<s1> and B<s2>.
+
+In POSIX-compatible system and on Windows these functions use "C" locale for
+case insensitive. Otherwise the comparison is done in current locale.
+
+=head1 RETURN VALUES
+
+Both functions return an integer less than, equal to, or greater than zero if
+s1 is found, respectively, to be less than, to match, or be greater than s2.
+
+=head1 NOTES
+
+OpenSSL extensively uses case insensitive comparison of ASCII strings. Though
+OpenSSL itself is locale-agnostic, the applications using OpenSSL libraries may
+unpredictably suffer when they use localization (e.g. Turkish locale is
+well-known with a specific I/i cases). These functions use C locale for string
+comparison.
+
+=head1 COPYRIGHT
+
+Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff -Nru openssl-3.0.2/doc/man3/OSSL_CMP_CTX_new.pod openssl-3.0.3/doc/man3/OSSL_CMP_CTX_new.pod
--- openssl-3.0.2/doc/man3/OSSL_CMP_CTX_new.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/OSSL_CMP_CTX_new.pod	2022-05-03 15:32:01.000000000 +0200
@@ -244,7 +244,7 @@
                                         ("indirect method")
 
         Note that a signature-based POPO can only be produced if a private key
-        is provided as the newPkey or client pkey component of the CMP context.
+        is provided as the newPkey or client's pkey component of the CMP context.
 
 =item B<OSSL_CMP_OPT_DIGEST_ALGNID>
 
@@ -441,7 +441,7 @@
 OSSL_CMP_CTX_get0_untrusted(OSSL_CMP_CTX *ctx) returns a pointer to the
 list of untrusted certs, which may be empty if unset.
 
-OSSL_CMP_CTX_set1_cert() sets the certificate related to the private key
+OSSL_CMP_CTX_set1_cert() sets the certificate related to the client's private key
 used for CMP message protection.
 Therefore the public key of this I<cert> must correspond to
 the private key set before or thereafter via OSSL_CMP_CTX_set1_pkey().
@@ -468,7 +468,7 @@
 is performed on demand that is equivalent to calling this function
 with the I<candidates> and I<own_trusted> arguments being NULL.
 
-OSSL_CMP_CTX_set1_pkey() sets the private key corresponding to the
+OSSL_CMP_CTX_set1_pkey() sets the client's private key corresponding to the
 CMP signer certificate set via OSSL_CMP_CTX_set1_cert().
 This key is used create signature-based protection (protectionAlg = MSG_SIG_ALG)
 of outgoing messages
@@ -519,7 +519,7 @@
 OSSL_CMP_CTX_get0_newPkey() gives the key to use for certificate enrollment
 dependent on fields of the CMP context structure:
 the newPkey (which may be a private or public key) if present,
-else the public key in the p10CSR if present, else the client private key.
+else the public key in the p10CSR if present, else the client's private key.
 If the I<priv> parameter is not 0 and the selected key does not have a
 private component then NULL is returned.
 
diff -Nru openssl-3.0.2/doc/man3/OSSL_CMP_MSG_get0_header.pod openssl-3.0.3/doc/man3/OSSL_CMP_MSG_get0_header.pod
--- openssl-3.0.2/doc/man3/OSSL_CMP_MSG_get0_header.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/OSSL_CMP_MSG_get0_header.pod	2022-05-03 15:32:01.000000000 +0200
@@ -40,19 +40,35 @@
 for inclusion in a CMP request message based on details contained in I<ctx>.
 The I<rid> argument defines the request identifier to use, which typically is 0.
 
-The subject DN to include in the certificate template is determined as follows.
-If I<ctx> includes a subject name set via L<OSSL_CMP_CTX_set1_subjectName(3)>,
-this name is used.
-Otherwise, if a PKCS#10 CSR is given in I<ctx>, its subject is used.
-Otherwise, if a reference certificate is given in I<ctx>
-(see L<OSSL_CMP_CTX_set1_oldCert(3)>), its subject is used if I<for_KUR>
-is nonzero or the I<ctx> does not include a Subject Alternative Name.
-
-The public key to include is taken from any value set via
-L<OSSL_CMP_CTX_set0_newPkey(3)>,
-otherwise the public key of any PKCS#10 CSR is given in I<ctx>,
-otherwise the public key of any reference certificate given in I<ctx>,
-otherwise it is derived from the client private key if given in I<ctx>.
+The subject DN included in the certificate template is
+the first available value of these:
+
+=over 4
+
+=item any subject name in I<ctx> set via L<OSSL_CMP_CTX_set1_subjectName(3)>,
+
+=item the subject field of any PKCS#10 CSR is given in I<ctx>, or
+
+=item the subject field of any reference certificate given in I<ctx>
+(see L<OSSL_CMP_CTX_set1_oldCert(3)>), if I<for_KUR> is nonzero
+or the I<ctx> does not include a Subject Alternative Name.
+
+=back
+
+The public key included is the first available value of these:
+
+=over 4
+
+=item the public key derived from any key set via L<OSSL_CMP_CTX_set0_newPkey(3)>,
+
+=item the public key of any PKCS#10 CSR is given in I<ctx>,
+
+=item the public key of any reference certificate given in I<ctx>, or
+
+=item the public key derived from any client's private key
+set via L<OSSL_CMP_CTX_set1_pkey(3)>.
+
+=back
 
 The set of X.509 extensions to include is computed as follows.
 If a PKCS#10 CSR is present in I<ctx>, default extensions are taken from there,
diff -Nru openssl-3.0.2/doc/man3/PEM_read_bio_PrivateKey.pod openssl-3.0.3/doc/man3/PEM_read_bio_PrivateKey.pod
--- openssl-3.0.2/doc/man3/PEM_read_bio_PrivateKey.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/PEM_read_bio_PrivateKey.pod	2022-05-03 15:32:01.000000000 +0200
@@ -193,8 +193,8 @@
 =head1 DESCRIPTION
 
 All of the functions described on this page that have a I<TYPE> of B<DH>, B<DSA>
-and B<RSA> are deprecated. Applications should use OSSL_ENCODER_to_bio() and
-OSSL_DECODER_from_bio() instead.
+and B<RSA> are deprecated. Applications should use L<OSSL_ENCODER_to_bio(3)> and
+L<OSSL_DECODER_from_bio(3)> instead.
 
 The PEM functions read or write structures in PEM format. In
 this sense PEM format is simply base64 encoded data surrounded
diff -Nru openssl-3.0.2/doc/man3/SSL_CONF_cmd.pod openssl-3.0.3/doc/man3/SSL_CONF_cmd.pod
--- openssl-3.0.2/doc/man3/SSL_CONF_cmd.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CONF_cmd.pod	2022-05-03 15:32:01.000000000 +0200
@@ -64,7 +64,7 @@
 setting B<SSL_OP_ALLOW_CLIENT_RENEGOTIATION>.
 Only used by servers.
 
-=item B<-legacyrenegotiation>
+=item B<-legacy_renegotiation>
 
 Permits the use of unsafe legacy renegotiation. Equivalent to setting
 B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION>.
diff -Nru openssl-3.0.2/doc/man3/SSL_CTX_get0_param.pod openssl-3.0.3/doc/man3/SSL_CTX_get0_param.pod
--- openssl-3.0.2/doc/man3/SSL_CTX_get0_param.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CTX_get0_param.pod	2022-05-03 15:32:01.000000000 +0200
@@ -2,7 +2,8 @@
 
 =head1 NAME
 
-SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param -
+SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param,
+SSL_CTX_set_purpose, SSL_CTX_set_trust, SSL_set_purpose, SSL_set_trust -
 get and set verification parameters
 
 =head1 SYNOPSIS
@@ -14,6 +15,12 @@
  int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm);
  int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm);
 
+ int SSL_CTX_set_purpose(SSL_CTX *ctx, int purpose);
+ int SSL_set_purpose(SSL *ssl, int purpose);
+
+ int SSL_CTX_set_trust(SSL_CTX *ctx, int trust);
+ int SSL_set_trust(SSL *ssl, int trust);
+
 =head1 DESCRIPTION
 
 SSL_CTX_get0_param() and SSL_get0_param() retrieve an internal pointer to
@@ -23,6 +30,14 @@
 SSL_CTX_set1_param() and SSL_set1_param() set the verification parameters
 to B<vpm> for B<ctx> or B<ssl>.
 
+The functions SSL_CTX_set_purpose() and SSL_set_purpose() are shorthands which
+set the purpose parameter on the verification parameters object. These functions
+are equivalent to calling X509_VERIFY_PARAM_set_purpose() directly.
+
+The functions SSL_CTX_set_trust() and SSL_set_trust() are similarly shorthands
+which set the trust parameter on the verification parameters object. These
+functions are equivalent to calling X509_VERIFY_PARAM_set_trust() directly.
+
 =head1 NOTES
 
 Typically parameters are retrieved from an B<SSL_CTX> or B<SSL> structure
@@ -34,8 +49,9 @@
 SSL_CTX_get0_param() and SSL_get0_param() return a pointer to an
 B<X509_VERIFY_PARAM> structure.
 
-SSL_CTX_set1_param() and SSL_set1_param() return 1 for success and 0
-for failure.
+SSL_CTX_set1_param(), SSL_set1_param(), SSL_CTX_set_purpose(),
+SSL_set_purpose(), SSL_CTX_set_trust() and SSL_set_trust() return 1 for success
+and 0 for failure.
 
 =head1 EXAMPLES
 
@@ -55,7 +71,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/SSL_CTX_set1_verify_cert_store.pod openssl-3.0.3/doc/man3/SSL_CTX_set1_verify_cert_store.pod
--- openssl-3.0.2/doc/man3/SSL_CTX_set1_verify_cert_store.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CTX_set1_verify_cert_store.pod	2022-05-03 15:32:01.000000000 +0200
@@ -5,7 +5,9 @@
 SSL_CTX_set0_verify_cert_store, SSL_CTX_set1_verify_cert_store,
 SSL_CTX_set0_chain_cert_store, SSL_CTX_set1_chain_cert_store,
 SSL_set0_verify_cert_store, SSL_set1_verify_cert_store,
-SSL_set0_chain_cert_store, SSL_set1_chain_cert_store - set certificate
+SSL_set0_chain_cert_store, SSL_set1_chain_cert_store,
+SSL_CTX_get0_verify_cert_store, SSL_CTX_get0_chain_cert_store,
+SSL_get0_verify_cert_store, SSL_get0_chain_cert_store - set certificate
 verification or chain store
 
 =head1 SYNOPSIS
@@ -16,11 +18,15 @@
  int SSL_CTX_set1_verify_cert_store(SSL_CTX *ctx, X509_STORE *st);
  int SSL_CTX_set0_chain_cert_store(SSL_CTX *ctx, X509_STORE *st);
  int SSL_CTX_set1_chain_cert_store(SSL_CTX *ctx, X509_STORE *st);
+ int SSL_CTX_get0_verify_cert_store(SSL_CTX *ctx, X509_STORE **st);
+ int SSL_CTX_get0_chain_cert_store(SSL_CTX *ctx, X509_STORE **st);
 
  int SSL_set0_verify_cert_store(SSL *ctx, X509_STORE *st);
  int SSL_set1_verify_cert_store(SSL *ctx, X509_STORE *st);
  int SSL_set0_chain_cert_store(SSL *ctx, X509_STORE *st);
  int SSL_set1_chain_cert_store(SSL *ctx, X509_STORE *st);
+ int SSL_get0_verify_cert_store(SSL *ctx, X509_STORE **st);
+ int SSL_get0_chain_cert_store(SSL *ctx, X509_STORE **st);
 
 =head1 DESCRIPTION
 
@@ -34,6 +40,11 @@
 SSL_set0_chain_cert_store() and SSL_set1_chain_cert_store() are similar
 except they apply to SSL structure B<ssl>.
 
+SSL_CTX_get0_verify_chain_store(), SSL_get0_verify_chain_store(),
+SSL_CTX_get0_chain_cert_store() and SSL_get0_chain_cert_store() retrieve the
+objects previously set via the above calls. A pointer to the object (or NULL if
+no such object has been set) is written to B<*st>.
+
 All these functions are implemented as macros. Those containing a B<1>
 increment the reference count of the supplied store so it must
 be freed at some point after the operation. Those containing a B<0> do
@@ -94,7 +105,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/SSL_CTX_set_ssl_version.pod openssl-3.0.3/doc/man3/SSL_CTX_set_ssl_version.pod
--- openssl-3.0.2/doc/man3/SSL_CTX_set_ssl_version.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CTX_set_ssl_version.pod	2022-05-03 15:32:01.000000000 +0200
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-SSL_CTX_set_ssl_version, SSL_set_ssl_method, SSL_get_ssl_method
+SSL_CTX_set_ssl_version, SSL_CTX_get_ssl_method, SSL_set_ssl_method, SSL_get_ssl_method
 - choose a new TLS/SSL method
 
 =head1 SYNOPSIS
@@ -10,6 +10,8 @@
  #include <openssl/ssl.h>
 
  int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *method);
+ const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx);
+
  int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method);
  const SSL_METHOD *SSL_get_ssl_method(const SSL *ssl);
 
@@ -22,10 +24,13 @@
 SSL_CTX with L<SSL_new(3)> are not affected, except when L<SSL_clear(3)> is
 being called, as described below.
 
+SSL_CTX_get_ssl_method() returns the SSL_METHOD which was used to construct the
+SSL_CTX.
+
 SSL_set_ssl_method() sets a new TLS/SSL B<method> for a particular B<ssl>
 object. It may be reset, when SSL_clear() is called.
 
-SSL_get_ssl_method() returns a function pointer to the TLS/SSL method
+SSL_get_ssl_method() returns a pointer to the TLS/SSL method
 set in B<ssl>.
 
 =head1 NOTES
@@ -59,6 +64,9 @@
 
 =back
 
+SSL_CTX_get_ssl_method() and SSL_get_ssl_method() always return non-NULL
+pointers.
+
 =head1 SEE ALSO
 
 L<SSL_CTX_new(3)>, L<SSL_new(3)>,
@@ -71,7 +79,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/SSL_CTX_set_timeout.pod openssl-3.0.3/doc/man3/SSL_CTX_set_timeout.pod
--- openssl-3.0.2/doc/man3/SSL_CTX_set_timeout.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CTX_set_timeout.pod	2022-05-03 15:32:01.000000000 +0200
@@ -42,6 +42,16 @@
 All currently supported protocols have the same default timeout value
 of 300 seconds.
 
+This timeout value is used as the ticket lifetime hint for stateless session
+tickets. It is also used as the timeout value within the ticket itself.
+
+For TLSv1.3, RFC8446 limits transmission of this value to 1 week (604800
+seconds).
+
+For TLSv1.2, tickets generated during an initial handshake use the value
+as specified. Tickets generated during a resumed handshake have a value
+of 0 for the ticket lifetime hint.
+
 =head1 RETURN VALUES
 
 SSL_CTX_set_timeout() returns the previously set timeout value.
@@ -58,7 +68,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man3/SSL_CTX_set_verify.pod openssl-3.0.3/doc/man3/SSL_CTX_set_verify.pod
--- openssl-3.0.2/doc/man3/SSL_CTX_set_verify.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_CTX_set_verify.pod	2022-05-03 15:32:01.000000000 +0200
@@ -53,11 +53,11 @@
 with B<SSL_ERROR_WANT_RETRY_VERIFY>.
 The application can for instance fetch further certificates or cert status
 information needed for the verification.
-Note that the handshake may still be aborted if a subsequent invocation of the
-callback (e.g. at a lower depth, or for a separate error condition) returns 0.
 Calling L<SSL_connect(3)> again resumes the connection attempt by retrying the
 server certificate verification step.
 This process may even be repeated if need be.
+Note that the handshake may still be aborted if a subsequent invocation of the
+callback (e.g., at a lower depth, or for a separate error condition) returns 0.
 
 SSL_CTX_set_verify_depth() sets the maximum B<depth> for the certificate chain
 verification that shall be allowed for B<ctx>.
diff -Nru openssl-3.0.2/doc/man3/SSL_set_session.pod openssl-3.0.3/doc/man3/SSL_set_session.pod
--- openssl-3.0.2/doc/man3/SSL_set_session.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man3/SSL_set_session.pod	2022-05-03 15:32:01.000000000 +0200
@@ -21,7 +21,8 @@
 
 If there is already a session set inside B<ssl> (because it was set with
 SSL_set_session() before or because the same B<ssl> was already used for
-a connection), SSL_SESSION_free() will be called for that session. If that old
+a connection), SSL_SESSION_free() will be called for that session.
+This is also the case when B<session> is a NULL pointer. If that old
 session is still B<open>, it is considered bad and will be removed from the
 session cache (if used). A session is considered open, if L<SSL_shutdown(3)> was
 not called for the connection (or at least L<SSL_set_shutdown(3)> was used to
@@ -60,7 +61,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man7/EVP_KDF-SSHKDF.pod openssl-3.0.3/doc/man7/EVP_KDF-SSHKDF.pod
--- openssl-3.0.2/doc/man7/EVP_KDF-SSHKDF.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man7/EVP_KDF-SSHKDF.pod	2022-05-03 15:32:01.000000000 +0200
@@ -103,7 +103,7 @@
 
  EVP_KDF *kdf;
  EVP_KDF_CTX *kctx;
- const char type = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
+ char type = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
  unsigned char key[1024] = "01234...";
  unsigned char xcghash[32] = "012345...";
  unsigned char session_id[32] = "012345...";
@@ -126,7 +126,7 @@
  *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE,
                                          &type, sizeof(type));
  *p = OSSL_PARAM_construct_end();
- if (EVP_KDF_derive(kctx, out, &outlen, params) <= 0)
+ if (EVP_KDF_derive(kctx, out, outlen, params) <= 0)
      /* Error */
 
 
@@ -146,7 +146,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man7/provider.pod openssl-3.0.3/doc/man7/provider.pod
--- openssl-3.0.2/doc/man7/provider.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man7/provider.pod	2022-05-03 15:32:01.000000000 +0200
@@ -115,7 +115,7 @@
 B<EVP_MD>.
 The number for this operation is B<OSSL_OP_DIGEST>.
 The functions the provider can offer are described in
-L<provider-digest(7)>
+L<provider-digest(7)>.
 
 =item Symmetric ciphers
 
@@ -123,7 +123,7 @@
 B<EVP_CIPHER>.
 The number for this operation is B<OSSL_OP_CIPHER>.
 The functions the provider can offer are described in
-L<provider-cipher(7)>
+L<provider-cipher(7)>.
 
 =item Message Authentication Code (MAC)
 
@@ -131,7 +131,7 @@
 B<EVP_MAC>.
 The number for this operation is B<OSSL_OP_MAC>.
 The functions the provider can offer are described in
-L<provider-mac(7)>
+L<provider-mac(7)>.
 
 =item Key Derivation Function (KDF)
 
@@ -139,7 +139,7 @@
 B<EVP_KDF>.
 The number for this operation is B<OSSL_OP_KDF>.
 The functions the provider can offer are described in
-L<provider-kdf(7)>
+L<provider-kdf(7)>.
 
 =item Key Exchange
 
@@ -147,7 +147,7 @@
 B<EVP_KEYEXCH>.
 The number for this operation is B<OSSL_OP_KEYEXCH>.
 The functions the provider can offer are described in
-L<provider-keyexch(7)>
+L<provider-keyexch(7)>.
 
 =item Asymmetric Ciphers
 
@@ -155,13 +155,13 @@
 B<EVP_ASYM_CIPHER>.
 The number for this operation is B<OSSL_OP_ASYM_CIPHER>.
 The functions the provider can offer are described in
-L<provider-asym_cipher(7)>
+L<provider-asym_cipher(7)>.
 
 =item Asymmetric Key Encapsulation
 
 In the OpenSSL libraries, the corresponding method object is B<EVP_KEM>.
 The number for this operation is B<OSSL_OP_KEM>.
-The functions the provider can offer are described in L<provider-kem(7)>
+The functions the provider can offer are described in L<provider-kem(7)>.
 
 =item Encoding
 
@@ -169,7 +169,39 @@
 B<OSSL_ENCODER>.
 The number for this operation is B<OSSL_OP_ENCODER>.
 The functions the provider can offer are described in
-L<provider-encoder(7)>
+L<provider-encoder(7)>.
+
+=item Decoding
+
+In the OpenSSL libraries, the corresponding method object is
+B<OSSL_DECODER>.
+The number for this operation is B<OSSL_OP_DECODER>.
+The functions the provider can offer are described in
+L<provider-decoder(7)>.
+
+=item Random Number Generation
+
+The number for this operation is B<OSSL_OP_RAND>.
+The functions the provider can offer for random number generation are described
+in L<provider-rand(7)>.
+
+=item Key Management
+
+The number for this operation is B<OSSL_OP_KEYMGMT>.
+The functions the provider can offer for key management are described in
+L<provider-keymgmt(7)>.
+
+=item Signing and Signature Verification
+
+The number for this operation is B<OSSL_OP_SIGNATURE>.
+The functions the provider can offer for digital signatures are described in
+L<provider-signature(7)>.
+
+=item Store Management
+
+The number for this operation is B<OSSL_OP_STORE>.
+The functions the provider can offer for store management are described in
+L<provider-storemgmt(7)>.
 
 =back
 
@@ -222,7 +254,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/doc/man7/provider-signature.pod openssl-3.0.3/doc/man7/provider-signature.pod
--- openssl-3.0.2/doc/man7/provider-signature.pod	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/doc/man7/provider-signature.pod	2022-05-03 15:32:01.000000000 +0200
@@ -43,7 +43,7 @@
 
  /* Digest Sign */
  int OSSL_FUNC_signature_digest_sign_init(void *ctx, const char *mdname,
-                                          const char *props, void *provkey,
+                                          void *provkey,
                                           const OSSL_PARAM params[]);
  int OSSL_FUNC_signature_digest_sign_update(void *ctx, const unsigned char *data,
                                      size_t datalen);
@@ -56,7 +56,7 @@
 
  /* Digest Verify */
  int OSSL_FUNC_signature_digest_verify_init(void *ctx, const char *mdname,
-                                            const char *props, void *provkey,
+                                            void *provkey,
                                             const OSSL_PARAM params[]);
  int OSSL_FUNC_signature_digest_verify_update(void *ctx,
                                               const unsigned char *data,
@@ -266,9 +266,7 @@
 The key object should have been
 previously generated, loaded or imported into the provider using the
 key management (OSSL_OP_KEYMGMT) operation (see provider-keymgmt(7)>.
-The name of the digest to be used will be in the I<mdname> parameter. There may
-also be properties to be used in fetching the digest in the I<props> parameter,
-although this may be ignored by providers.
+The name of the digest to be used will be in the I<mdname> parameter.
 
 OSSL_FUNC_signature_digest_sign_update() provides data to be signed in the I<data>
 parameter which should be of length I<datalen>. A previously initialised
@@ -305,9 +303,7 @@
 The key object should have been
 previously generated, loaded or imported into the provider using the
 key management (OSSL_OP_KEYMGMT) operation (see provider-keymgmt(7)>.
-The name of the digest to be used will be in the I<mdname> parameter. There may
-also be properties to be used in fetching the digest in the I<props> parameter,
-although this may be ignored by providers.
+The name of the digest to be used will be in the I<mdname> parameter.
 
 OSSL_FUNC_signature_digest_verify_update() provides data to be verified in the I<data>
 parameter which should be of length I<datalen>. A previously initialised
@@ -435,7 +431,7 @@
 
 =head1 COPYRIGHT
 
-Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/engines/e_devcrypto.c openssl-3.0.3/engines/e_devcrypto.c
--- openssl-3.0.2/engines/e_devcrypto.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/engines/e_devcrypto.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -1159,9 +1159,9 @@
     case DEVCRYPTO_CMD_CIPHERS:
         if (p == NULL)
             return 1;
-        if (strcasecmp((const char *)p, "ALL") == 0) {
+        if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) {
             devcrypto_select_all_ciphers(selected_ciphers);
-        } else if (strcasecmp((const char*)p, "NONE") == 0) {
+        } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) {
             memset(selected_ciphers, 0, sizeof(selected_ciphers));
         } else {
             new_list=OPENSSL_zalloc(sizeof(selected_ciphers));
@@ -1179,9 +1179,9 @@
     case DEVCRYPTO_CMD_DIGESTS:
         if (p == NULL)
             return 1;
-        if (strcasecmp((const char *)p, "ALL") == 0) {
+        if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) {
             devcrypto_select_all_digests(selected_digests);
-        } else if (strcasecmp((const char*)p, "NONE") == 0) {
+        } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) {
             memset(selected_digests, 0, sizeof(selected_digests));
         } else {
             new_list=OPENSSL_zalloc(sizeof(selected_digests));
diff -Nru openssl-3.0.2/engines/e_loader_attic.c openssl-3.0.3/engines/e_loader_attic.c
--- openssl-3.0.2/engines/e_loader_attic.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/engines/e_loader_attic.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -14,7 +14,6 @@
 /* We need to use some engine deprecated APIs */
 #define OPENSSL_SUPPRESS_DEPRECATED
 
-/* #include "e_os.h" */
 #include <string.h>
 #include <sys/stat.h>
 #include <ctype.h>
@@ -44,7 +43,6 @@
 
 #ifdef _WIN32
 # define stat _stat
-# define strncasecmp _strnicmp
 #endif
 
 #ifndef S_ISDIR
@@ -971,12 +969,12 @@
      * There's a special case if the URI also contains an authority, then
      * the full URI shouldn't be used as a path anywhere.
      */
-    if (strncasecmp(uri, "file:", 5) == 0) {
+    if (OPENSSL_strncasecmp(uri, "file:", 5) == 0) {
         const char *p = &uri[5];
 
         if (strncmp(&uri[5], "//", 2) == 0) {
             path_data_n--;           /* Invalidate using the full URI */
-            if (strncasecmp(&uri[7], "localhost/", 10) == 0) {
+            if (OPENSSL_strncasecmp(&uri[7], "localhost/", 10) == 0) {
                 p = &uri[16];
             } else if (uri[7] == '/') {
                 p = &uri[7];
@@ -1466,7 +1464,8 @@
     /*
      * First, check the basename
      */
-    if (strncasecmp(name, ctx->_.dir.search_name, len) != 0 || name[len] != '.')
+    if (OPENSSL_strncasecmp(name, ctx->_.dir.search_name, len) != 0
+        || name[len] != '.')
         return 0;
     p = &name[len + 1];
 
diff -Nru openssl-3.0.2/engines/e_ossltest.c openssl-3.0.3/engines/e_ossltest.c
--- openssl-3.0.2/engines/e_ossltest.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/engines/e_ossltest.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -42,10 +42,6 @@
 
 #include "e_ossltest_err.c"
 
-#ifdef _WIN32
-# define strncasecmp _strnicmp
-#endif
-
 /* Engine Id and Name */
 static const char *engine_ossltest_id = "ossltest";
 static const char *engine_ossltest_name = "OpenSSL Test engine support";
@@ -383,7 +379,7 @@
     BIO *in;
     EVP_PKEY *key;
 
-    if (strncasecmp(key_id, "ot:", 3) != 0)
+    if (OPENSSL_strncasecmp(key_id, "ot:", 3) != 0)
         return NULL;
     key_id += 3;
 
diff -Nru openssl-3.0.2/e_os.h openssl-3.0.3/e_os.h
--- openssl-3.0.2/e_os.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/e_os.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -249,8 +249,6 @@
 /***********************************************/
 
 # if defined(OPENSSL_SYS_WINDOWS)
-#  define strcasecmp _stricmp
-#  define strncasecmp _strnicmp
 #  if (_MSC_VER >= 1310) && !defined(_WIN32_WCE)
 #   define open _open
 #   define fdopen _fdopen
diff -Nru openssl-3.0.2/fuzz/client.c openssl-3.0.3/fuzz/client.c
--- openssl-3.0.2/fuzz/client.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/fuzz/client.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -55,7 +55,7 @@
 
 int FuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
-    SSL *client;
+    SSL *client = NULL;
     BIO *in;
     BIO *out;
     SSL_CTX *ctx;
@@ -65,13 +65,23 @@
 
     /* This only fuzzes the initial flow from the client so far. */
     ctx = SSL_CTX_new(SSLv23_method());
+    if (ctx == NULL)
+        goto end;
 
     client = SSL_new(ctx);
+    if (client == NULL)
+        goto end;
     OPENSSL_assert(SSL_set_min_proto_version(client, 0) == 1);
     OPENSSL_assert(SSL_set_cipher_list(client, "ALL:eNULL:@SECLEVEL=0") == 1);
     SSL_set_tlsext_host_name(client, "localhost");
     in = BIO_new(BIO_s_mem());
+    if (in == NULL)
+        goto end;
     out = BIO_new(BIO_s_mem());
+    if (out == NULL) {
+        BIO_free(in);
+        goto end;
+    }
     SSL_set_bio(client, in, out);
     SSL_set_connect_state(client);
     OPENSSL_assert((size_t)BIO_write(in, buf, len) == len);
@@ -84,6 +94,7 @@
             }
         }
     }
+ end:
     SSL_free(client);
     ERR_clear_error();
     SSL_CTX_free(ctx);
diff -Nru openssl-3.0.2/include/crypto/ctype.h openssl-3.0.3/include/crypto/ctype.h
--- openssl-3.0.2/include/crypto/ctype.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/crypto/ctype.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -80,4 +80,6 @@
 # define ossl_isbase64(c)       (ossl_ctype_check((c), CTYPE_MASK_base64))
 # define ossl_isasn1print(c)    (ossl_ctype_check((c), CTYPE_MASK_asn1print))
 
+int ossl_init_casecmp(void);
+void ossl_deinit_casecmp(void);
 #endif
diff -Nru openssl-3.0.2/include/crypto/ecerr.h openssl-3.0.3/include/crypto/ecerr.h
--- openssl-3.0.2/include/crypto/ecerr.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/crypto/ecerr.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff -Nru openssl-3.0.2/include/internal/core.h openssl-3.0.3/include/internal/core.h
--- openssl-3.0.2/include/internal/core.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/internal/core.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -63,4 +63,6 @@
 int ossl_lib_ctx_unlock(OSSL_LIB_CTX *ctx);
 int ossl_lib_ctx_is_child(OSSL_LIB_CTX *ctx);
 
+void *ossl_c_locale(void);
+
 #endif
diff -Nru openssl-3.0.2/include/openssl/crypto.h.in openssl-3.0.3/include/openssl/crypto.h.in
--- openssl-3.0.2/include/openssl/crypto.h.in	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/openssl/crypto.h.in	2022-05-03 15:32:01.000000000 +0200
@@ -133,6 +133,8 @@
                           const char *str, const char sep);
 unsigned char *OPENSSL_hexstr2buf(const char *str, long *buflen);
 int OPENSSL_hexchar2int(unsigned char c);
+int OPENSSL_strcasecmp(const char *s1, const char *s2);
+int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n);
 
 # define OPENSSL_MALLOC_MAX_NELEMS(type)  (((1U<<(sizeof(int)*8-1))-1)/sizeof(type))
 
diff -Nru openssl-3.0.2/include/openssl/ecerr.h openssl-3.0.3/include/openssl/ecerr.h
--- openssl-3.0.2/include/openssl/ecerr.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/openssl/ecerr.h	2022-05-03 15:32:01.000000000 +0200
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -35,6 +35,7 @@
 #  define EC_R_DECODE_ERROR                                142
 #  define EC_R_DISCRIMINANT_IS_ZERO                        118
 #  define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE                119
+#  define EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED               127
 #  define EC_R_FAILED_MAKING_PUBLIC_KEY                    166
 #  define EC_R_FIELD_TOO_LARGE                             143
 #  define EC_R_GF2M_NOT_SUPPORTED                          147
diff -Nru openssl-3.0.2/include/openssl/ssl.h.in openssl-3.0.3/include/openssl/ssl.h.in
--- openssl-3.0.2/include/openssl/ssl.h.in	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/openssl/ssl.h.in	2022-05-03 15:32:01.000000000 +0200
@@ -1309,6 +1309,8 @@
 # define SSL_CTRL_GET_TMP_KEY                    133
 # define SSL_CTRL_GET_NEGOTIATED_GROUP           134
 # define SSL_CTRL_SET_RETRY_VERIFY               136
+# define SSL_CTRL_GET_VERIFY_CERT_STORE          137
+# define SSL_CTRL_GET_CHAIN_CERT_STORE           138
 # define SSL_CERT_SET_FIRST                      1
 # define SSL_CERT_SET_NEXT                       2
 # define SSL_CERT_SET_SERVER                     3
@@ -1370,10 +1372,14 @@
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st))
 # define SSL_CTX_set1_verify_cert_store(ctx,st) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st))
+# define SSL_CTX_get0_verify_cert_store(ctx,st) \
+        SSL_CTX_ctrl(ctx,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st))
 # define SSL_CTX_set0_chain_cert_store(ctx,st) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st))
 # define SSL_CTX_set1_chain_cert_store(ctx,st) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st))
+# define SSL_CTX_get0_chain_cert_store(ctx,st) \
+        SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st))
 # define SSL_set0_chain(s,sk) \
         SSL_ctrl(s,SSL_CTRL_CHAIN,0,(char *)(sk))
 # define SSL_set1_chain(s,sk) \
@@ -1396,10 +1402,15 @@
         SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st))
 # define SSL_set1_verify_cert_store(s,st) \
         SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st))
+#define SSL_get0_verify_cert_store(s,st) \
+        SSL_ctrl(s,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st))
 # define SSL_set0_chain_cert_store(s,st) \
         SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st))
 # define SSL_set1_chain_cert_store(s,st) \
         SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st))
+#define SSL_get0_chain_cert_store(s,st) \
+        SSL_ctrl(s,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st))
+
 # define SSL_get1_groups(s, glist) \
         SSL_ctrl(s,SSL_CTRL_GET_GROUPS,0,(int*)(glist))
 # define SSL_CTX_set1_groups(ctx, glist, glistlen) \
diff -Nru openssl-3.0.2/include/openssl/x509.h.in openssl-3.0.3/include/openssl/x509.h.in
--- openssl-3.0.2/include/openssl/x509.h.in	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/include/openssl/x509.h.in	2022-05-03 15:32:01.000000000 +0200
@@ -1,7 +1,7 @@
 /*
  * {- join("\n * ", @autowarntext) -}
  *
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -358,11 +358,11 @@
 X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout);
 X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout);
 # ifndef OPENSSL_NO_DEPRECATED_3_0
-#  include <openssl/ocsp.h> /* OCSP_REQ_CTX_nbio_d2i */
+#  include <openssl/http.h> /* OSSL_HTTP_REQ_CTX_nbio_d2i */
 #  define X509_http_nbio(rctx, pcert) \
-      OCSP_REQ_CTX_nbio_d2i(rctx, pcert, ASN1_ITEM_rptr(X509))
+      OSSL_HTTP_REQ_CTX_nbio_d2i(rctx, pcert, ASN1_ITEM_rptr(X509))
 #  define X509_CRL_http_nbio(rctx, pcrl) \
-      OCSP_REQ_CTX_nbio_d2i(rctx, pcrl, ASN1_ITEM_rptr(X509_CRL))
+      OSSL_HTTP_REQ_CTX_nbio_d2i(rctx, pcrl, ASN1_ITEM_rptr(X509_CRL))
 # endif
 
 # ifndef OPENSSL_NO_STDIO
diff -Nru openssl-3.0.2/NEWS.md openssl-3.0.3/NEWS.md
--- openssl-3.0.2/NEWS.md	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/NEWS.md	2022-05-03 15:32:01.000000000 +0200
@@ -18,6 +18,17 @@
 OpenSSL 3.0
 -----------
 
+### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022]
+
+  * Fixed a bug in the c_rehash script which was not properly sanitising shell
+    metacharacters to prevent command injection ([CVE-2022-1292])
+  * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer
+    certificate on an OCSP response ([CVE-2022-1343])
+  * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the
+    AAD data as the MAC key ([CVE-2022-1434])
+  * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory
+    occuppied by the removed hash table entries ([CVE-2022-1473])
+
 ### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
 
   * Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
diff -Nru openssl-3.0.2/NOTES-WINDOWS.md openssl-3.0.3/NOTES-WINDOWS.md
--- openssl-3.0.2/NOTES-WINDOWS.md	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/NOTES-WINDOWS.md	2022-05-03 15:32:01.000000000 +0200
@@ -28,12 +28,12 @@
 Native builds using Visual C++
 ==============================
 
-The native builds using Visual C++ have a VC-* prefix.
+The native builds using Visual C++ have a `VC-*` prefix.
 
 Requirement details
 -------------------
 
-In addition to the requirements and instructions listed in INSTALL.md,
+In addition to the requirements and instructions listed in `INSTALL.md`,
 these are required as well:
 
 ### Perl
@@ -64,22 +64,26 @@
 
  4. Use Visual Studio Developer Command Prompt with administrative privileges,
     choosing one of its variants depending on the intended architecture.
-    Or run "cmd" and execute "vcvarsall.bat" with one of the options x86,
-    x86_amd64, x86_arm, x86_arm64, amd64, amd64_x86, amd64_arm, or amd64_arm64.
-    This sets up the environment variables needed for nmake.exe, cl.exe, etc.
+    Or run `cmd` and execute `vcvarsall.bat` with one of the options `x86`,
+    `x86_amd64`, `x86_arm`, `x86_arm64`, `amd64`, `amd64_x86`, `amd64_arm`,
+    or `amd64_arm64`.
+    This sets up the environment variables needed for `nmake.exe`, `cl.exe`,
+    etc.
     See also
     <https://docs.microsoft.com/cpp/build/building-on-the-command-line>
 
  5. From the root of the OpenSSL source directory enter
-    perl Configure VC-WIN32    if you want 32-bit OpenSSL or
-    perl Configure VC-WIN64A   if you want 64-bit OpenSSL or
-    perl Configure             to let Configure figure out the platform
+    - `perl Configure VC-WIN32`     if you want 32-bit OpenSSL or
+    - `perl Configure VC-WIN64A`    if you want 64-bit OpenSSL or
+    - `perl Configure VC-WIN64-ARM` if you want Windows on Arm (win-arm64)
+       OpenSSL or
+    - `perl Configure`              to let Configure figure out the platform
 
- 6. nmake
+ 6. `nmake`
 
- 7. nmake test
+ 7. `nmake test`
 
- 8. nmake install
+ 8. `nmake install`
 
 For the full installation instructions, or if anything goes wrong at any stage,
 check the INSTALL.md file.
@@ -109,25 +113,25 @@
 ALSO NOTE that those directories are usually write protected, even if
 your account is in the Administrators group.  To work around that,
 start the command prompt by right-clicking on it and choosing "Run as
-Administrator" before running 'nmake install'.  The other solution
+Administrator" before running `nmake install`.  The other solution
 is, of course, to choose a different set of directories by using
---prefix and --openssldir when configuring.
+`--prefix` and `--openssldir` when configuring.
 
-Special notes for Universal Windows Platform builds, aka VC-*-UWP
---------------------------------------------------------------------
+Special notes for Universal Windows Platform builds, aka `VC-*-UWP`
+-------------------------------------------------------------------
 
  - UWP targets only support building the static and dynamic libraries.
 
- - You should define the platform type to "uwp" and the target arch via
-   "vcvarsall.bat" before you compile. For example, if you want to build
-   "arm64" builds, you should run "vcvarsall.bat x86_arm64 uwp".
+ - You should define the platform type to `uwp` and the target arch via
+   `vcvarsall.bat` before you compile. For example, if you want to build
+   `arm64` builds, you should run `vcvarsall.bat x86_arm64 uwp`.
 
 Native builds using Embarcadero C++Builder
 =========================================
 
 This toolchain (a descendant of Turbo/Borland C++) is an alternative to MSVC.
 OpenSSL currently includes an experimental 32-bit configuration targeting the
-Clang-based compiler (bcc32c.exe) in v10.3.3 Community Edition.
+Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
 <https://www.embarcadero.com/products/cbuilder/starter>
 
  1. Install Perl.
@@ -135,11 +139,11 @@
  2. Open the RAD Studio Command Prompt.
 
  3. Go to the root of the OpenSSL source directory and run:
-    perl Configure BC-32 --prefix=%CD%
+    `perl Configure BC-32 --prefix=%CD%`
 
- 4. make -N
+ 4. `make -N`
 
- 5. make -N test
+ 5. `make -N test`
 
  6. Build your program against this OpenSSL:
     * Set your include search path to the "include" subdirectory of OpenSSL.
@@ -166,9 +170,9 @@
 
    - Perl, at least version 5.10.0, which usually comes pre-installed with MSYS2
 
-   - make, installed using "pacman -S make" into the MSYS2 environment
+   - make, installed using `pacman -S make` into the MSYS2 environment
 
-   - MinGW[64] compiler: mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc.
+   - MinGW[64] compiler: `mingw-w64-i686-gcc` and/or `mingw-w64-x86_64-gcc`.
      These compilers must be on your MSYS2 $PATH.
      A common error is to not have these on your $PATH.
      The MSYS2 version of gcc will not work correctly here.
@@ -176,22 +180,28 @@
    In the MSYS2 shell do the configuration depending on the target architecture:
 
        ./Configure mingw ...
+
    or
+
        ./Configure mingw64 ...
+
    or
+
        ./Configure ...
 
    for the default architecture.
 
-   Apart from that, follow the Unix / Linux instructions in INSTALL.md.
+   Apart from that, follow the Unix / Linux instructions in `INSTALL.md`.
 
  * It is also possible to build mingw[64] on Linux or Cygwin.
 
-   In this case configure with the corresponding --cross-compile-prefix= option.
-   For example
+   In this case configure with the corresponding `--cross-compile-prefix=`
+   option. For example
 
        ./Configure mingw --cross-compile-prefix=i686-w64-mingw32- ...
+
    or
+
        ./Configure mingw64 --cross-compile-prefix=x86_64-w64-mingw32- ...
 
    This requires that you've installed the necessary add-on packages for
@@ -203,18 +213,18 @@
 This section applies to all native builds.
 
 If you link with static OpenSSL libraries then you're expected to
-additionally link your application with WS2_32.LIB, GDI32.LIB,
-ADVAPI32.LIB, CRYPT32.LIB and USER32.LIB. Those developing
+additionally link your application with `WS2_32.LIB`, `GDI32.LIB`,
+`ADVAPI32.LIB`, `CRYPT32.LIB` and `USER32.LIB`. Those developing
 non-interactive service applications might feel concerned about
-linking with GDI32.LIB and USER32.LIB, as they are justly associated
+linking with `GDI32.LIB` and `USER32.LIB`, as they are justly associated
 with interactive desktop, which is not available to service
 processes. The toolkit is designed to detect in which context it's
 currently executed, GUI, console app or service, and act accordingly,
 namely whether or not to actually make GUI calls. Additionally those
-who wish to /DELAYLOAD:GDI32.DLL and /DELAYLOAD:USER32.DLL and
+who wish to `/DELAYLOAD:GDI32.DLL` and `/DELAYLOAD:USER32.DLL` and
 actually keep them off service process should consider implementing
-and exporting from .exe image in question own _OPENSSL_isservice not
-relying on USER32.DLL. E.g., on Windows Vista and later you could:
+and exporting from .exe image in question own `_OPENSSL_isservice` not
+relying on `USER32.DLL`. E.g., on Windows Vista and later you could:
 
        __declspec(dllexport) __cdecl BOOL _OPENSSL_isservice(void)
        {
@@ -233,7 +243,7 @@
 Hosted builds using Cygwin
 ==========================
 
-Cygwin implements a POSIX/Unix runtime system (cygwin1.dll) on top of the
+Cygwin implements a POSIX/Unix runtime system (`cygwin1.dll`) on top of the
 Windows subsystem and provides a Bash shell and GNU tools environment.
 Consequently, a build of OpenSSL with Cygwin is virtually identical to the
 Unix procedure.
@@ -249,7 +259,7 @@
 
 Apart from that, follow the Unix / Linux instructions in INSTALL.md.
 
-NOTE: "make test" and normal file operations may fail in directories
-mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin
+NOTE: `make test` and normal file operations may fail in directories
+mounted as text (i.e. `mount -t c:\somewhere /home`) due to Cygwin
 stripping of carriage returns. To avoid this ensure that a binary
-mount is used, e.g. mount -b c:\somewhere /home.
+mount is used, e.g. `mount -b c:\somewhere /home`.
diff -Nru openssl-3.0.2/providers/common/capabilities.c openssl-3.0.3/providers/common/capabilities.c
--- openssl-3.0.2/providers/common/capabilities.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/common/capabilities.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -217,7 +217,7 @@
 int ossl_prov_get_capabilities(void *provctx, const char *capability,
                                OSSL_CALLBACK *cb, void *arg)
 {
-    if (strcasecmp(capability, "TLS-GROUP") == 0)
+    if (OPENSSL_strcasecmp(capability, "TLS-GROUP") == 0)
         return tls_group_capability(cb, arg);
 
     /* We don't support this capability */
diff -Nru openssl-3.0.2/providers/fips/fipsprov.c openssl-3.0.3/providers/fips/fipsprov.c
--- openssl-3.0.2/providers/fips/fipsprov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/fips/fipsprov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -22,6 +22,7 @@
 #include "prov/provider_util.h"
 #include "prov/seeding.h"
 #include "self_test.h"
+#include "internal/core.h"
 
 static const char FIPS_DEFAULT_PROPERTIES[] = "provider=fips,fips=yes";
 static const char FIPS_UNAPPROVED_PROPERTIES[] = "provider=fips,fips=no";
@@ -35,6 +36,22 @@
 static OSSL_FUNC_provider_get_params_fn fips_get_params;
 static OSSL_FUNC_provider_query_operation_fn fips_query;
 
+/* Locale object accessor functions */
+#ifdef OPENSSL_SYS_MACOSX
+# include <xlocale.h>
+#else
+# include <locale.h>
+#endif
+
+#if defined OPENSSL_SYS_WINDOWS
+# define locale_t _locale_t
+# define freelocale _free_locale
+#endif
+static locale_t loc;
+
+static int fips_init_casecmp(void);
+static void fips_deinit_casecmp(void);
+
 #define ALGC(NAMES, FUNC, CHECK) { { NAMES, FIPS_DEFAULT_PROPERTIES, FUNC }, CHECK }
 #define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL)
 
@@ -486,6 +503,23 @@
     return NULL;
 }
 
+void *ossl_c_locale() {
+    return (void *)loc;
+}
+
+static int fips_init_casecmp(void) {
+# ifdef OPENSSL_SYS_WINDOWS
+    loc = _create_locale(LC_COLLATE, "C");
+# else
+    loc = newlocale(LC_COLLATE_MASK, "C", (locale_t) 0);
+# endif
+    return (loc == (locale_t) 0) ? 0 : 1;
+}
+
+static void fips_deinit_casecmp(void) {
+    freelocale(loc);
+}
+
 static void fips_teardown(void *provctx)
 {
     OSSL_LIB_CTX_free(PROV_LIBCTX_OF(provctx));
@@ -498,6 +532,7 @@
      * We know that the library context is the same as for the outer provider,
      * so no need to destroy it here.
      */
+    fips_deinit_casecmp();
     ossl_prov_ctx_free(provctx);
 }
 
@@ -547,6 +582,8 @@
 
     memset(&selftest_params, 0, sizeof(selftest_params));
 
+    if (!fips_init_casecmp())
+        return 0;
     if (!ossl_prov_seeding_from_dispatch(in))
         return 0;
     for (; in->function_id != 0; in++) {
diff -Nru openssl-3.0.2/providers/fips/self_test.c openssl-3.0.3/providers/fips/self_test.c
--- openssl-3.0.2/providers/fips/self_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/fips/self_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -103,6 +103,13 @@
     }
     return TRUE;
 }
+
+#elif defined(__GNUC__)
+# undef DEP_INIT_ATTRIBUTE
+# undef DEP_FINI_ATTRIBUTE
+# define DEP_INIT_ATTRIBUTE static __attribute__((constructor))
+# define DEP_FINI_ATTRIBUTE static __attribute__((destructor))
+
 #elif defined(__sun)
 # pragma init(init)
 # pragma fini(cleanup)
@@ -125,12 +132,6 @@
 # pragma init "init"
 # pragma fini "cleanup"
 
-#elif defined(__GNUC__)
-# undef DEP_INIT_ATTRIBUTE
-# undef DEP_FINI_ATTRIBUTE
-# define DEP_INIT_ATTRIBUTE static __attribute__((constructor))
-# define DEP_FINI_ATTRIBUTE static __attribute__((destructor))
-
 #elif defined(__TANDEM)
 /* Method automatically called by the NonStop OS when the DLL loads */
 void __INIT__init(void) {
diff -Nru openssl-3.0.2/providers/fips.checksum openssl-3.0.3/providers/fips.checksum
--- openssl-3.0.2/providers/fips.checksum	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/fips.checksum	2022-05-03 15:32:01.000000000 +0200
@@ -1 +1 @@
-0223646a9f0ba5ca3bd4dc320fe5a647c8b4d48cc1e273b09acceeabc035c19e  providers/fips-sources.checksums
+d0e2cb7b2818aed1f4d89da6323f20372c8834c3f57f9dfd1c5e9f908d7e420a  providers/fips-sources.checksums
diff -Nru openssl-3.0.2/providers/fips-sources.checksums openssl-3.0.3/providers/fips-sources.checksums
--- openssl-3.0.2/providers/fips-sources.checksums	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/fips-sources.checksums	2022-05-03 15:32:01.000000000 +0200
@@ -72,8 +72,8 @@
 58b587e20404efa408b31a88ba9c357059ced709bea78c07deb91df7b687db81  crypto/bn/bn_conv.c
 2893b6d03d4850d09c15959941b0759bbb50d8c20e873bed088e7cde4e15a65a  crypto/bn/bn_ctx.c
 d94295953ab91469fe2b9da2a542b8ea11ac38551ecde8f8202b7f645c2dea16  crypto/bn/bn_dh.c
-a837ba52750ab30a57b6dd2fd4cf901e18a891a189b089f83add2f5dc8138eb7  crypto/bn/bn_div.c
-160ea2c916774d6a7f8130e0a05cad7c0a954b4726c15017b3df67e3285231f3  crypto/bn/bn_exp.c
+74b63a4515894592b7241fb30b91b21510beaa3d397809e3d74bc9a73e879d18  crypto/bn/bn_div.c
+692e200e66389991eb2e6fe9d9a62eda5fe9005cda834b8af1a435a811b6b3c9  crypto/bn/bn_exp.c
 ec2b6e3af6df473a23e7f1a8522f2554cb0eb5d34e3282458c4a66d242278434  crypto/bn/bn_exp2.c
 b32d83cee8c00d837a7e4fb8af3f5cf17cb8d2419302e8f5fbcf62119092e874  crypto/bn/bn_gcd.c
 4d6cc7ed36978247a191df1eea0120f8ee97b639ba228793dabe5a8355a1a609  crypto/bn/bn_gf2m.c
@@ -101,13 +101,13 @@
 834db8ff36006e5cb53e09ca6c44290124bd23692f4341ea6563b66fcade4cea  crypto/bsearch.c
 c39334b70e1394e43f378ae8d31b6e6dc125e4d9181e6536d38e649c4eaadb75  crypto/buffer/buffer.c
 23d46ae37a8d9452c0c88418d2cb8350153f8c2c6060234130a2e429da2370e0  crypto/cmac/cmac.c
-7f24e4937e0af857e233afbb6a7f25b09b1e5674185242a5cc8f579a45bbf1da  crypto/context.c
+58068d6533fed9359b164ddc9711b2dd7b2a76f32ad94103d91dbe3462ac95d8  crypto/context.c
 83b8912fb01bacfe0b5269c7afa69db7e1718530cce1ed27870abef1407951d6  crypto/core_algorithm.c
 60321d1af7bf9697d969438f6b319fbcb4fdc1a47a0b056d02b971973a8550ca  crypto/core_fetch.c
-7d090f71175f28fdc400455fdbc68340a545556d16cb1f6251ac92ebb63a38c1  crypto/core_namemap.c
+02670d631bf0f34cca1e3477079d7fe5de4e03c391cf3992986f44f55319597c  crypto/core_namemap.c
 469e2f53b5f76cd487a60d3d4c44c8fc3a6c4d08405597ba664661ba485508d3  crypto/cpuid.c
 71f0fff881eb4c5505fb17662f0ea4bbff24c6858c045a013ad8f786b07da5c4  crypto/cryptlib.c
-a3d146afa1d66cc3bbfdc7c106f262b679bb5aecce54e8dee732ae9b3e3333db  crypto/ctype.c
+7e8c8c0b43af045fb31c38a0eb643d5db1316fb832b3b0494809f7c288630ec8  crypto/ctype.c
 8e61d79299003917ac409d129d291f0a63e4ed417811a8b21169b2b918355335  crypto/der_writer.c
 fea3ba4225df97aee90690adf387625b746d8edfdc5af2357ee65151a3d236ac  crypto/des/des_enc.c
 4971cdc016ee262d81e31f96c1617a33a63c0d90139e440c2ff32a368ee07bbd  crypto/des/des_local.h
@@ -119,8 +119,8 @@
 816472a54c273906d0a2b58650e0b9d28cc2c8023d120f0d77160f1fe34c4ca3  crypto/dh/dh_backend.c
 832e5a1caf9cb0dacfd937fc59252aaac7c5c1bf0ae1a9ebf3c3af6e59dcf4c0  crypto/dh/dh_check.c
 7838e9a35870b0fbcba0aff2f52a2439f64d026e9922bce6e5978c2f22c51120  crypto/dh/dh_gen.c
-70f4cf3485a38cd7d22aa3e965bfe950905f8efec1622e832592a6728498fd78  crypto/dh/dh_group_params.c
-7809cbfd5570db17dcb4bd8f0cf9c5f94337096d39da453d0624c08f071e809f  crypto/dh/dh_kdf.c
+129ee295875e68ad444070b0676f1021eb254cbd87ab22d6baaf7e4e6e59a40b  crypto/dh/dh_group_params.c
+a5cf5cb464b40f1bc5457dc2a6f2c5ec0f050196603cd2ba7037a23ab64adbf7  crypto/dh/dh_kdf.c
 0afa7dd237f9b21b0cfb0de10505facd57eb07ded905d888d43a1de2356d4002  crypto/dh/dh_key.c
 b0046b2c4e1d74ff4e93f2486a00f63728909b8a75cbdd29b9100e607f97995c  crypto/dh/dh_lib.c
 8300775d88db0a1aa26a77eb49d6c4f7252e7fee69e1440de4c40edadc9da044  crypto/dh/dh_local.h
@@ -147,7 +147,7 @@
 063dac1e4a9573c47532123e9e03e3532a7473cc3e146521ba9ec6f486ddf3b1  crypto/ec/curve448/arch_64/arch_intrinsics.h
 43423b7ee85a5c740c1d81499ee06f4a17732c7731a598e7429d5e402ee77cf4  crypto/ec/curve448/arch_64/f_impl.h
 1689097ae10e4982a8cbe50c2f6eddb03c83436f331f0b67edb98d6b58adc962  crypto/ec/curve448/arch_64/f_impl64.c
-b35976955a49414313e3823144a898bc58873b755f4e3a772d520cdd63099581  crypto/ec/curve448/curve448.c
+9b408ec0d43f3b6d714ef5963147e2c2abaddc88633db7dd759193d3c56ed727  crypto/ec/curve448/curve448.c
 3c12d90e3fdd59b5d32d63186f1a6f15c75eb73f5035b844a2054356a9459780  crypto/ec/curve448/curve448_local.h
 178fb9863c33174b633c2e7607160b1bedb506d66cc06d53382d87431441f306  crypto/ec/curve448/curve448_tables.c
 f30e13bba5a136ab9ba5225c98b9b94c2cd73fb3aef60f9dcde3cd471cfa1ca4  crypto/ec/curve448/curve448utils.h
@@ -161,13 +161,13 @@
 ae1637d89287c9d22a34bdc0d67f6e01262a2f8dcef9b61369dba8c334f5a80d  crypto/ec/ec2_oct.c
 6bbbf570ce31f5b579f7e03ec9f8a774663c7c1eb5e475bd31f8fee94a021ffc  crypto/ec/ec2_smpl.c
 2a71bd8dbe4f427c117d990581709a4ddce07fa8e530794b5a9574fef7c48a0c  crypto/ec/ec_asn1.c
-c07fa05c6885e59913e2ce345ff52ef9dfb0418842de3affa6163ad3e71f9c1b  crypto/ec/ec_backend.c
+88e19ca6b892a3afefb25dab0f9cf8796e2eb8504022dcc10b29d5d3923ce73d  crypto/ec/ec_backend.c
 86e2becf9b3870979e2abefa1bd318e1a31820d275e2b50e03b17fc287abb20a  crypto/ec/ec_check.c
 265f911b9d4aada326a2d52cd8a589b556935c8b641598dcd36c6f85d29ce655  crypto/ec/ec_curve.c
 8cfd0dcfb5acbf6105691a2d5e2826dba1ff3906707bc9dd6ff9bffcc306468f  crypto/ec/ec_cvt.c
 28726bc957ea821639b1023e5bff0e77ced61bae31f96c165e33aadfe0bc5c9a  crypto/ec/ec_key.c
 7e40fc646863e0675bbb90f075b809f61bdf0600d8095c8366858d9533ab7700  crypto/ec/ec_kmeth.c
-074a5345ea71ff3fdfb8e0be360391a7640719f1a8a4eae8580c8f02e57af880  crypto/ec/ec_lib.c
+f520a41732e4ca96a74d047b6e8bdca8bdfdc4517c18d27410de33969646abef  crypto/ec/ec_lib.c
 a8a4690e42b4af60aad822aa8b16196df337906af53ea4db926707f7b596ff27  crypto/ec/ec_local.h
 fa901b996eb0e460359cd470843bdb03af7a77a2f1136c5e1d30daef70f3e4d2  crypto/ec/ec_mult.c
 129c6b42417bfcf582f4a959cfd65433e6f85b158274f4fa38f9c62615ac9166  crypto/ec/ec_oct.c
@@ -178,7 +178,7 @@
 f686cea8c8a3259d95c1e6142813d9da47b6d624c62f26c7e4a16d5607cddb35  crypto/ec/ecdsa_vrf.c
 141cfc1459214555b623517a054a9e8d5e4065a11301237b7247be2c6f397a0a  crypto/ec/ecp_mont.c
 13b30f34aeeb0c98747239bfe91b5f0f14e91b2c1f11db62ebb5950c7219daa0  crypto/ec/ecp_nist.c
-c016eb9412aad8cd1213a2f5b1083df1a1a9cb734dc6cc19d99e706935c81ef2  crypto/ec/ecp_nistz256.c
+f288c23b6f83740956886b2303c64d5a3098c98b530859c3bb4b698c01c1643b  crypto/ec/ecp_nistz256.c
 51cb98e7e9c241e33261589f0d74103238baaa850e333c61ff1da360e127518a  crypto/ec/ecp_oct.c
 b4b7c683279454ba41438f50a015cb63ef056ccb9be0168918dfbae00313dc68  crypto/ec/ecp_smpl.c
 2096e13aa2fbcb0d4b10faca3e3f5359cf66098b0397a6d74c6fca14f5dee659  crypto/ec/ecx_backend.c
@@ -187,10 +187,10 @@
 28abc295dad8888b5482eb61d31cd78dd80545ecb67dc6f9446a36deb8c40a5e  crypto/evp/asymcipher.c
 0e75a058dcbbb62cfe39fec6c4a85385dc1a8fce794e4278ce6cebb29763b82b  crypto/evp/dh_support.c
 7fca5ec7c5723b799a7d84d5803071b8f495511e1baf89d430e6800a5228cdad  crypto/evp/digest.c
-5e2c5d865029ae86855f15e162360d091f28ca0d4c67260700c90aa25faf308b  crypto/evp/ec_support.c
-2724dc804304135bc874bd305e14b811169a9e4a62176220a0d5e83f152c2546  crypto/evp/evp_enc.c
+838277f228cd3025cf95a9cd435e5606ad1fb5d207bbb057aa29892e6a657c55  crypto/evp/ec_support.c
+cfccc525e3806d0932254a94ca1a895fe086da84ae8ad2bf2972e96a12d649d2  crypto/evp/evp_enc.c
 0cd2765bf33d998f96d6e8193b2bf27293bcc6a37b7bef7dfd6ec54952ad3c8f  crypto/evp/evp_fetch.c
-029df8bb80a2fb45c22765234b9041ffce82735108e0b11580fd3fbd805362dd  crypto/evp/evp_lib.c
+c9c399b7848f64832deb6e1704e957423ea93827edb4917fafbb0ff911892a2b  crypto/evp/evp_lib.c
 9ac3d97d756ec008db16dd1952115b551f32b2d0590d9a85e1c87d1c78620257  crypto/evp/evp_local.h
 e822c16fc4dc30f2c86e8598c721a9ddfe46d318ce78f4e8e883cdcf8b936221  crypto/evp/evp_rand.c
 2a128617ec0178e9eeacbe41d75a5530755f41ea524cd124607543cf73456a0c  crypto/evp/evp_utils.c
@@ -203,24 +203,24 @@
 e1a052839b8b70dca20dbac1282d61abd1c415bf4fb6afb56b811e8770d8a2e1  crypto/evp/m_sigver.c
 5b8b0bcd4b720b66ce6bc54090ec333891126bb7f6cce4502daf2333668c3db9  crypto/evp/mac_lib.c
 e7e8eb5683cd3fbd409df888020dc353b65ac291361829cc4131d5bc86c9fcb3  crypto/evp/mac_meth.c
-b976077a1f880768f2f0a1c996a53dfdd363605e4977c56fb37e9c1f84f35aa6  crypto/evp/p_lib.c
+ee87cce7ee44b6f3121d21fd20f00d0c91c494a1a9804319981987f3d093923d  crypto/evp/p_lib.c
 3b4228b92eebd04616ecc3ee58684095313dd5ffd1b43cf698a7d6c202cb4622  crypto/evp/pmeth_check.c
 1f0e9e94e9b0ad322956521b438b78d44cfcd8eb974e8921d05f9e21ba1c05cf  crypto/evp/pmeth_gn.c
-76511fba789089a50ef87774817a5482c33633a76a94ecf7b6e8eb915585575d  crypto/evp/pmeth_lib.c
+ef2f789091e4e3f77fea3b4643ff36d9659b18bf7a8c59929ce3305480a3baef  crypto/evp/pmeth_lib.c
 f3a5cbbccb1078cf1fafd74c4caa9f30827081832fbe6dfa5579b17ef809776c  crypto/evp/signature.c
 b06cb8fd4bd95aae1f66e1e145269c82169257f1a60ef0f78f80a3d4c5131fac  crypto/ex_data.c
 324feb067d0f8deb4334f3e6518f570114cb388c85b24f9232bd931a64ff0a9e  crypto/ffc/ffc_backend.c
-ead786b4f5689ab69d6cca5d49e513e0f90cb558b67e6c5898255f2671f1393d  crypto/ffc/ffc_dh.c
+5fe89ce2ce34848b832a2b5a7ac42c161d7ec214a641b7fb11fb1153f2186f74  crypto/ffc/ffc_dh.c
 82abf1f9645336b7dff5e3fa153899280ecaa27b3dad50e6a9ba94d871961888  crypto/ffc/ffc_key_generate.c
 084ae8e68a9df5785376bb961a998036336ed13092ffd1c4258b56e6a7e0478b  crypto/ffc/ffc_key_validate.c
-67fdf1a07ea118963a55540be2ee21c98b7a5eb8149c8caa26e19d922bf60346  crypto/ffc/ffc_params.c
+ecc0d737ccece492f86262dd45f8f03eef2beacafce8022f91939a372f68ac90  crypto/ffc/ffc_params.c
 5174e008f44909724e0ee7109095ee353e67e9ba77e1ab3bedfcf6eaecab7b6c  crypto/ffc/ffc_params_generate.c
 73dac805abab36cd9df53a421221c71d06a366a4ce479fa788be777f11b47159  crypto/ffc/ffc_params_validate.c
 0a4fc92e408b0562cf95c480df93a9907a318a2c92356642903a5d50ed04fd88  crypto/hmac/hmac.c
 0395c1b0834f2f4a0ca1756385f4dc1a4ef6fb925b2db3743df7f57256c5166f  crypto/hmac/hmac_local.h
 f897493b50f4e9dd4cacb2a7accda6683c10ece602641874cdff1dac7128a751  crypto/initthread.c
-f0782ee92b6ebf5a0e66b970ecfbd9c9c6fc4a35ccd055967fbb402577c234ab  crypto/lhash/lhash.c
-73d63f91fbaba47649231636c5afdf76d049a46436fde9fbb2e107cf16bb879e  crypto/lhash/lhash_local.h
+5482c47c266523129980302426d25839fda662f1544f4b684707e6b272a952c9  crypto/lhash/lhash.c
+5d49ce00fc06df1b64cbc139ef45c71e0faf08a33f966bc608c82d574521a49e  crypto/lhash/lhash_local.h
 f866aafae928db1b439ac950dc90744a2397dfe222672fe68b3798396190c8b0  crypto/mem_clr.c
 183bdca6f855182d7d2c78a5c961b34283f85ea69ac828b700605ee82546397d  crypto/modes/asm/aes-gcm-armv8_64.pl
 1d686af304f94743038f916125effcb51790c025f3165d8d37b526bbeee781f0  crypto/modes/asm/aesni-gcm-x86_64.pl
@@ -248,12 +248,12 @@
 cc4483ec9ba7a30908e3a433a6817e2f211d4c1f69c206e6bae24bbd39a68281  crypto/param_build.c
 c2fe815fb3fd5efe9a6544cae55f9469063a0f6fb728361737b927f6182ae0bb  crypto/param_build_set.c
 02dfeb286c85567bb1b6323a53c089ba66447db97695cc78eceb6677fbc76bf9  crypto/params.c
-4f2a8c9acf5898fdc1e4bf98813049947221cd9a1db04faaa490250591f54cb4  crypto/params_dup.c
+4fda13f6af05d80b0ab89ec4f5813c274a21a9b4565be958a02d006236cef05c  crypto/params_dup.c
 a0097ff2da8955fe15ba204cb54f3fd48a06f846e2b9826f507b26acf65715c3  crypto/params_from_text.c
 2140778d5f35e503e22b173736e18ff84406f6657463e8ff9e7b91a78aa686d3  crypto/property/defn_cache.c
 9153343b26e5c2c4f6009d37a12d6af85681ed0c7d3f58de2ace44dfd789a59b  crypto/property/property.c
 a2c69527b60692a8b07cfdfe7e75f654daa092411d5de5e02b446a4ef3752855  crypto/property/property_local.h
-c3217b73871d93d81ab9f15e9f1fc37ea609bbe4bbc0c1b84ec62a99c91f6756  crypto/property/property_parse.c
+b87bfb053457cbe1cedad3a53cce044375d2f429c75d0c97c2a61def59080644  crypto/property/property_parse.c
 a7cefda6a117550e2c76e0f307565ce1e11640b11ba10c80e469a837fd1212a3  crypto/property/property_query.c
 065698c8d88a5facc0cbc02a3bd0c642c94687a8c5dd79901c942138b406067d  crypto/property/property_string.c
 01d2e5be52d94efdff4329281b3609c7fa57162ab6143492c380c96952df1396  crypto/provider_core.c
@@ -262,7 +262,7 @@
 4e6b7d1d8278067c18bcb5e3ac9b7fe7e9b1d0d03bc5a276275483f541d1a12c  crypto/rand/rand_lib.c
 fd03b9bb2c23470fa40880ed3bf9847bb17d50592101a78c0ad7a0f121209788  crypto/rand/rand_local.h
 f0c8792a99132e0b9c027cfa7370f45594a115934cdc9e8f23bdd64abecaf7fd  crypto/rsa/rsa_acvp_test_params.c
-054f8e32eabb218d219a5fa8cb40f6e76bc5a395d03e4f83c5f2b703a5a476b9  crypto/rsa/rsa_backend.c
+b89d28722134386072670ddc4d5cbff736d1649c114f38d964892f21420c13bf  crypto/rsa/rsa_backend.c
 38a102cd1da1f6ca5a46e6a22f018237964336274385f5c70cbedcaa6997647e  crypto/rsa/rsa_chk.c
 e32cfa04221a2a3ea33f7bcb93ee51b84cbeba97e94c1fbf6e420b24f97fc9ce  crypto/rsa/rsa_crpt.c
 21794dcb6bfebcf9a14d4f8aa7fab8f745b595433b388b55f46ba6e615d90f98  crypto/rsa/rsa_gen.c
@@ -328,21 +328,21 @@
 3d972a11be18bfbfcd45790028635d63548bfe0a2e45d2fc56b6051b759d22f0  crypto/sha/sha3.c
 8038a5a97f826f519424db634be5b082b3f7eca3ccb89875ca40fa6bd7dfdcfd  crypto/sha/sha512.c
 6c6f0e6069ac98e407a5810b84deace2d1396d252c584703bcd154d1a015c3ea  crypto/sha/sha_local.h
-86913a593b55c759a3824eeede398f966278d79c148bef41986c5ac4e48f0bd7  crypto/sparse_array.c
+4f6b66f811144648d6cb6bc26e08779529acbbd563519590c726d0e51699fe96  crypto/sparse_array.c
 b39e5ba863af36e455cc5864fe8c5d0fc05a6aaef0d528a115951d1248e8fa8b  crypto/stack/stack.c
 7b4efa594d8d1f3ecbf4605cf54f72fb296a3b1d951bdc69e415aaa08f34e5c8  crypto/threads_lib.c
 a41ae93a755e2ec89b3cb5b4932e2b508fdda92ace2e025a2650a6da0e9e972c  crypto/threads_none.c
-ebb210a22c280839853920bee245eb769c713ab99cb35a468ed2b1df0d112a7f  crypto/threads_pthread.c
+2637a8727dee790812b000f2e02b336f7907949df633dda72938bbaafdb204fe  crypto/threads_pthread.c
 68e1cdeb948d3a106b5a27b76bcddbae6bb053b2bdc4a21a1fec9797a00cd904  crypto/threads_win.c
 fd6c27cf7c6b5449b17f2b725f4203c4c10207f1973db09fd41571efe5de08fd  crypto/x86_64cpuid.pl
-d13560a5f8a66d7b956d54cd6bf24eade529d686992d243bfb312376a57b475e  e_os.h
+84c4331bbe99471706fadf97299c660dca46f663c2526f33c3424656215aa0c5  e_os.h
 6f353dc7c8c4d8f24f7ffbf920668ccb224ebb5810805a7c80d96770cd858005  include/crypto/aes_platform.h
 8c6f308c1ca774e6127e325c3b80511dbcdc99631f032694d8db53a5c02364ee  include/crypto/asn1_dsa.h
 8ce1b35c6924555ef316c7c51d6c27656869e6da7f513f45b7a7051579e3e54d  include/crypto/bn.h
 1c46818354d42bd1b1c4e5fdae9e019814936e775fd8c918ca49959c2a6416df  include/crypto/bn_conf.h.in
 7a43a4898fcc8446065e6c99249bcc14e475716e8c1d40d50408c0ab179520e6  include/crypto/bn_dh.h
 e69b2b20fb415e24b970941c84a62b752b5d0175bc68126e467f7cc970495504  include/crypto/cryptlib.h
-5ee1ea30382bef9869f29b6610665ca304f3b9cf3653746a2d02c64b1a24f103  include/crypto/ctype.h
+cf1d91147fb3f6cd02387c7fe219ff2efd8c060e9a8501d1c2245fbdb21bf7a6  include/crypto/ctype.h
 89693e0a7528a9574e1d2f80644b29e3b895d3684111dd07c18cc5bed28b45b7  include/crypto/des_platform.h
 daf508bb7ed5783f1c8c622f0c230e179244dd3f584e1223a19ab95930fbcb4f  include/crypto/dh.h
 20d99c9a740e4d7d67e23fa4ae4c6a39d114e486c66ad41b65d91a8244cd1dea  include/crypto/dsa.h
@@ -361,7 +361,7 @@
 5bfeea62d21b7cb43d9a819c5cd2800f02ea019687a8331abf313d615889ad37  include/crypto/types.h
 782a83d4e489fd865e2768a20bfa31e78c2071fd0ceeb9eb077276ae2bcc6590  include/internal/bio.h
 92aacb3e49288f91b44f97e41933e88fe455706e1dd21a365683c2ab545db131  include/internal/constant_time.h
-71ddae419297069056065ab71f32fe88b09ddbe4db2200a759fedd8ad4349628  include/internal/core.h
+1f92626d81730616fb459849c1c7fb0ec105f2ffb0e51edaa0a64307bc1e1027  include/internal/core.h
 d7ddeab97434a21cb2cad1935a3cb130f6cd0b3c75322463d431c5eab3ab1ae1  include/internal/cryptlib.h
 9571cfd3d5666749084b354a6d65adee443deeb5713a58c098c7b03bc69dbc63  include/internal/deprecated.h
 8a2371f964cbb7fc3916583d2a4cee5c56f98595dfa30bd60c71637811a6d9da  include/internal/der.h
@@ -402,7 +402,7 @@
 df5e60af861665675e4a00d40d15e36884f940e3379c7b45c9f717eaf1942697  include/openssl/core.h
 00110e80b9b4f621c604ea99f05e7a75d3db4721fc2779224e6fa7e52f06e345  include/openssl/core_dispatch.h
 cbd9d7855ca3ba4240207fc025c22bbfef7411116446ff63511e336a0559bed0  include/openssl/core_names.h
-8880892256a4d2dd7a9be91f23518f71e5037dbd377cd41bdb4c1f3cb3c7ee2d  include/openssl/crypto.h.in
+194f96a30bdc4dab3f65693c09326ef53c54ebfd613c2513d8258a0aa35a6996  include/openssl/crypto.h.in
 1d1697bd3e35920ff9eaec23c29472d727a7fc4d108150957f41f6f5ecf80f1a  include/openssl/cryptoerr.h
 bbc82260cbcadd406091f39b9e3b5ea63146d9a4822623ead16fa12c43ab9fc6  include/openssl/cryptoerr_legacy.h
 fa3e6b6c2e6222424b9cd7005e3c5499a2334c831cd5d6a29256ce945be8cb1d  include/openssl/des.h
@@ -413,7 +413,7 @@
 41bf49e64e1c341a8c17778147ddeba35e88dfd7ff131db6210e801ef25a8fd5  include/openssl/e_os2.h
 bc9ec2be442a4f49980ba2c63c8f0da701de1f6e23d7db35d781658f833dd7b9  include/openssl/ebcdic.h
 33b6321d1c6b7b1621198346946401bb81472054aa236b03c6f22f247248d2ad  include/openssl/ec.h
-cbbf74efc7fdb020f06840c856ad7fe97553944f4cc3c197fbb004de38158048  include/openssl/ecerr.h
+dad1943d309aaadb800be4a3056096abec611d81982b83c601b482405e11d5c0  include/openssl/ecerr.h
 61c76ee3f12ed0e42503a56421ca00f1cb9a0f4caa5f9c4421c374bcd45917d7  include/openssl/encoder.h
 69dd983f45b8ccd551f084796519446552963a18c52b70470d978b597c81b2dc  include/openssl/encodererr.h
 0bb50eda4fe2600c20779d5e3c49668cf2dd8f295104549a33e57bc95a9219eb  include/openssl/err.h.in
@@ -448,7 +448,7 @@
 410c6eb3ffadcbee13d511d6b8ee576db75b35b324cb394b5e05dbd4a17fb92e  include/openssl/trace.h
 873d2ec2054ec24c52df4abe830cb2b9666fe4e75cc62b4de0f50ef9d20c5812  include/openssl/types.h
 c0a9551efccf43f3dd748d4fd8ec897ddaabbc629c00ec1ad76ce983e1195a13  providers/common/bio_prov.c
-e7c39ef7b76668dae1470ce0edd7254da2937569762cebbf20e08fb97cb3324c  providers/common/capabilities.c
+4546387d6642603c81ec4cd8d5fc4af8ba60ac7359eb6f31e7d24827031e68ad  providers/common/capabilities.c
 f94b7435d4ec888ec30df1c611afa8b9eedbb59e905a2c7cb17cfc8c4b9b85b8  providers/common/der/der_digests_gen.c.in
 424d7b2ece984a0904b80c73e541400c6e2d50a285c397dd323b440a4f2a8d8e  providers/common/der/der_dsa_gen.c.in
 27ff361a5fbfc97cd41690ab26639708961d0507b60912f55f5919649842c6ae  providers/common/der/der_dsa_key.c
@@ -482,8 +482,8 @@
 ba345b0d71f74c9e3d752579e16d11cc70b4b00faa329cc674bc43dd2620e044  providers/common/securitycheck.c
 527eda471e26763a5fcf123b2d290234d5c836de7b8ef6eef2166ef439919d82  providers/common/securitycheck_fips.c
 abd5997bc33b681a4ab275978b92aebca0806a4a3f0c2f41dacf11b3b6f4e101  providers/fips/fips_entry.c
-a4dc9bf2d77e34175737b7b8d28fbe90815ac0e2904e3ac2d9e2a271f345ef20  providers/fips/fipsprov.c
-fdbaf748044ce54f13e673b92db876e32436e4d5644f443cc43d063112a89676  providers/fips/self_test.c
+c458e4830c0cd31e4aabef0e33c2011079f201c6bbaee59b59cefab70eb9c7b4  providers/fips/fipsprov.c
+24a2e1a855de57b9d970727fcc11ebe7e06c0d4884d3cedbacf59fa471f91e72  providers/fips/self_test.c
 f822a03138e8b83ccaa910b89d72f31691da6778bf6638181f993ec7ae1167e3  providers/fips/self_test.h
 5b3379a3d382c4dad37841dbd58b77ed5ff712b0a37c485771b828fa9b39c351  providers/fips/self_test_data.inc
 2f4f23ebc2c7ed5ef71c98ca71f06b639112a1dea04784c46af58083482c150f  providers/fips/self_test_kats.c
@@ -513,7 +513,7 @@
 c4a2499b214d7cf786dafaaee5c8c6963b3d5d1c27c144eec4b460f839074a3b  providers/implementations/ciphers/cipher_aes_xts.h
 281157d1da4d7285d878978e6d42d0d33b3a6bc16e3bc5b6879e39093a7d70da  providers/implementations/ciphers/cipher_aes_xts_fips.c
 f358c4121a8a223e2c6cf009fd28b8a195520279016462890214e8858880f632  providers/implementations/ciphers/cipher_aes_xts_hw.c
-f2e7404005e0602c4cc90b49b7af7453aa5b8644720ca1028d93e78bc28a7c09  providers/implementations/ciphers/cipher_cts.c
+46ba8271917b53fd8fdf77aee19cc326a219c950b94e043d6d118dcac25ad7ad  providers/implementations/ciphers/cipher_cts.c
 74640ce402acc704af72e055fb7f27e6aa8efd417babc56f710478e571d8631c  providers/implementations/ciphers/cipher_cts.h
 fcc3bb0637864252402aaa9d543209909df9a39611127f777b168bc888498dc0  providers/implementations/ciphers/cipher_tdes.c
 77709f7fc3f7c08986cd4f0ebf2ef6e44bacb975c1483ef444b3cf5e5071f9d6  providers/implementations/ciphers/cipher_tdes.h
@@ -544,31 +544,31 @@
 c95ce5498e724b9b3d58e3c2f4723e7e3e4beb07f9bea9422e43182cbadb43af  providers/implementations/include/prov/macsignature.h
 29d1a112b799e1f45fdf8bcee8361c2ed67428c250c1cdf408a9fbb7ebf4cce1  providers/implementations/include/prov/names.h
 2187713b446d8b6d24ee986748b941ac3e24292c71e07ff9fb53a33021decdda  providers/implementations/include/prov/seeding.h
-432e2d5e467a50bd031a6b94b27072f5d66f4fadb6d62c9bfd9453d444c2aedf  providers/implementations/kdfs/hkdf.c
-06c93b62806819ee51f69c899413fda5be2435d43a70ef467b77a7296cd9528a  providers/implementations/kdfs/kbkdf.c
+86026710ea733f0dd44e400c43e7dab745526f2255816f48a6b00dd8b8009879  providers/implementations/kdfs/hkdf.c
+a62e3af09f5af84dcf36f951ba4ac90ca1694adaf3747126186020b155f94186  providers/implementations/kdfs/kbkdf.c
 e0644e727aacfea4da3cf2c4d2602d7ef0626ebb760b6467432ffd54d5fbb24d  providers/implementations/kdfs/pbkdf2.c
 c0778565abff112c0c5257329a7750ec4605e62f26cc36851fa1fbee6e03c70c  providers/implementations/kdfs/pbkdf2.h
 abe2b0f3711eaa34846e155cffc9242e4051c45de896f747afd5ac9d87f637dc  providers/implementations/kdfs/pbkdf2_fips.c
-66d30c754c1e16d97a8e989f7f2e89eab59ec40ca3731dea664ba56ec38c4002  providers/implementations/kdfs/sshkdf.c
+9cc42a4b0a8089e6d1be64637dbb9e41bd21ae5e3386022a27a8f29308ad25c9  providers/implementations/kdfs/sshkdf.c
 7c692170729ab1d648564abdbf9bcbba5071f9a81a25fab9eae66899316bcd4a  providers/implementations/kdfs/sskdf.c
-3c46ec0e14be09a133d709c3a1c3d5ab05a4f1ed5385c3e7a1afb2f0ee47ef7a  providers/implementations/kdfs/tls1_prf.c
+7d258a469fac4d5ae99c785bae5f490044c593ed13a02a861b1d33339ee167e0  providers/implementations/kdfs/tls1_prf.c
 27bb6ee5e2d00c545635c0c29402b10e74a1831adbc9800c159cbe04f2bfa2f7  providers/implementations/kdfs/x942kdf.c
-f419a9f6b17cfba1543a3690326188ac8335db66807c58de211a3d69e18f7d4d  providers/implementations/kem/rsa_kem.c
+6b6c776b12664164f3cb54c21df61e1c4477c7855d89431a16fb338cdae58d43  providers/implementations/kem/rsa_kem.c
 7628cfd7c88f37faa557c671a78ff56266691d64075104a514a28cb6fb9a6816  providers/implementations/keymgmt/dh_kmgmt.c
-68d5cad49334ad0ee6948329b3784bb43eede84c3bc59ff22cbbe7aed9292672  providers/implementations/keymgmt/dsa_kmgmt.c
-3e2798d299d6571c973fc75468e2ac025b7c893ae2f15f14e057430325622a69  providers/implementations/keymgmt/ec_kmgmt.c
+9dc19fb4e9775e93b233fa93212e60f0959faa61248f853db75f3281e2535e95  providers/implementations/keymgmt/dsa_kmgmt.c
+c68b2331f2863d0d92725367c16a6a68b1243c672c14dde13768ed4afd9c7418  providers/implementations/keymgmt/ec_kmgmt.c
 258ae17bb2dd87ed1511a8eb3fe99eed9b77f5c2f757215ff6b3d0e8791fc251  providers/implementations/keymgmt/ec_kmgmt_imexport.inc
-8871260c1b05832efa8363e5546210004da1683fee74da6c749ebba802b40f2b  providers/implementations/keymgmt/ecx_kmgmt.c
+d77ece2494e6b12a6201a2806ee5fb24a6dc2fa3e1891a46012a870e0b781ab1  providers/implementations/keymgmt/ecx_kmgmt.c
 053a2be39a87f50b877ebdbbf799cf5faf8b2de33b04311d819d212ee1ea329b  providers/implementations/keymgmt/kdf_legacy_kmgmt.c
-260c560930c5aca61225a40ed49dfbb905f2b1fa50728d1388e946358f9d5e18  providers/implementations/keymgmt/mac_legacy_kmgmt.c
+e30357311e4a3e1c78266af6315fd1fc99584bfb09f4a7cd0ddc7261cf1e17e1  providers/implementations/keymgmt/mac_legacy_kmgmt.c
 d469be20a6d1a3744c1a2d5c26cb3b8ff6339a2242d4ef6e5ed9531551f717c1  providers/implementations/keymgmt/rsa_kmgmt.c
-79da66d4b696388d7eab6b2126bccc88908915813d79c4305b8b4d545a500469  providers/implementations/macs/cmac_prov.c
-41464d1e640434bb3ff9998f093829d5e2c1963d68033dca7d31e5ab75365fb1  providers/implementations/macs/gmac_prov.c
-282c1065f18c87073529ed1bdc2c0b3a1967701728084de6632ddc72c671d209  providers/implementations/macs/hmac_prov.c
+aeb42590728ca87b916b8a3d337351b1c82ee0747213e5ce740c2350b3db7185  providers/implementations/macs/cmac_prov.c
+93fa712c692bd5c93d3802b2554d5df33ea9d0b8987f9c92aa88358089a4bdfa  providers/implementations/macs/gmac_prov.c
+400a054d449cdee1f308644f1314bdc044fd0fdf793ae58ffa4e4aac6c0498d3  providers/implementations/macs/hmac_prov.c
 aa7ba1d39ea4e3347294eb50b4dfcb895ef1a22bd6117d3b076a74e9ff11c242  providers/implementations/macs/kmac_prov.c
 bf30274dd6b528ae913984775bd8f29c6c48c0ef06d464d0f738217727b7aa5c  providers/implementations/rands/crngt.c
 c7236e6e2e8adce14f8206da0ceef63c7974d4ba1a7dd71b94fa100cac6b46ba  providers/implementations/rands/drbg.c
-b1e7a0b2610aaab5800af7ede0df13a184f4a321a4084652cdb509357c55783b  providers/implementations/rands/drbg_ctr.c
+bb5f8161a80d0d1a7ee919af2b167972b00afd62e326252ca6aa93101f315f19  providers/implementations/rands/drbg_ctr.c
 a05adc3f6d9d6f948e5ead75f0522ed3164cb5b2d301169242f3cb97c4a7fac3  providers/implementations/rands/drbg_hash.c
 0876dfae991028c569631938946e458e6829cacf4cfb673d2b144ae50a3160bb  providers/implementations/rands/drbg_hmac.c
 fc43558964bdf12442d3f6ab6cc3e6849f7adb42f4d0123a1279819befcf71cb  providers/implementations/rands/drbg_local.h
@@ -577,6 +577,6 @@
 a30dc6308de0ca33406e7ce909f3bcf7580fb84d863b0976b275839f866258df  providers/implementations/signature/ecdsa_sig.c
 b057870cf8be1fd28834670fb092f0e6f202424c7ae19282fe9df4e52c9ce036  providers/implementations/signature/eddsa_sig.c
 3bb0f342b4cc1b4594ed0986adc47791c0a7b5c1ae7b1888c1fb5edb268a78d9  providers/implementations/signature/mac_legacy_sig.c
-cee0e3304cc365ef76b422363ef12affc4d03670fd2ab2c8f3babc38f9d5db37  providers/implementations/signature/rsa_sig.c
+2334c8bba705032b8c1db5dd28e024a45a73b72cae82a2d815fe855445a49d10  providers/implementations/signature/rsa_sig.c
 c8df17850314b145ca83d4037207d6bf0994f9c34e6e55116860cf575df58e81  ssl/record/tls_pad.c
 3f2e01a98d9e3fda6cc5cb4b44dd43f6cae4ec34994e8f734d11b1e643e58636  ssl/s3_cbc.c
diff -Nru openssl-3.0.2/providers/implementations/ciphers/cipher_cts.c openssl-3.0.3/providers/implementations/ciphers/cipher_cts.c
--- openssl-3.0.2/providers/implementations/ciphers/cipher_cts.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/ciphers/cipher_cts.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -46,7 +46,6 @@
  *      Otherwise it is the same as CS2.
  */
 
-#include "e_os.h" /* strcasecmp */
 #include <openssl/core_names.h>
 #include "prov/ciphercommon.h"
 #include "internal/nelem.h"
@@ -92,7 +91,7 @@
     size_t i;
 
     for (i = 0; i < OSSL_NELEM(cts_modes); ++i) {
-        if (strcasecmp(name, cts_modes[i].name) == 0)
+        if (OPENSSL_strcasecmp(name, cts_modes[i].name) == 0)
             return (int)cts_modes[i].id;
     }
     return -1;
diff -Nru openssl-3.0.2/providers/implementations/ciphers/cipher_rc4_hmac_md5.c openssl-3.0.3/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
--- openssl-3.0.2/providers/implementations/ciphers/cipher_rc4_hmac_md5.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/ciphers/cipher_rc4_hmac_md5.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -183,7 +183,7 @@
         }
         ctx->tls_aad_pad_sz = sz;
     }
-    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
+    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_MAC_KEY);
     if (p != NULL) {
         if (p->data_type != OSSL_PARAM_OCTET_STRING) {
             ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
diff -Nru openssl-3.0.2/providers/implementations/kdfs/hkdf.c openssl-3.0.3/providers/implementations/kdfs/hkdf.c
--- openssl-3.0.2/providers/implementations/kdfs/hkdf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/kdfs/hkdf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -199,11 +199,11 @@
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) {
         if (p->data_type == OSSL_PARAM_UTF8_STRING) {
-            if (strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) {
+            if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) {
                 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;
-            } else if (strcasecmp(p->data, "EXTRACT_ONLY") == 0) {
+            } else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) {
                 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
-            } else if (strcasecmp(p->data, "EXPAND_ONLY") == 0) {
+            } else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) {
                 ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
             } else {
                 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
diff -Nru openssl-3.0.2/providers/implementations/kdfs/kbkdf.c openssl-3.0.3/providers/implementations/kdfs/kbkdf.c
--- openssl-3.0.2/providers/implementations/kdfs/kbkdf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/kdfs/kbkdf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2019 Red Hat, Inc.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -298,10 +298,11 @@
     }
 
     p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE);
-    if (p != NULL && strncasecmp("counter", p->data, p->data_size) == 0) {
+    if (p != NULL
+        && OPENSSL_strncasecmp("counter", p->data, p->data_size) == 0) {
         ctx->mode = COUNTER;
     } else if (p != NULL
-               && strncasecmp("feedback", p->data, p->data_size) == 0) {
+               && OPENSSL_strncasecmp("feedback", p->data, p->data_size) == 0) {
         ctx->mode = FEEDBACK;
     } else if (p != NULL) {
         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
diff -Nru openssl-3.0.2/providers/implementations/kdfs/sshkdf.c openssl-3.0.3/providers/implementations/kdfs/sshkdf.c
--- openssl-3.0.2/providers/implementations/kdfs/sshkdf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/kdfs/sshkdf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -59,7 +59,8 @@
 
     if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL)
         ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
-    ctx->provctx = provctx;
+    else
+        ctx->provctx = provctx;
     return ctx;
 }
 
diff -Nru openssl-3.0.2/providers/implementations/kdfs/tls1_prf.c openssl-3.0.3/providers/implementations/kdfs/tls1_prf.c
--- openssl-3.0.2/providers/implementations/kdfs/tls1_prf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/kdfs/tls1_prf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -172,7 +172,7 @@
         return 1;
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DIGEST)) != NULL) {
-        if (strcasecmp(p->data, SN_md5_sha1) == 0) {
+        if (OPENSSL_strcasecmp(p->data, SN_md5_sha1) == 0) {
             if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
                                                    OSSL_MAC_NAME_HMAC,
                                                    NULL, SN_md5, libctx)
diff -Nru openssl-3.0.2/providers/implementations/kem/rsa_kem.c openssl-3.0.3/providers/implementations/kem/rsa_kem.c
--- openssl-3.0.2/providers/implementations/kem/rsa_kem.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/kem/rsa_kem.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -12,8 +12,8 @@
  * internal use.
  */
 #include "internal/deprecated.h"
+#include "internal/nelem.h"
 
-#include "e_os.h"  /* strcasecmp */
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/core_dispatch.h>
@@ -69,7 +69,7 @@
         return -1;
 
     for (i = 0; i < sz; ++i) {
-        if (strcasecmp(map[i].ptr, name) == 0)
+        if (OPENSSL_strcasecmp(map[i].ptr, name) == 0)
             return map[i].id;
     }
     return -1;
diff -Nru openssl-3.0.2/providers/implementations/keymgmt/dsa_kmgmt.c openssl-3.0.3/providers/implementations/keymgmt/dsa_kmgmt.c
--- openssl-3.0.2/providers/implementations/keymgmt/dsa_kmgmt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/keymgmt/dsa_kmgmt.c	2022-05-03 15:32:01.000000000 +0200
@@ -13,7 +13,6 @@
  */
 #include "internal/deprecated.h"
 
-#include "e_os.h" /* strcasecmp */
 #include <openssl/core_dispatch.h>
 #include <openssl/core_names.h>
 #include <openssl/bn.h>
@@ -90,7 +89,7 @@
     size_t i;
 
     for (i = 0; i < OSSL_NELEM(dsatype2id); ++i) {
-        if (strcasecmp(dsatype2id[i].name, name) == 0)
+        if (OPENSSL_strcasecmp(dsatype2id[i].name, name) == 0)
             return dsatype2id[i].id;
     }
     return -1;
diff -Nru openssl-3.0.2/providers/implementations/keymgmt/ec_kmgmt.c openssl-3.0.3/providers/implementations/keymgmt/ec_kmgmt.c
--- openssl-3.0.2/providers/implementations/keymgmt/ec_kmgmt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/keymgmt/ec_kmgmt.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -13,7 +13,6 @@
  */
 #include "internal/deprecated.h"
 
-#include "e_os.h" /* strcasecmp */
 #include <string.h>
 #include <openssl/core_dispatch.h>
 #include <openssl/core_names.h>
@@ -470,9 +469,6 @@
     if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0
             && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0)
         return 0;
-    if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0
-            && (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
-        return 0;
 
     tmpl = OSSL_PARAM_BLD_new();
     if (tmpl == NULL)
diff -Nru openssl-3.0.2/providers/implementations/keymgmt/ecx_kmgmt.c openssl-3.0.3/providers/implementations/keymgmt/ecx_kmgmt.c
--- openssl-3.0.2/providers/implementations/keymgmt/ecx_kmgmt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/keymgmt/ecx_kmgmt.c	2022-05-03 15:32:01.000000000 +0200
@@ -9,8 +9,6 @@
 
 #include <assert.h>
 #include <string.h>
-/* For strcasecmp on Windows */
-#include "e_os.h"
 #include <openssl/core_dispatch.h>
 #include <openssl/core_names.h>
 #include <openssl/params.h>
@@ -546,7 +544,7 @@
         }
         if (p->data_type != OSSL_PARAM_UTF8_STRING
                 || groupname == NULL
-                || strcasecmp(p->data, groupname) != 0) {
+                || OPENSSL_strcasecmp(p->data, groupname) != 0) {
             ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);
             return 0;
         }
diff -Nru openssl-3.0.2/providers/implementations/keymgmt/mac_legacy_kmgmt.c openssl-3.0.3/providers/implementations/keymgmt/mac_legacy_kmgmt.c
--- openssl-3.0.2/providers/implementations/keymgmt/mac_legacy_kmgmt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/keymgmt/mac_legacy_kmgmt.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -26,7 +26,6 @@
 #include "prov/providercommon.h"
 #include "prov/provider_ctx.h"
 #include "prov/macsignature.h"
-#include "e_os.h" /* strcasecmp */
 
 static OSSL_FUNC_keymgmt_new_fn mac_new;
 static OSSL_FUNC_keymgmt_free_fn mac_free;
diff -Nru openssl-3.0.2/providers/implementations/macs/cmac_prov.c openssl-3.0.3/providers/implementations/macs/cmac_prov.c
--- openssl-3.0.2/providers/implementations/macs/cmac_prov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/macs/cmac_prov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -122,7 +122,8 @@
         return 0;
     if (key != NULL)
         return cmac_setkey(macctx, key, keylen);
-    return 1;
+    /* Reinitialize the CMAC context */
+    return CMAC_Init(macctx->ctx, NULL, 0, NULL, NULL);
 }
 
 static int cmac_update(void *vmacctx, const unsigned char *data,
diff -Nru openssl-3.0.2/providers/implementations/macs/gmac_prov.c openssl-3.0.3/providers/implementations/macs/gmac_prov.c
--- openssl-3.0.2/providers/implementations/macs/gmac_prov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/macs/gmac_prov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -120,7 +120,7 @@
         return 0;
     if (key != NULL)
         return gmac_setkey(macctx, key, keylen);
-    return 1;
+    return EVP_EncryptInit_ex(macctx->ctx, NULL, NULL, NULL, NULL);
 }
 
 static int gmac_update(void *vmacctx, const unsigned char *data,
@@ -209,19 +209,22 @@
 
     if (params == NULL)
         return 1;
-    if (ctx == NULL
-        || !ossl_prov_cipher_load_from_params(&macctx->cipher, params, provctx))
+    if (ctx == NULL)
         return 0;
 
-    if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher))
-        != EVP_CIPH_GCM_MODE) {
-        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
-        return 0;
+    if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_CIPHER)) != NULL) {
+        if (!ossl_prov_cipher_load_from_params(&macctx->cipher, params, provctx))
+            return 0;
+        if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher))
+            != EVP_CIPH_GCM_MODE) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
+            return 0;
+        }
+        if (!EVP_EncryptInit_ex(ctx, ossl_prov_cipher_cipher(&macctx->cipher),
+                                ossl_prov_cipher_engine(&macctx->cipher), NULL,
+                                NULL))
+            return 0;
     }
-    if (!EVP_EncryptInit_ex(ctx, ossl_prov_cipher_cipher(&macctx->cipher),
-                            ossl_prov_cipher_engine(&macctx->cipher), NULL,
-                            NULL))
-        return 0;
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_KEY)) != NULL)
         if (p->data_type != OSSL_PARAM_OCTET_STRING
diff -Nru openssl-3.0.2/providers/implementations/macs/hmac_prov.c openssl-3.0.3/providers/implementations/macs/hmac_prov.c
--- openssl-3.0.2/providers/implementations/macs/hmac_prov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/macs/hmac_prov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -152,7 +152,7 @@
 {
     const EVP_MD *digest;
 
-    if (macctx->keylen > 0)
+    if (macctx->key != NULL)
         OPENSSL_secure_clear_free(macctx->key, macctx->keylen);
     /* Keep a copy of the key in case we need it for TLS HMAC */
     macctx->key = OPENSSL_secure_malloc(keylen > 0 ? keylen : 1);
@@ -177,9 +177,11 @@
     if (!ossl_prov_is_running() || !hmac_set_ctx_params(macctx, params))
         return 0;
 
-    if (key != NULL && !hmac_setkey(macctx, key, keylen))
-        return 0;
-    return 1;
+    if (key != NULL)
+        return hmac_setkey(macctx, key, keylen);
+
+    /* Just reinit the HMAC context */
+    return HMAC_Init_ex(macctx->ctx, NULL, 0, NULL, NULL);
 }
 
 static int hmac_update(void *vmacctx, const unsigned char *data,
@@ -325,22 +327,10 @@
     if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_KEY)) != NULL) {
         if (p->data_type != OSSL_PARAM_OCTET_STRING)
             return 0;
-
-        if (macctx->keylen > 0)
-            OPENSSL_secure_clear_free(macctx->key, macctx->keylen);
-        /* Keep a copy of the key if we need it for TLS HMAC */
-        macctx->key = OPENSSL_secure_malloc(p->data_size > 0 ? p->data_size : 1);
-        if (macctx->key == NULL)
-            return 0;
-        memcpy(macctx->key, p->data, p->data_size);
-        macctx->keylen = p->data_size;
-
-        if (!HMAC_Init_ex(macctx->ctx, p->data, p->data_size,
-                          ossl_prov_digest_md(&macctx->digest),
-                          NULL /* ENGINE */))
+        if (!hmac_setkey(macctx, p->data, p->data_size))
             return 0;
-
     }
+
     if ((p = OSSL_PARAM_locate_const(params,
                                      OSSL_MAC_PARAM_TLS_DATA_SIZE)) != NULL) {
         if (!OSSL_PARAM_get_size_t(p, &macctx->tls_data_size))
diff -Nru openssl-3.0.2/providers/implementations/macs/poly1305_prov.c openssl-3.0.3/providers/implementations/macs/poly1305_prov.c
--- openssl-3.0.2/providers/implementations/macs/poly1305_prov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/macs/poly1305_prov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -37,6 +37,7 @@
 
 struct poly1305_data_st {
     void *provctx;
+    int updated;
     POLY1305 poly1305;           /* Poly1305 data */
 };
 
@@ -64,11 +65,11 @@
 
     if (!ossl_prov_is_running())
         return NULL;
-    dst = poly1305_new(src->provctx);
+    dst = OPENSSL_malloc(sizeof(*dst));
     if (dst == NULL)
         return NULL;
 
-    dst->poly1305 = src->poly1305;
+    *dst = *src;
     return dst;
 }
 
@@ -85,6 +86,7 @@
         return 0;
     }
     Poly1305_Init(&ctx->poly1305, key);
+    ctx->updated = 0;
     return 1;
 }
 
@@ -98,7 +100,8 @@
         return 0;
     if (key != NULL)
         return poly1305_setkey(ctx, key, keylen);
-    return 1;
+    /* no reinitialization of context with the same key is allowed */
+    return ctx->updated == 0;
 }
 
 static int poly1305_update(void *vmacctx, const unsigned char *data,
@@ -106,6 +109,7 @@
 {
     struct poly1305_data_st *ctx = vmacctx;
 
+    ctx->updated = 1;
     if (datalen == 0)
         return 1;
 
@@ -121,6 +125,7 @@
 
     if (!ossl_prov_is_running())
         return 0;
+    ctx->updated = 1;
     Poly1305_Final(&ctx->poly1305, out);
     *outl = poly1305_size();
     return 1;
diff -Nru openssl-3.0.2/providers/implementations/macs/siphash_prov.c openssl-3.0.3/providers/implementations/macs/siphash_prov.c
--- openssl-3.0.2/providers/implementations/macs/siphash_prov.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/macs/siphash_prov.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -39,6 +39,7 @@
 struct siphash_data_st {
     void *provctx;
     SIPHASH siphash;             /* Siphash data */
+    SIPHASH sipcopy;             /* Siphash data copy for reinitialization */
     unsigned int crounds, drounds;
 };
 
@@ -76,11 +77,11 @@
 
     if (!ossl_prov_is_running())
         return NULL;
-    sdst = siphash_new(ssrc->provctx);
+    sdst = OPENSSL_malloc(sizeof(*sdst));
     if (sdst == NULL)
         return NULL;
 
-    sdst->siphash = ssrc->siphash;
+    *sdst = *ssrc;
     return sdst;
 }
 
@@ -94,9 +95,14 @@
 static int siphash_setkey(struct siphash_data_st *ctx,
                           const unsigned char *key, size_t keylen)
 {
+    int ret;
+
     if (keylen != SIPHASH_KEY_SIZE)
         return 0;
-    return SipHash_Init(&ctx->siphash, key, crounds(ctx), drounds(ctx));
+    ret = SipHash_Init(&ctx->siphash, key, crounds(ctx), drounds(ctx));
+    if (ret)
+        ctx->sipcopy = ctx->siphash;
+    return ret;
 }
 
 static int siphash_init(void *vmacctx, const unsigned char *key, size_t keylen,
@@ -106,11 +112,14 @@
 
     if (!ossl_prov_is_running() || !siphash_set_params(ctx, params))
         return 0;
-    /* Without a key, there is not much to do here,
+    /*
+     * Without a key, there is not much to do here,
      * The actual initialization happens through controls.
      */
-    if (key == NULL)
+    if (key == NULL) {
+        ctx->siphash = ctx->sipcopy;
         return 1;
+    }
     return siphash_setkey(ctx, key, keylen);
 }
 
@@ -194,7 +203,8 @@
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_SIZE)) != NULL) {
         if (!OSSL_PARAM_get_size_t(p, &size)
-            || !SipHash_set_hash_size(&ctx->siphash, size))
+            || !SipHash_set_hash_size(&ctx->siphash, size)
+            || !SipHash_set_hash_size(&ctx->sipcopy, size))
             return 0;
     }
     if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_C_ROUNDS)) != NULL
diff -Nru openssl-3.0.2/providers/implementations/rands/drbg_ctr.c openssl-3.0.3/providers/implementations/rands/drbg_ctr.c
--- openssl-3.0.2/providers/implementations/rands/drbg_ctr.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/rands/drbg_ctr.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2011-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -14,7 +14,6 @@
 #include <openssl/rand.h>
 #include <openssl/aes.h>
 #include <openssl/proverr.h>
-#include "e_os.h" /* strcasecmp */
 #include "crypto/modes.h"
 #include "internal/thread_once.h"
 #include "prov/implementations.h"
@@ -690,7 +689,7 @@
         if (p->data_type != OSSL_PARAM_UTF8_STRING
                 || p->data_size < ctr_str_len)
             return 0;
-        if (strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) {
+        if (OPENSSL_strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) {
             ERR_raise(ERR_LIB_PROV, PROV_R_REQUIRE_CTR_MODE_CIPHER);
             return 0;
         }
diff -Nru openssl-3.0.2/providers/implementations/signature/rsa_sig.c openssl-3.0.3/providers/implementations/signature/rsa_sig.c
--- openssl-3.0.2/providers/implementations/signature/rsa_sig.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/signature/rsa_sig.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -13,7 +13,6 @@
  */
 #include "internal/deprecated.h"
 
-#include "e_os.h" /* strcasecmp */
 #include <string.h>
 #include <openssl/crypto.h>
 #include <openssl/core_dispatch.h>
@@ -854,7 +853,7 @@
 
     if (mdname != NULL
         /* was rsa_setup_md already called in rsa_signverify_init()? */
-        && (mdname[0] == '\0' || strcasecmp(prsactx->mdname, mdname) != 0)
+        && (mdname[0] == '\0' || OPENSSL_strcasecmp(prsactx->mdname, mdname) != 0)
         && !rsa_setup_md(prsactx, mdname, prsactx->propq))
         return 0;
 
diff -Nru openssl-3.0.2/providers/implementations/signature/sm2_sig.c openssl-3.0.3/providers/implementations/signature/sm2_sig.c
--- openssl-3.0.2/providers/implementations/signature/sm2_sig.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/signature/sm2_sig.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -430,7 +430,7 @@
     p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DIST_ID);
     if (p != NULL) {
         void *tmp_id = NULL;
-        size_t tmp_idlen;
+        size_t tmp_idlen = 0;
 
         /*
          * If the 'z' digest has already been computed, the ID is set too late
@@ -438,7 +438,8 @@
         if (!psm2ctx->flag_compute_z_digest)
             return 0;
 
-        if (!OSSL_PARAM_get_octet_string(p, &tmp_id, 0, &tmp_idlen))
+        if (p->data_size != 0
+            && !OSSL_PARAM_get_octet_string(p, &tmp_id, 0, &tmp_idlen))
             return 0;
         OPENSSL_free(psm2ctx->id);
         psm2ctx->id = tmp_id;
diff -Nru openssl-3.0.2/providers/implementations/storemgmt/file_store.c openssl-3.0.3/providers/implementations/storemgmt/file_store.c
--- openssl-3.0.2/providers/implementations/storemgmt/file_store.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/providers/implementations/storemgmt/file_store.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -9,8 +9,6 @@
 
 /* This file has quite some overlap with engines/e_loader_attic.c */
 
-#include "e_os.h"                /* To get strncasecmp() on Windows */
-
 #include <string.h>
 #include <sys/stat.h>
 #include <ctype.h>  /* isdigit */
@@ -220,12 +218,12 @@
      * There's a special case if the URI also contains an authority, then
      * the full URI shouldn't be used as a path anywhere.
      */
-    if (strncasecmp(uri, "file:", 5) == 0) {
+    if (OPENSSL_strncasecmp(uri, "file:", 5) == 0) {
         const char *p = &uri[5];
 
         if (strncmp(&uri[5], "//", 2) == 0) {
             path_data_n--;           /* Invalidate using the full URI */
-            if (strncasecmp(&uri[7], "localhost/", 10) == 0) {
+            if (OPENSSL_strncasecmp(&uri[7], "localhost/", 10) == 0) {
                 p = &uri[16];
             } else if (uri[7] == '/') {
                 p = &uri[7];
@@ -592,7 +590,8 @@
     /*
      * First, check the basename
      */
-    if (strncasecmp(name, ctx->_.dir.search_name, len) != 0 || name[len] != '.')
+    if (OPENSSL_strncasecmp(name, ctx->_.dir.search_name, len) != 0
+        || name[len] != '.')
         return 0;
     p = &name[len + 1];
 
diff -Nru openssl-3.0.2/ssl/s3_lib.c openssl-3.0.3/ssl/s3_lib.c
--- openssl-3.0.2/ssl/s3_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/s3_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -3686,6 +3686,12 @@
     case SSL_CTRL_SET_CHAIN_CERT_STORE:
         return ssl_cert_set_cert_store(s->cert, parg, 1, larg);
 
+    case SSL_CTRL_GET_VERIFY_CERT_STORE:
+        return ssl_cert_get_cert_store(s->cert, parg, 0);
+
+    case SSL_CTRL_GET_CHAIN_CERT_STORE:
+        return ssl_cert_get_cert_store(s->cert, parg, 1);
+
     case SSL_CTRL_GET_PEER_SIGNATURE_NID:
         if (s->s3.tmp.peer_sigalg == NULL)
             return 0;
@@ -3931,6 +3937,12 @@
     case SSL_CTRL_SET_CHAIN_CERT_STORE:
         return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);
 
+    case SSL_CTRL_GET_VERIFY_CERT_STORE:
+        return ssl_cert_get_cert_store(ctx->cert, parg, 0);
+
+    case SSL_CTRL_GET_CHAIN_CERT_STORE:
+        return ssl_cert_get_cert_store(ctx->cert, parg, 1);
+
         /* A Thawte special :-) */
     case SSL_CTRL_EXTRA_CHAIN_CERT:
         if (ctx->extra_certs == NULL) {
diff -Nru openssl-3.0.2/ssl/ssl_cert.c openssl-3.0.3/ssl/ssl_cert.c
--- openssl-3.0.2/ssl/ssl_cert.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/ssl_cert.c	2022-05-03 15:32:01.000000000 +0200
@@ -971,6 +971,12 @@
     return 1;
 }
 
+int ssl_cert_get_cert_store(CERT *c, X509_STORE **pstore, int chain)
+{
+    *pstore = (chain ? c->chain_store : c->verify_store);
+    return 1;
+}
+
 int ssl_get_security_level_bits(const SSL *s, const SSL_CTX *ctx, int *levelp)
 {
     int level;
diff -Nru openssl-3.0.2/ssl/ssl_conf.c openssl-3.0.3/ssl/ssl_conf.c
--- openssl-3.0.2/ssl/ssl_conf.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/ssl_conf.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2012-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -148,7 +148,8 @@
     if (namelen == -1) {
         if (strcmp(tbl->name, name))
             return 0;
-    } else if (tbl->namelen != namelen || strncasecmp(tbl->name, name, namelen))
+    } else if (tbl->namelen != namelen
+               || OPENSSL_strncasecmp(tbl->name, name, namelen))
         return 0;
     ssl_set_option(cctx, tbl->name_flags, tbl->option_value, onoff);
     return 1;
@@ -232,8 +233,8 @@
 
     /* Ignore values supported by 1.0.2 for the automatic selection */
     if ((cctx->flags & SSL_CONF_FLAG_FILE)
-            && (strcasecmp(value, "+automatic") == 0
-                || strcasecmp(value, "automatic") == 0))
+            && (OPENSSL_strcasecmp(value, "+automatic") == 0
+                || OPENSSL_strcasecmp(value, "automatic") == 0))
         return 1;
     if ((cctx->flags & SSL_CONF_FLAG_CMDLINE) &&
         strcmp(value, "auto") == 0)
@@ -597,15 +598,19 @@
             = OSSL_DECODER_CTX_new_for_pkey(&dhpkey, "PEM", NULL, "DH",
                                             OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
                                             sslctx->libctx, sslctx->propq);
-        if (decoderctx == NULL
-                || !OSSL_DECODER_from_bio(decoderctx, in)) {
-            OSSL_DECODER_CTX_free(decoderctx);
+        if (decoderctx == NULL)
             goto end;
-        }
+        ERR_set_mark();
+        while (!OSSL_DECODER_from_bio(decoderctx, in)
+               && dhpkey == NULL
+               && !BIO_eof(in));
         OSSL_DECODER_CTX_free(decoderctx);
 
-        if (dhpkey == NULL)
+        if (dhpkey == NULL) {
+            ERR_clear_last_mark();
             goto end;
+        }
+        ERR_pop_to_mark();
     } else {
         return 1;
     }
@@ -808,7 +813,7 @@
             strncmp(*pcmd, cctx->prefix, cctx->prefixlen))
             return 0;
         if (cctx->flags & SSL_CONF_FLAG_FILE &&
-            strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen))
+            OPENSSL_strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen))
             return 0;
         *pcmd += cctx->prefixlen;
     } else if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
@@ -850,7 +855,7 @@
                     return t;
             }
             if (cctx->flags & SSL_CONF_FLAG_FILE) {
-                if (t->str_file && strcasecmp(t->str_file, cmd) == 0)
+                if (t->str_file && OPENSSL_strcasecmp(t->str_file, cmd) == 0)
                     return t;
             }
         }
diff -Nru openssl-3.0.2/ssl/ssl_lib.c openssl-3.0.3/ssl/ssl_lib.c
--- openssl-3.0.2/ssl/ssl_lib.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/ssl_lib.c	2022-05-03 15:32:01.000000000 +0200
@@ -2232,6 +2232,7 @@
         if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
             struct ssl_async_args args;
 
+            memset(&args, 0, sizeof(args));
             args.s = s;
             args.type = OTHERFUNC;
             args.f.func_other = s->method->ssl_shutdown;
@@ -3914,6 +3915,7 @@
         if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
             struct ssl_async_args args;
 
+            memset(&args, 0, sizeof(args));
             args.s = s;
 
             ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
diff -Nru openssl-3.0.2/ssl/ssl_local.h openssl-3.0.3/ssl/ssl_local.h
--- openssl-3.0.2/ssl/ssl_local.h	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/ssl_local.h	2022-05-03 15:32:01.000000000 +0200
@@ -2430,6 +2430,7 @@
 __owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags);
 __owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain,
                                    int ref);
+__owur int ssl_cert_get_cert_store(CERT *c, X509_STORE **pstore, int chain);
 
 __owur int ssl_security(const SSL *s, int op, int bits, int nid, void *other);
 __owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid,
diff -Nru openssl-3.0.2/ssl/ssl_txt.c openssl-3.0.3/ssl/ssl_txt.c
--- openssl-3.0.2/ssl/ssl_txt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/ssl_txt.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2005 Nokia. All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -129,11 +129,11 @@
     }
 #endif
     if (x->time != 0L) {
-        if (BIO_printf(bp, "\n    Start Time: %ld", x->time) <= 0)
+        if (BIO_printf(bp, "\n    Start Time: %lld", (long long)x->time) <= 0)
             goto err;
     }
     if (x->timeout != 0L) {
-        if (BIO_printf(bp, "\n    Timeout   : %ld (sec)", x->timeout) <= 0)
+        if (BIO_printf(bp, "\n    Timeout   : %lld (sec)", (long long)x->timeout) <= 0)
             goto err;
     }
     if (BIO_puts(bp, "\n") <= 0)
diff -Nru openssl-3.0.2/ssl/statem/statem_clnt.c openssl-3.0.3/ssl/statem/statem_clnt.c
--- openssl-3.0.2/ssl/statem/statem_clnt.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/statem/statem_clnt.c	2022-05-03 15:32:01.000000000 +0200
@@ -1395,6 +1395,10 @@
             && sversion == TLS1_2_VERSION
             && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE
             && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) {
+        if (s->hello_retry_request != SSL_HRR_NONE) {
+            SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto err;
+        }
         s->hello_retry_request = SSL_HRR_PENDING;
         hrr = 1;
         if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) {
diff -Nru openssl-3.0.2/ssl/statem/statem_dtls.c openssl-3.0.3/ssl/statem/statem_dtls.c
--- openssl-3.0.2/ssl/statem/statem_dtls.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/statem/statem_dtls.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -218,8 +218,8 @@
         else
             len = s->init_num;
 
-        if (len > s->max_send_fragment)
-            len = s->max_send_fragment;
+        if (len > ssl_get_max_send_fragment(s))
+            len = ssl_get_max_send_fragment(s);
 
         /*
          * XDTLS: this function is too long.  split out the CCS part
@@ -241,7 +241,7 @@
 
         ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                                 &written);
-        if (ret < 0) {
+        if (ret <= 0) {
             /*
              * might need to update MTU here, but we don't know which
              * previous packet caused the failure -- so can't really
diff -Nru openssl-3.0.2/ssl/statem/statem_srvr.c openssl-3.0.3/ssl/statem/statem_srvr.c
--- openssl-3.0.2/ssl/statem/statem_srvr.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/ssl/statem/statem_srvr.c	2022-05-03 15:32:01.000000000 +0200
@@ -3621,15 +3621,24 @@
 static int create_ticket_prequel(SSL *s, WPACKET *pkt, uint32_t age_add,
                                  unsigned char *tick_nonce)
 {
+    uint32_t timeout = (uint32_t)s->session->timeout;
+
     /*
-     * Ticket lifetime hint: For TLSv1.2 this is advisory only and we leave this
-     * unspecified for resumed session (for simplicity).
+     * Ticket lifetime hint:
      * In TLSv1.3 we reset the "time" field above, and always specify the
-     * timeout.
+     * timeout, limited to a 1 week period per RFC8446.
+     * For TLSv1.2 this is advisory only and we leave this unspecified for
+     * resumed session (for simplicity).
      */
-    if (!WPACKET_put_bytes_u32(pkt,
-                               (s->hit && !SSL_IS_TLS13(s))
-                               ? 0 : (uint32_t)s->session->timeout)) {
+#define ONE_WEEK_SEC (7 * 24 * 60 * 60)
+
+    if (SSL_IS_TLS13(s)) {
+        if (s->session->timeout > ONE_WEEK_SEC)
+            timeout = ONE_WEEK_SEC;
+    } else if (s->hit)
+        timeout = 0;
+
+    if (!WPACKET_put_bytes_u32(pkt, timeout)) {
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         return 0;
     }
diff -Nru openssl-3.0.2/test/bntest.c openssl-3.0.3/test/bntest.c
--- openssl-3.0.2/test/bntest.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/bntest.c	2022-05-03 15:32:01.000000000 +0200
@@ -10,9 +10,6 @@
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
-#ifdef __TANDEM
-# include <strings.h> /* strcasecmp */
-#endif
 #include <ctype.h>
 
 #include <openssl/bn.h>
@@ -23,10 +20,6 @@
 #include "internal/numbers.h"
 #include "testutil.h"
 
-#ifdef OPENSSL_SYS_WINDOWS
-# define strcasecmp _stricmp
-#endif
-
 /*
  * Things in boring, not in openssl.
  */
@@ -64,7 +57,7 @@
     PAIR *pp = s->pairs;
 
     for ( ; --i >= 0; pp++)
-        if (strcasecmp(pp->key, key) == 0)
+        if (OPENSSL_strcasecmp(pp->key, key) == 0)
             return pp->value;
     return NULL;
 }
diff -Nru openssl-3.0.2/test/build.info openssl-3.0.3/test/build.info
--- openssl-3.0.2/test/build.info	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/build.info	2022-05-03 15:32:01.000000000 +0200
@@ -37,7 +37,7 @@
           sanitytest rsa_complex exdatatest bntest \
           ecstresstest gmdifftest pbelutest \
           destest mdc2test sha_test \
-          exptest pbetest \
+          exptest pbetest localetest evp_pkey_ctx_new_from_name\
           evp_pkey_provided_test evp_test evp_extra_test evp_extra_test2 \
           evp_fetch_prov_test evp_libctx_test ossl_store_test \
           v3nametest v3ext \
@@ -135,6 +135,14 @@
   INCLUDE[exptest]=../include ../apps/include
   DEPEND[exptest]=../libcrypto libtestutil.a
 
+  SOURCE[localetest]=localetest.c
+  INCLUDE[localetest]=../include ../apps/include
+  DEPEND[localetest]=../libcrypto libtestutil.a
+
+  SOURCE[evp_pkey_ctx_new_from_name]=evp_pkey_ctx_new_from_name.c
+  INCLUDE[evp_pkey_ctx_new_from_name]=../include ../apps/include
+  DEPEND[evp_pkey_ctx_new_from_name]=../libcrypto
+
   SOURCE[pbetest]=pbetest.c
   INCLUDE[pbetest]=../include ../apps/include
   DEPEND[pbetest]=../libcrypto libtestutil.a
diff -Nru openssl-3.0.2/test/cmsapitest.c openssl-3.0.3/test/cmsapitest.c
--- openssl-3.0.2/test/cmsapitest.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/cmsapitest.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -18,6 +18,7 @@
 
 static X509 *cert = NULL;
 static EVP_PKEY *privkey = NULL;
+static char *derin = NULL;
 
 static int test_encrypt_decrypt(const EVP_CIPHER *cipher)
 {
@@ -288,7 +289,30 @@
     return ret;
 }
 
-OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
+static int test_d2i_CMS_bio_file_encrypted_data(void)
+{
+    BIO *bio = NULL;
+    CMS_ContentInfo *cms = NULL;
+    int ret = 0;
+
+    ERR_clear_error();
+
+    if (!TEST_ptr(bio = BIO_new_file(derin, "r"))
+      || !TEST_ptr(cms = d2i_CMS_bio(bio, NULL)))
+      goto end;
+
+    if (!TEST_int_eq(ERR_peek_error(), 0))
+        goto end;
+
+    ret = 1;
+end:
+    CMS_ContentInfo_free(cms);
+    BIO_free(bio);
+
+    return ret;
+}
+
+OPT_TEST_DECLARE_USAGE("certfile privkeyfile derfile\n")
 
 int setup_tests(void)
 {
@@ -301,7 +325,8 @@
     }
 
     if (!TEST_ptr(certin = test_get_argument(0))
-            || !TEST_ptr(privkeyin = test_get_argument(1)))
+            || !TEST_ptr(privkeyin = test_get_argument(1))
+            || !TEST_ptr(derin = test_get_argument(2)))
         return 0;
 
     certbio = BIO_new_file(certin, "r");
@@ -332,6 +357,7 @@
     ADD_TEST(test_encrypt_decrypt_aes_192_gcm);
     ADD_TEST(test_encrypt_decrypt_aes_256_gcm);
     ADD_TEST(test_d2i_CMS_bio_NULL);
+    ADD_TEST(test_d2i_CMS_bio_file_encrypted_data);
     return 1;
 }
 
diff -Nru openssl-3.0.2/test/dtls_mtu_test.c openssl-3.0.3/test/dtls_mtu_test.c
--- openssl-3.0.2/test/dtls_mtu_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/dtls_mtu_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -185,12 +185,58 @@
 
  end:
     SSL_CTX_free(ctx);
-    bio_s_mempacket_test_free();
     return ret;
 }
 
+static int test_server_mtu_larger_than_max_fragment_length(void)
+{
+    SSL_CTX *ctx = NULL;
+    SSL *srvr_ssl = NULL, *clnt_ssl = NULL;
+    int rv = 0;
+
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method())))
+        goto end;
+
+    SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback);
+    SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback);
+
+#ifndef OPENSSL_NO_DH
+    if (!TEST_true(SSL_CTX_set_dh_auto(ctx, 1)))
+        goto end;
+#endif
+
+    if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl,
+                                      NULL, NULL)))
+        goto end;
+
+    SSL_set_options(srvr_ssl, SSL_OP_NO_QUERY_MTU);
+    if (!TEST_true(DTLS_set_link_mtu(srvr_ssl, 1500)))
+        goto end;
+
+    SSL_set_tlsext_max_fragment_length(clnt_ssl,
+                                       TLSEXT_max_fragment_length_512);
+
+    if (!TEST_true(create_ssl_connection(srvr_ssl, clnt_ssl,
+                                         SSL_ERROR_NONE)))
+        goto end;
+
+    rv = 1;
+
+ end:
+    SSL_free(clnt_ssl);
+    SSL_free(srvr_ssl);
+    SSL_CTX_free(ctx);
+    return rv;
+}
+
 int setup_tests(void)
 {
     ADD_TEST(run_mtu_tests);
+    ADD_TEST(test_server_mtu_larger_than_max_fragment_length);
     return 1;
 }
+
+void cleanup_tests(void)
+{
+    bio_s_mempacket_test_free();
+}
diff -Nru openssl-3.0.2/test/endecode_test.c openssl-3.0.3/test/endecode_test.c
--- openssl-3.0.2/test/endecode_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/endecode_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -143,6 +143,7 @@
 typedef void (dumper)(const char *label, const void *data, size_t data_len);
 
 #define FLAG_DECODE_WITH_TYPE   0x0001
+#define FLAG_FAIL_IF_FIPS       0x0002
 
 static int test_encode_decode(const char *file, const int line,
                               const char *type, EVP_PKEY *pkey,
@@ -166,8 +167,19 @@
      * dumping purposes.
      */
     if (!TEST_true(encode_cb(file, line, &encoded, &encoded_len, pkey, selection,
-                             output_type, output_structure, pass, pcipher))
-        || !TEST_true(check_cb(file, line, type, encoded, encoded_len))
+                             output_type, output_structure, pass, pcipher)))
+        goto end;
+
+    if ((flags & FLAG_FAIL_IF_FIPS) != 0 && is_fips) {
+        if (TEST_false(decode_cb(file, line, (void **)&pkey2, encoded,
+                                  encoded_len, output_type, output_structure,
+                                  (flags & FLAG_DECODE_WITH_TYPE ? type : NULL),
+                                  selection, pass)))
+            ok = 1;
+        goto end;
+    }
+
+    if (!TEST_true(check_cb(file, line, type, encoded, encoded_len))
         || !TEST_true(decode_cb(file, line, (void **)&pkey2, encoded, encoded_len,
                                 output_type, output_structure,
                                 (flags & FLAG_DECODE_WITH_TYPE ? type : NULL),
@@ -521,7 +533,7 @@
     return ok;
 }
 
-static int test_unprotected_via_DER(const char *type, EVP_PKEY *key)
+static int test_unprotected_via_DER(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_KEYPAIR
@@ -529,7 +541,7 @@
                               "DER", "PrivateKeyInfo", NULL, NULL,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
                               test_mem, check_unprotected_PKCS8_DER,
-                              dump_der, 0);
+                              dump_der, fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 static int check_unprotected_PKCS8_PEM(const char *file, const int line,
@@ -543,7 +555,7 @@
                         sizeof(expected_pem_header) - 1);
 }
 
-static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key)
+static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_KEYPAIR
@@ -551,7 +563,7 @@
                               "PEM", "PrivateKeyInfo", NULL, NULL,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
                               test_text, check_unprotected_PKCS8_PEM,
-                              dump_pem, 0);
+                              dump_pem, fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 #ifndef OPENSSL_NO_KEYPARAMS
@@ -698,7 +710,7 @@
     return ok;
 }
 
-static int test_protected_via_DER(const char *type, EVP_PKEY *key)
+static int test_protected_via_DER(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_KEYPAIR
@@ -707,7 +719,7 @@
                               pass, pass_cipher,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
                               test_mem, check_protected_PKCS8_DER,
-                              dump_der, 0);
+                              dump_der, fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 static int check_protected_PKCS8_PEM(const char *file, const int line,
@@ -721,7 +733,7 @@
                         sizeof(expected_pem_header) - 1);
 }
 
-static int test_protected_via_PEM(const char *type, EVP_PKEY *key)
+static int test_protected_via_PEM(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_KEYPAIR
@@ -730,7 +742,7 @@
                               pass, pass_cipher,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
                               test_text, check_protected_PKCS8_PEM,
-                              dump_pem, 0);
+                              dump_pem, fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 static int check_protected_legacy_PEM(const char *file, const int line,
@@ -791,14 +803,15 @@
     return ok;
 }
 
-static int test_public_via_DER(const char *type, EVP_PKEY *key)
+static int test_public_via_DER(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_PUBLIC_KEY
                               | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
                               "DER", "SubjectPublicKeyInfo", NULL, NULL,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
-                              test_mem, check_public_DER, dump_der, 0);
+                              test_mem, check_public_DER, dump_der,
+                              fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 static int check_public_PEM(const char *file, const int line,
@@ -812,14 +825,15 @@
                      sizeof(expected_pem_header) - 1);
 }
 
-static int test_public_via_PEM(const char *type, EVP_PKEY *key)
+static int test_public_via_PEM(const char *type, EVP_PKEY *key, int fips)
 {
     return test_encode_decode(__FILE__, __LINE__, type, key,
                               OSSL_KEYMGMT_SELECT_PUBLIC_KEY
                               | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
                               "PEM", "SubjectPublicKeyInfo", NULL, NULL,
                               encode_EVP_PKEY_prov, decode_EVP_PKEY_prov,
-                              test_text, check_public_PEM, dump_pem, 0);
+                              test_text, check_public_PEM, dump_pem,
+                              fips ? 0 : FLAG_FAIL_IF_FIPS);
 }
 
 static int check_public_MSBLOB(const char *file, const int line,
@@ -864,30 +878,30 @@
     EVP_PKEY_free(template_##KEYTYPE);                                  \
     EVP_PKEY_free(key_##KEYTYPE)
 
-#define IMPLEMENT_TEST_SUITE(KEYTYPE, KEYTYPEstr)                       \
+#define IMPLEMENT_TEST_SUITE(KEYTYPE, KEYTYPEstr, fips)                 \
     static int test_unprotected_##KEYTYPE##_via_DER(void)               \
     {                                                                   \
-        return test_unprotected_via_DER(KEYTYPEstr, key_##KEYTYPE);     \
+        return test_unprotected_via_DER(KEYTYPEstr, key_##KEYTYPE, fips); \
     }                                                                   \
     static int test_unprotected_##KEYTYPE##_via_PEM(void)               \
     {                                                                   \
-        return test_unprotected_via_PEM(KEYTYPEstr, key_##KEYTYPE);     \
+        return test_unprotected_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips); \
     }                                                                   \
     static int test_protected_##KEYTYPE##_via_DER(void)                 \
     {                                                                   \
-        return test_protected_via_DER(KEYTYPEstr, key_##KEYTYPE);       \
+        return test_protected_via_DER(KEYTYPEstr, key_##KEYTYPE, fips); \
     }                                                                   \
     static int test_protected_##KEYTYPE##_via_PEM(void)                 \
     {                                                                   \
-        return test_protected_via_PEM(KEYTYPEstr, key_##KEYTYPE);       \
+        return test_protected_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips); \
     }                                                                   \
     static int test_public_##KEYTYPE##_via_DER(void)                    \
     {                                                                   \
-        return test_public_via_DER(KEYTYPEstr, key_##KEYTYPE);          \
+        return test_public_via_DER(KEYTYPEstr, key_##KEYTYPE, fips);    \
     }                                                                   \
     static int test_public_##KEYTYPE##_via_PEM(void)                    \
     {                                                                   \
-        return test_public_via_PEM(KEYTYPEstr, key_##KEYTYPE);          \
+        return test_public_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips);    \
     }
 
 #define ADD_TEST_SUITE(KEYTYPE)                                 \
@@ -961,10 +975,10 @@
 
 #ifndef OPENSSL_NO_DH
 DOMAIN_KEYS(DH);
-IMPLEMENT_TEST_SUITE(DH, "DH")
+IMPLEMENT_TEST_SUITE(DH, "DH", 1)
 IMPLEMENT_TEST_SUITE_PARAMS(DH, "DH")
 DOMAIN_KEYS(DHX);
-IMPLEMENT_TEST_SUITE(DHX, "X9.42 DH")
+IMPLEMENT_TEST_SUITE(DHX, "X9.42 DH", 1)
 IMPLEMENT_TEST_SUITE_PARAMS(DHX, "X9.42 DH")
 /*
  * DH has no support for PEM_write_bio_PrivateKey_traditional(),
@@ -973,7 +987,7 @@
 #endif
 #ifndef OPENSSL_NO_DSA
 DOMAIN_KEYS(DSA);
-IMPLEMENT_TEST_SUITE(DSA, "DSA")
+IMPLEMENT_TEST_SUITE(DSA, "DSA", 1)
 IMPLEMENT_TEST_SUITE_PARAMS(DSA, "DSA")
 IMPLEMENT_TEST_SUITE_LEGACY(DSA, "DSA")
 IMPLEMENT_TEST_SUITE_MSBLOB(DSA, "DSA")
@@ -984,41 +998,41 @@
 #endif
 #ifndef OPENSSL_NO_EC
 DOMAIN_KEYS(EC);
-IMPLEMENT_TEST_SUITE(EC, "EC")
+IMPLEMENT_TEST_SUITE(EC, "EC", 1)
 IMPLEMENT_TEST_SUITE_PARAMS(EC, "EC")
 IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC")
 DOMAIN_KEYS(ECExplicitPrimeNamedCurve);
-IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC")
+IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC", 1)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve, "EC")
 DOMAIN_KEYS(ECExplicitPrime2G);
-IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC")
+IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC", 0)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrime2G, "EC")
 # ifndef OPENSSL_NO_EC2M
 DOMAIN_KEYS(ECExplicitTriNamedCurve);
-IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC")
+IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC", 1)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve, "EC")
 DOMAIN_KEYS(ECExplicitTri2G);
-IMPLEMENT_TEST_SUITE(ECExplicitTri2G, "EC")
+IMPLEMENT_TEST_SUITE(ECExplicitTri2G, "EC", 0)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTri2G, "EC")
 # endif
 KEYS(ED25519);
-IMPLEMENT_TEST_SUITE(ED25519, "ED25519")
+IMPLEMENT_TEST_SUITE(ED25519, "ED25519", 1)
 KEYS(ED448);
-IMPLEMENT_TEST_SUITE(ED448, "ED448")
+IMPLEMENT_TEST_SUITE(ED448, "ED448", 1)
 KEYS(X25519);
-IMPLEMENT_TEST_SUITE(X25519, "X25519")
+IMPLEMENT_TEST_SUITE(X25519, "X25519", 1)
 KEYS(X448);
-IMPLEMENT_TEST_SUITE(X448, "X448")
+IMPLEMENT_TEST_SUITE(X448, "X448", 1)
 /*
  * ED25519, ED448, X25519 and X448 have no support for
  * PEM_write_bio_PrivateKey_traditional(), so no legacy tests.
  */
 #endif
 KEYS(RSA);
-IMPLEMENT_TEST_SUITE(RSA, "RSA")
+IMPLEMENT_TEST_SUITE(RSA, "RSA", 1)
 IMPLEMENT_TEST_SUITE_LEGACY(RSA, "RSA")
 KEYS(RSA_PSS);
-IMPLEMENT_TEST_SUITE(RSA_PSS, "RSA-PSS")
+IMPLEMENT_TEST_SUITE(RSA_PSS, "RSA-PSS", 1)
 /*
  * RSA-PSS has no support for PEM_write_bio_PrivateKey_traditional(),
  * so no legacy tests.
diff -Nru openssl-3.0.2/test/evp_extra_test.c openssl-3.0.3/test/evp_extra_test.c
--- openssl-3.0.2/test/evp_extra_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/evp_extra_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -35,7 +35,6 @@
 #include "internal/nelem.h"
 #include "internal/sizes.h"
 #include "crypto/evp.h"
-#include "../e_os.h" /* strcasecmp */
 
 static OSSL_LIB_CTX *testctx = NULL;
 static char *testpropq = NULL;
@@ -1739,7 +1738,7 @@
         return 0;
 
     for (i = 0; i < OSSL_NELEM(ec_encodings); i++) {
-        if (strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) {
+        if (OPENSSL_strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) {
             *enc = ec_encodings[i].encoding;
             break;
         }
@@ -1963,6 +1962,24 @@
     if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
         goto done;
 
+    /*
+     * Try verify again with non-matching 0 length id but ensure that it can
+     * be set on the context and overrides the previous value.
+     */
+
+    if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL,
+                                        pkey)))
+        goto done;
+
+    if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, NULL, 0), 0))
+        goto done;
+
+    if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg))))
+        goto done;
+
+    if (!TEST_int_eq(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
+        goto done;
+
     /* now check encryption/decryption */
 
     gparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST,
diff -Nru openssl-3.0.2/test/evp_libctx_test.c openssl-3.0.3/test/evp_libctx_test.c
--- openssl-3.0.2/test/evp_libctx_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/evp_libctx_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -33,7 +33,6 @@
 #include "testutil.h"
 #include "internal/nelem.h"
 #include "crypto/bn_dh.h"   /* _bignum_ffdhe2048_p */
-#include "../e_os.h"        /* strcasecmp */
 
 static OSSL_LIB_CTX *libctx = NULL;
 static OSSL_PROVIDER *nullprov = NULL;
@@ -478,7 +477,7 @@
 
 static int name_cmp(const char * const *a, const char * const *b)
 {
-    return strcasecmp(*a, *b);
+    return OPENSSL_strcasecmp(*a, *b);
 }
 
 static void collect_cipher_names(EVP_CIPHER *cipher, void *cipher_names_list)
diff -Nru openssl-3.0.2/test/evp_pkey_ctx_new_from_name.c openssl-3.0.3/test/evp_pkey_ctx_new_from_name.c
--- openssl-3.0.2/test/evp_pkey_ctx_new_from_name.c	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/test/evp_pkey_ctx_new_from_name.c	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,14 @@
+#include <stdio.h>
+#include <openssl/ec.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+
+int main(int argc, char *argv[])
+{
+    EVP_PKEY_CTX *pctx = NULL;
+
+    pctx = EVP_PKEY_CTX_new_from_name(NULL, "NO_SUCH_ALGORITHM", NULL);
+    EVP_PKEY_CTX_free(pctx);
+
+    return 0;
+}
diff -Nru openssl-3.0.2/test/evp_test.c openssl-3.0.3/test/evp_test.c
--- openssl-3.0.2/test/evp_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/evp_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -12,7 +12,6 @@
 #include <string.h>
 #include <stdlib.h>
 #include <ctype.h>
-#include "../e_os.h" /* strcasecmp */
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
@@ -1133,6 +1132,8 @@
     size_t salt_len;
     /* XOF mode? */
     int xof;
+    /* Reinitialization fails */
+    int no_reinit;
     /* Collection of controls */
     STACK_OF(OPENSSL_STRING) *controls;
     /* Output size */
@@ -1245,6 +1246,8 @@
         return parse_bin(value, &mdata->output, &mdata->output_len);
     if (strcmp(keyword, "XOF") == 0)
         return mdata->xof = 1;
+    if (strcmp(keyword, "NoReinit") == 0)
+        return mdata->no_reinit = 1;
     if (strcmp(keyword, "Ctrl") == 0)
         return sk_OPENSSL_STRING_push(mdata->controls,
                                       OPENSSL_strdup(value)) != 0;
@@ -1408,6 +1411,7 @@
     const OSSL_PARAM *defined_params =
         EVP_MAC_settable_ctx_params(expected->mac);
     int xof;
+    int reinit = 1;
 
     if (expected->alg == NULL)
         TEST_info("Trying the EVP_MAC %s test", expected->mac_name);
@@ -1518,6 +1522,7 @@
             goto err;
         }
     }
+ retry:
     if (!EVP_MAC_update(ctx, expected->input, expected->input_len)) {
         t->err = "MAC_UPDATE_ERROR";
         goto err;
@@ -1552,6 +1557,39 @@
             goto err;
         }
     }
+    if (reinit--) {
+        OSSL_PARAM ivparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
+        int ret;
+
+        /* If the MAC uses IV, we have to set it again */
+        if (expected->iv != NULL) {
+            ivparams[0] =
+                OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_IV,
+                                                  expected->iv,
+                                                  expected->iv_len);
+            ivparams[1] = OSSL_PARAM_construct_end();
+        }
+        ERR_set_mark();
+        ret = EVP_MAC_init(ctx, NULL, 0, ivparams);
+        if (expected->no_reinit) {
+            if (ret) {
+                ERR_clear_last_mark();
+                t->err = "MAC_REINIT_SHOULD_FAIL";
+                goto err;
+            }
+        } else if (ret) {
+            ERR_clear_last_mark();
+            OPENSSL_free(got);
+            got = NULL;
+            goto retry;
+        } else {
+            ERR_clear_last_mark();
+            t->err = "MAC_REINIT_ERROR";
+            goto err;
+        }
+        /* If reinitialization fails, it is unsupported by the algorithm */
+        ERR_pop_to_mark();
+    }
     t->err = NULL;
 
     /* Test the EVP_Q_mac interface as well */
@@ -3886,9 +3924,9 @@
     OSSL_LIB_CTX_free(libctx);
 }
 
-#define STR_STARTS_WITH(str, pre) strncasecmp(pre, str, strlen(pre)) == 0
+#define STR_STARTS_WITH(str, pre) OPENSSL_strncasecmp(pre, str, strlen(pre)) == 0
 #define STR_ENDS_WITH(str, pre)                                                \
-strlen(str) < strlen(pre) ? 0 : (strcasecmp(pre, str + strlen(str) - strlen(pre)) == 0)
+strlen(str) < strlen(pre) ? 0 : (OPENSSL_strcasecmp(pre, str + strlen(str) - strlen(pre)) == 0)
 
 static int is_digest_disabled(const char *name)
 {
@@ -3897,31 +3935,31 @@
         return 1;
 #endif
 #ifdef OPENSSL_NO_MD2
-    if (strcasecmp(name, "MD2") == 0)
+    if (OPENSSL_strcasecmp(name, "MD2") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_MDC2
-    if (strcasecmp(name, "MDC2") == 0)
+    if (OPENSSL_strcasecmp(name, "MDC2") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_MD4
-    if (strcasecmp(name, "MD4") == 0)
+    if (OPENSSL_strcasecmp(name, "MD4") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_MD5
-    if (strcasecmp(name, "MD5") == 0)
+    if (OPENSSL_strcasecmp(name, "MD5") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_RMD160
-    if (strcasecmp(name, "RIPEMD160") == 0)
+    if (OPENSSL_strcasecmp(name, "RIPEMD160") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_SM3
-    if (strcasecmp(name, "SM3") == 0)
+    if (OPENSSL_strcasecmp(name, "SM3") == 0)
         return 1;
 #endif
 #ifdef OPENSSL_NO_WHIRLPOOL
-    if (strcasecmp(name, "WHIRLPOOL") == 0)
+    if (OPENSSL_strcasecmp(name, "WHIRLPOOL") == 0)
         return 1;
 #endif
     return 0;
diff -Nru openssl-3.0.2/test/helpers/handshake.c openssl-3.0.3/test/helpers/handshake.c
--- openssl-3.0.2/test/helpers/handshake.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/helpers/handshake.c	2022-05-03 15:32:01.000000000 +0200
@@ -1432,6 +1432,7 @@
                                  test_ctx, extra, &server_ctx_data,
                                  &server2_ctx_data, &client_ctx_data)) {
         TEST_note("configure_handshake_ctx");
+        HANDSHAKE_RESULT_free(ret);
         return NULL;
     }
 
diff -Nru openssl-3.0.2/test/helpers/ssl_test_ctx.c openssl-3.0.3/test/helpers/ssl_test_ctx.c
--- openssl-3.0.2/test/helpers/ssl_test_ctx.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/helpers/ssl_test_ctx.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -16,21 +16,17 @@
 #include "ssl_test_ctx.h"
 #include "../testutil.h"
 
-#ifdef OPENSSL_SYS_WINDOWS
-# define strcasecmp _stricmp
-#endif
-
 static const int default_app_data_size = 256;
 /* Default set to be as small as possible to exercise fragmentation. */
 static const int default_max_fragment_size = 512;
 
 static int parse_boolean(const char *value, int *result)
 {
-    if (strcasecmp(value, "Yes") == 0) {
+    if (OPENSSL_strcasecmp(value, "Yes") == 0) {
         *result = 1;
         return 1;
     }
-    else if (strcasecmp(value, "No") == 0) {
+    else if (OPENSSL_strcasecmp(value, "No") == 0) {
         *result = 0;
         return 1;
     }
diff -Nru openssl-3.0.2/test/localetest.c openssl-3.0.3/test/localetest.c
--- openssl-3.0.2/test/localetest.c	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/test/localetest.c	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,124 @@
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/x509.h>
+#include "testutil.h"
+#include "testutil/output.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <locale.h>
+#ifdef OPENSSL_SYS_WINDOWS
+# define strcasecmp _stricmp
+#else
+# include <strings.h>
+#endif
+
+int setup_tests(void)
+{
+  const unsigned char der_bytes[] = {
+  0x30, 0x82, 0x03, 0x09, 0x30, 0x82, 0x01, 0xf1, 0xa0, 0x03, 0x02, 0x01,
+  0x02, 0x02, 0x14, 0x08, 0xe0, 0x8c, 0xd3, 0xf3, 0xbf, 0x2c, 0xf2, 0x0d,
+  0x0a, 0x75, 0xd1, 0xe8, 0xea, 0xbe, 0x70, 0x61, 0xd9, 0x67, 0xf9, 0x30,
+  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
+  0x05, 0x00, 0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04,
+  0x03, 0x0c, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74,
+  0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x34, 0x31, 0x31, 0x31, 0x34,
+  0x31, 0x39, 0x35, 0x37, 0x5a, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x35, 0x31,
+  0x31, 0x31, 0x34, 0x31, 0x39, 0x35, 0x37, 0x5a, 0x30, 0x14, 0x31, 0x12,
+  0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x09, 0x6c, 0x6f, 0x63,
+  0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
+  0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82,
+  0x01, 0x01, 0x00, 0xc3, 0x1f, 0x5c, 0x56, 0x46, 0x8d, 0x69, 0xb6, 0x48,
+  0x3c, 0xbf, 0xe2, 0x0f, 0xa7, 0x4a, 0x44, 0x72, 0x74, 0x36, 0xfe, 0xe8,
+  0x2f, 0x10, 0x4a, 0xe9, 0x46, 0x45, 0x72, 0x5e, 0x48, 0xdd, 0x75, 0xab,
+  0xd9, 0x63, 0x91, 0x37, 0x93, 0x46, 0x28, 0x7e, 0x45, 0x94, 0x4b, 0x8a,
+  0xd5, 0x05, 0x2b, 0x9a, 0x01, 0x96, 0x30, 0xde, 0xcc, 0x14, 0x2d, 0x06,
+  0x09, 0x1b, 0x7d, 0x50, 0x14, 0x99, 0x36, 0x6b, 0x97, 0x6e, 0xc9, 0xb1,
+  0x69, 0x70, 0xcd, 0x9b, 0x74, 0x24, 0x9a, 0xe2, 0xd4, 0xc0, 0x1e, 0xbc,
+  0xec, 0xf6, 0x7a, 0xbb, 0xa0, 0x53, 0x93, 0xf8, 0x68, 0x9a, 0x18, 0xa1,
+  0xa1, 0x5c, 0x47, 0x93, 0xd1, 0x4c, 0x36, 0x8c, 0x00, 0xb3, 0x66, 0xda,
+  0xf1, 0x05, 0xb2, 0x3a, 0xad, 0x7e, 0x4b, 0xf3, 0xd3, 0x93, 0xfa, 0x59,
+  0x09, 0x9c, 0x60, 0x37, 0x69, 0x61, 0xe8, 0x5a, 0x33, 0xc6, 0xb2, 0x1a,
+  0xba, 0x36, 0xe2, 0xb3, 0x58, 0xe9, 0x73, 0x01, 0x2d, 0x36, 0x48, 0x36,
+  0x94, 0xe4, 0xb2, 0xa4, 0x5b, 0xdf, 0x3d, 0x5f, 0x62, 0x9f, 0xd9, 0xf3,
+  0x24, 0x0c, 0xf0, 0x2f, 0x71, 0x44, 0x79, 0x13, 0x70, 0x95, 0xa7, 0xbe,
+  0xea, 0x0a, 0x08, 0x0a, 0xa6, 0x4b, 0xe9, 0x58, 0x6b, 0xa4, 0xc2, 0xed,
+  0x74, 0x1e, 0xb0, 0x3b, 0x59, 0xd5, 0xe6, 0xdb, 0x8f, 0x58, 0x6a, 0xa3,
+  0x7d, 0x52, 0x40, 0xec, 0x72, 0xb7, 0xba, 0x7e, 0x30, 0x9d, 0x12, 0x57,
+  0xf2, 0x48, 0xae, 0x80, 0x0d, 0x0a, 0xf4, 0xfd, 0x24, 0xed, 0xd8, 0x05,
+  0xb2, 0x96, 0x44, 0x02, 0x3e, 0x6e, 0x25, 0xb0, 0xc4, 0x93, 0xda, 0xfe,
+  0x78, 0xd9, 0xbb, 0xd2, 0x71, 0x69, 0x70, 0x7f, 0xba, 0xf7, 0xb0, 0x4f,
+  0x14, 0xf7, 0x98, 0x71, 0x01, 0x6c, 0xec, 0x6f, 0x76, 0x03, 0x59, 0xff,
+  0xe2, 0xba, 0x8d, 0xd9, 0x21, 0x08, 0xb3, 0x02, 0x03, 0x01, 0x00, 0x01,
+  0xa3, 0x53, 0x30, 0x51, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04,
+  0x16, 0x04, 0x14, 0x59, 0xb8, 0x6e, 0x1a, 0x72, 0xe9, 0x27, 0x1e, 0xbf,
+  0x80, 0x87, 0x0f, 0xa9, 0xd0, 0x06, 0x6a, 0x11, 0x30, 0x77, 0x8e, 0x30,
+  0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14,
+  0x59, 0xb8, 0x6e, 0x1a, 0x72, 0xe9, 0x27, 0x1e, 0xbf, 0x80, 0x87, 0x0f,
+  0xa9, 0xd0, 0x06, 0x6a, 0x11, 0x30, 0x77, 0x8e, 0x30, 0x0f, 0x06, 0x03,
+  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01,
+  0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+  0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x98, 0x76, 0x9e,
+  0x3c, 0xfc, 0x3f, 0x58, 0xe8, 0xf2, 0x1f, 0x2e, 0x11, 0xa2, 0x59, 0xfa,
+  0x27, 0xb5, 0xec, 0x9d, 0x97, 0x05, 0x06, 0x2c, 0x95, 0xa5, 0x28, 0x88,
+  0x86, 0xeb, 0x4e, 0x8a, 0x62, 0xe9, 0x87, 0x78, 0xd8, 0x18, 0x22, 0x4e,
+  0xb1, 0x8d, 0x46, 0x4a, 0x4c, 0x6e, 0x7c, 0x53, 0x62, 0x2c, 0xf2, 0x7a,
+  0x95, 0xa0, 0x1a, 0x30, 0x18, 0x6a, 0x31, 0x6f, 0x3f, 0x55, 0x25, 0x9f,
+  0x67, 0x60, 0x68, 0x99, 0x0f, 0x41, 0x09, 0xc8, 0xe2, 0x04, 0x33, 0x22,
+  0x1a, 0xe9, 0xf3, 0xae, 0xce, 0xb6, 0x83, 0x64, 0x78, 0x66, 0x14, 0xc9,
+  0x54, 0xc8, 0x34, 0x70, 0x96, 0xaf, 0x16, 0xcd, 0xb8, 0xdf, 0x81, 0x7e,
+  0xf0, 0xa6, 0x7d, 0xc1, 0x13, 0xb2, 0x76, 0x3a, 0xd5, 0x7e, 0x68, 0x8c,
+  0xd5, 0x00, 0x70, 0x82, 0x23, 0x7e, 0x5e, 0xc9, 0x31, 0x2f, 0x33, 0x54,
+  0xaa, 0xaf, 0xcd, 0xe9, 0x38, 0x9a, 0x23, 0x53, 0xad, 0x4e, 0x72, 0xa7,
+  0x6f, 0x47, 0x60, 0xc9, 0xd3, 0x06, 0x9b, 0x7a, 0x21, 0xc6, 0xe9, 0xdb,
+  0x3c, 0xaa, 0xc0, 0x21, 0x29, 0x5f, 0x44, 0x6a, 0x45, 0x90, 0x73, 0x5e,
+  0x6d, 0x78, 0x82, 0xcb, 0x42, 0xe6, 0xba, 0x67, 0xb2, 0xe6, 0xa2, 0x15,
+  0x04, 0xea, 0x69, 0xae, 0x3e, 0xc0, 0x0c, 0x10, 0x99, 0xec, 0xa9, 0xb0,
+  0x7e, 0xe8, 0x94, 0xe2, 0xf3, 0xaf, 0xf7, 0x9f, 0x65, 0xe7, 0xd7, 0xe2,
+  0x49, 0xfa, 0x52, 0x7d, 0xb5, 0xfd, 0xa0, 0xa5, 0xe0, 0x49, 0xa7, 0x3d,
+  0x94, 0x20, 0x2d, 0xec, 0x8c, 0x22, 0xa5, 0xa4, 0x43, 0xfa, 0x7e, 0xd0,
+  0x50, 0x21, 0xb8, 0x67, 0x18, 0x44, 0x69, 0x8f, 0xdd, 0x47, 0x41, 0xc6,
+  0x35, 0xe0, 0xe9, 0x2e, 0x41, 0xa9, 0x6f, 0x41, 0xee, 0xb9, 0xbd, 0x45,
+  0xf3, 0x88, 0xc1, 0x23, 0x35, 0x96, 0xba, 0xf8, 0xcd, 0x4b, 0x83, 0x73,
+  0x5f
+};
+
+    char str1[] = "SubjectPublicKeyInfo", str2[] = "subjectpublickeyinfo";
+    int res;
+    X509 *cert = NULL;
+    X509_PUBKEY *cert_pubkey = NULL;
+    const unsigned char *p = der_bytes;
+
+    if (setlocale(LC_ALL, "") == NULL)
+        return TEST_skip("Cannot set the locale necessary for test");
+
+    res = strcasecmp(str1, str2);
+    TEST_note("Case-insensitive comparison via strcasecmp in current locale %s\n", res ? "failed" : "succeeded");
+
+    if (!TEST_false(OPENSSL_strcasecmp(str1, str2)))
+        return 0;
+
+    cert = d2i_X509(NULL, &p, sizeof(der_bytes));
+    if (!TEST_ptr(cert))
+        return 0;
+
+    cert_pubkey = X509_get_X509_PUBKEY(cert);
+    if (!TEST_ptr(cert_pubkey)) {
+        X509_free(cert);
+        return 0;
+    }
+
+    if (!TEST_ptr(X509_PUBKEY_get0(cert_pubkey))) {
+        X509_free(cert);
+        return 0;
+    }
+
+    X509_free(cert);
+    return 1;
+}
+
+void cleanup_tests(void)
+{
+}
diff -Nru openssl-3.0.2/test/params_conversion_test.c openssl-3.0.3/test/params_conversion_test.c
--- openssl-3.0.2/test/params_conversion_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/params_conversion_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -15,10 +15,6 @@
 /* On machines that dont support <inttypes.h> just disable the tests */
 #if !defined(OPENSSL_NO_INTTYPES_H)
 
-# ifdef OPENSSL_SYS_WINDOWS
-#  define strcasecmp _stricmp
-# endif
-
 # ifdef OPENSSL_SYS_VMS
 #  define strtoumax strtoull
 #  define strtoimax strtoll
@@ -62,7 +58,7 @@
 
     for (i = 0; i < s->numpairs; i++, pp++) {
         p = "";
-        if (strcasecmp(pp->key, "type") == 0) {
+        if (OPENSSL_strcasecmp(pp->key, "type") == 0) {
             if (type != NULL) {
                 TEST_info("Line %d: multiple type lines", s->curr);
                 return 0;
@@ -72,48 +68,48 @@
                 TEST_info("Line %d: unknown type line", s->curr);
                 return 0;
             }
-        } else if (strcasecmp(pp->key, "int32") == 0) {
+        } else if (OPENSSL_strcasecmp(pp->key, "int32") == 0) {
             if (def_i32++) {
                 TEST_info("Line %d: multiple int32 lines", s->curr);
                 return 0;
             }
-            if (strcasecmp(pp->value, "invalid") != 0) {
+            if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) {
                 pc->valid_i32 = 1;
                 pc->i32 = (int32_t)strtoimax(pp->value, &p, 10);
             }
-        } else if (strcasecmp(pp->key, "int64") == 0) {
+        } else if (OPENSSL_strcasecmp(pp->key, "int64") == 0) {
             if (def_i64++) {
                 TEST_info("Line %d: multiple int64 lines", s->curr);
                 return 0;
             }
-            if (strcasecmp(pp->value, "invalid") != 0) {
+            if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) {
                 pc->valid_i64 = 1;
                 pc->i64 = (int64_t)strtoimax(pp->value, &p, 10);
             }
-        } else if (strcasecmp(pp->key, "uint32") == 0) {
+        } else if (OPENSSL_strcasecmp(pp->key, "uint32") == 0) {
             if (def_u32++) {
                 TEST_info("Line %d: multiple uint32 lines", s->curr);
                 return 0;
             }
-            if (strcasecmp(pp->value, "invalid") != 0) {
+            if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) {
                 pc->valid_u32 = 1;
                 pc->u32 = (uint32_t)strtoumax(pp->value, &p, 10);
             }
-        } else if (strcasecmp(pp->key, "uint64") == 0) {
+        } else if (OPENSSL_strcasecmp(pp->key, "uint64") == 0) {
             if (def_u64++) {
                 TEST_info("Line %d: multiple uint64 lines", s->curr);
                 return 0;
             }
-            if (strcasecmp(pp->value, "invalid") != 0) {
+            if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) {
                 pc->valid_u64 = 1;
                 pc->u64 = (uint64_t)strtoumax(pp->value, &p, 10);
             }
-        } else if (strcasecmp(pp->key, "double") == 0) {
+        } else if (OPENSSL_strcasecmp(pp->key, "double") == 0) {
             if (def_d++) {
                 TEST_info("Line %d: multiple double lines", s->curr);
                 return 0;
             }
-            if (strcasecmp(pp->value, "invalid") != 0) {
+            if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) {
                 pc->valid_d = 1;
                 pc->d = strtod(pp->value, &p);
             }
@@ -133,7 +129,7 @@
         return 0;
     }
 
-    if (strcasecmp(type, "int32") == 0) {
+    if (OPENSSL_strcasecmp(type, "int32") == 0) {
         if (!TEST_true(def_i32) || !TEST_true(pc->valid_i32)) {
             TEST_note("errant int32 on line %d", s->curr);
             return 0;
@@ -142,7 +138,7 @@
         pc->datum = &datum_i32;
         pc->ref = &ref_i32;
         pc->size = sizeof(ref_i32);
-    } else if (strcasecmp(type, "int64") == 0) {
+    } else if (OPENSSL_strcasecmp(type, "int64") == 0) {
         if (!TEST_true(def_i64) || !TEST_true(pc->valid_i64)) {
             TEST_note("errant int64 on line %d", s->curr);
             return 0;
@@ -151,7 +147,7 @@
         pc->datum = &datum_i64;
         pc->ref = &ref_i64;
         pc->size = sizeof(ref_i64);
-    } else if (strcasecmp(type, "uint32") == 0) {
+    } else if (OPENSSL_strcasecmp(type, "uint32") == 0) {
         if (!TEST_true(def_u32) || !TEST_true(pc->valid_u32)) {
             TEST_note("errant uint32 on line %d", s->curr);
             return 0;
@@ -160,7 +156,7 @@
         pc->datum = &datum_u32;
         pc->ref = &ref_u32;
         pc->size = sizeof(ref_u32);
-    } else if (strcasecmp(type, "uint64") == 0) {
+    } else if (OPENSSL_strcasecmp(type, "uint64") == 0) {
         if (!TEST_true(def_u64) || !TEST_true(pc->valid_u64)) {
             TEST_note("errant uint64 on line %d", s->curr);
             return 0;
@@ -169,7 +165,7 @@
         pc->datum = &datum_u64;
         pc->ref = &ref_u64;
         pc->size = sizeof(ref_u64);
-    } else if (strcasecmp(type, "double") == 0) {
+    } else if (OPENSSL_strcasecmp(type, "double") == 0) {
         if (!TEST_true(def_d) || !TEST_true(pc->valid_d)) {
             TEST_note("errant double on line %d", s->curr);
             return 0;
diff -Nru openssl-3.0.2/test/provider_test.c openssl-3.0.3/test/provider_test.c
--- openssl-3.0.2/test/provider_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/provider_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -191,12 +191,15 @@
          * In this case we assume we've been built with "no-legacy" and skip
          * this test (there is no OPENSSL_NO_LEGACY)
          */
+        OSSL_LIB_CTX_free(libctx);
         return 1;
     }
 
     if (!TEST_true(OSSL_PROVIDER_add_builtin(libctx, name,
-                                             PROVIDER_INIT_FUNCTION_NAME)))
+                                             PROVIDER_INIT_FUNCTION_NAME))) {
+        OSSL_LIB_CTX_free(libctx);
         return 0;
+    }
 
     /* test_provider will free libctx and unload legacy as part of the test */
     return test_provider(&libctx, name, legacy);
diff -Nru openssl-3.0.2/test/recipes/02-test_localetest.t openssl-3.0.3/test/recipes/02-test_localetest.t
--- openssl-3.0.2/test/recipes/02-test_localetest.t	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/test/recipes/02-test_localetest.t	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,26 @@
+#! /usr/bin/env perl
+# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright (c) 2017, Oracle and/or its affiliates.  All rights reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use OpenSSL::Test;
+use OpenSSL::Test::Utils;
+
+setup("locale tests");
+
+plan skip_all => "Locale tests not available on Windows or VMS"
+    if $^O =~ /^(VMS|MSWin32)$/;
+
+plan tests => 3;
+
+ok(run(test(["evp_pkey_ctx_new_from_name"])), "running evp_pkey_ctx_new_from_name without explicit context init");
+
+$ENV{LANG} = "C";
+ok(run(test(["localetest"])), "running localetest");
+
+$ENV{LANG} = "tr_TR.UTF-8";
+ok(run(test(["localetest"])), "running localetest with Turkish locale");
diff -Nru openssl-3.0.2/test/recipes/03-test_fipsinstall.t openssl-3.0.3/test/recipes/03-test_fipsinstall.t
--- openssl-3.0.2/test/recipes/03-test_fipsinstall.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/03-test_fipsinstall.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -27,7 +27,7 @@
 plan tests => 29;
 
 my $infile = bldtop_file('providers', platform->dso('fips'));
-my $fipskey = $ENV{FIPSKEY} // '00';
+my $fipskey = $ENV{FIPSKEY} // config('FIPSKEY') // '00';
 
 # Read in a text $infile and replace the regular expression in $srch with the
 # value in $repl and output to a new file $outfile.
diff -Nru openssl-3.0.2/test/recipes/15-test_ecparam.t openssl-3.0.3/test/recipes/15-test_ecparam.t
--- openssl-3.0.2/test/recipes/15-test_ecparam.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/15-test_ecparam.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -13,7 +13,7 @@
 use File::Spec;
 use File::Compare qw/compare_text/;
 use OpenSSL::Glob;
-use OpenSSL::Test qw/:DEFAULT data_file/;
+use OpenSSL::Test qw/:DEFAULT data_file srctop_file bldtop_dir/;
 use OpenSSL::Test::Utils;
 
 setup("test_ecparam");
@@ -25,7 +25,7 @@
 my @noncanon = glob(data_file("noncanon", "*.pem"));
 my @invalid = glob(data_file("invalid", "*.pem"));
 
-plan tests => 11;
+plan tests => 12;
 
 sub checkload {
     my $files = shift; # List of files
@@ -59,6 +59,8 @@
     }
 }
 
+my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
+
 subtest "Check loading valid parameters by ecparam with -check" => sub {
     plan tests => scalar(@valid);
     checkload(\@valid, 1, "ecparam", "-check");
@@ -113,3 +115,31 @@
     plan tests => 2 * scalar(@valid);
     checkcompare(\@valid, "pkeyparam");
 };
+
+subtest "Check loading of fips and non-fips params" => sub {
+    plan skip_all => "FIPS is disabled"
+        if $no_fips;
+    plan tests => 3;
+
+    my $fipsconf = srctop_file("test", "fips-and-base.cnf");
+    my $defaultconf = srctop_file("test", "default.cnf");
+
+    $ENV{OPENSSL_CONF} = $fipsconf;
+
+    ok(run(app(['openssl', 'ecparam',
+                '-in', data_file('valid', 'secp384r1-explicit.pem'),
+                '-check'])),
+       "Loading explicitly encoded valid curve");
+
+    ok(run(app(['openssl', 'ecparam',
+                '-in', data_file('valid', 'secp384r1-named.pem'),
+                '-check'])),
+       "Loading named valid curve");
+
+    ok(!run(app(['openssl', 'ecparam',
+                '-in', data_file('valid', 'secp112r1-named.pem'),
+                '-check'])),
+       "Fail loading named non-fips curve");
+
+    $ENV{OPENSSL_CONF} = $defaultconf;
+};
diff -Nru openssl-3.0.2/test/recipes/15-test_rsapss.t openssl-3.0.3/test/recipes/15-test_rsapss.t
--- openssl-3.0.2/test/recipes/15-test_rsapss.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/15-test_rsapss.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -16,7 +16,7 @@
 
 setup("test_rsapss");
 
-plan tests => 7;
+plan tests => 9;
 
 #using test/testrsa.pem which happens to be a 512 bit RSA
 ok(run(app(['openssl', 'dgst', '-sign', srctop_file('test', 'testrsa.pem'), '-sha1',
@@ -64,3 +64,13 @@
             '-signature', 'testrsapss-unrestricted.sig',
             srctop_file('test', 'testrsa.pem')])),
    "openssl dgst -prverify [plain RSA key, PSS padding mode, no PSS restrictions]");
+
+# Test that RSA-PSS keys are supported by genpkey and rsa commands.
+{
+   my $rsapss = "rsapss.key";
+   ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA-PSS',
+               '-pkeyopt', 'rsa_keygen_bits:1024',
+               '--out', $rsapss])));
+   ok(run(app(['openssl', 'rsa', '-check',
+               '-in', $rsapss])));
+}
diff -Nru openssl-3.0.2/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt openssl-3.0.3/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt
--- openssl-3.0.2/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt	2022-05-03 15:32:01.000000000 +0200
@@ -124,25 +124,3 @@
 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f
 Ciphertext = 261cd0c88a4d4e6db7fc263257a9f6d0ce83c1ff5f2680dc57ffd8eefdbb9c00d3d507672d105a990b2b78509978625b9d93c2bd41e3fb721abd1496553c583c67dad9b662b3d58c8540e10ed9c5ed1a7f33ce9e9a41c30836651d73ee2c003af03a919eb41a6d70ef814e184e740f8a96221b924d9d025ef5e7150d4ca76921a025dd146fef87da738877313f11ec8f4c558b878c28ce6a9a5011d70f58c5dbd3412cf0a32154f5a4286958a5a50a86f15119835ceccf432601e4cc688cdd682ac9620500b60c0760bb93209859823778a7f2b5bab1af259bda13d84f952af9d2f07f500dadedc41a2b6a737a1296e0b2fb96ac4da4bf71fe2f0c4a1b6fc4dd251087e4c03d2e28c85a9b4a835ef166b48e5b7690f332a1d8db7bd9380221891f31ee82f4b8dd9ebf540cab583a0f33
 NextIV = 1f31ee82f4b8dd9ebf540cab583a0f33
-
-Title = RC4-HMAC-MD5 test vectors
-
-Availablein = legacy
-Cipher = RC4-HMAC-MD5
-Key = d48ecc0a163a06626bd1b7e172dfb5b3
-MACKey = 5973581f63768353af37d3f51ec9f6ef
-TLSAAD = 90a1b2c3e4f506172803010050
-TLSVersion = 0x0301
-Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
-Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
-Operation = ENCRYPT
-
-Availablein = legacy
-Cipher = RC4-HMAC-MD5
-Key = d48ecc0a163a06626bd1b7e172dfb5b3
-MACKey = 5973581f63768353af37d3f51ec9f6ef
-TLSAAD = 90a1b2c3e4f506172803010060
-TLSVersion = 0x0301
-Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
-Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
-Operation = DECRYPT
diff -Nru openssl-3.0.2/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt openssl-3.0.3/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt
--- openssl-3.0.2/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt	2022-05-03 15:32:01.000000000 +0200
@@ -7,7 +7,7 @@
 TLSAAD = 90a1b2c3e4f506172803010050
 TLSVersion = 0x0301
 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
-Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
+Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716
 # DECRYPT must be a separate entry due to change in TLSAAD value
 Operation = ENCRYPT
 
@@ -18,5 +18,5 @@
 TLSAAD = 90a1b2c3e4f506172803010060
 TLSVersion = 0x0301
 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
-Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c
+Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716
 Operation = DECRYPT
diff -Nru openssl-3.0.2/test/recipes/30-test_evp_data/evpmac_poly1305.txt openssl-3.0.3/test/recipes/30-test_evp_data/evpmac_poly1305.txt
--- openssl-3.0.2/test/recipes/30-test_evp_data/evpmac_poly1305.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/30-test_evp_data/evpmac_poly1305.txt	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #
-# Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -17,51 +17,60 @@
 Key = 0000000000000000000000000000000000000000000000000000000000000000
 Input = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
 Output = 00000000000000000000000000000000
+NoReinit = 1
 
 MAC = Poly1305
 Key = 0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e
 Input = 416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f
 Output = 36e5f6b5c5e06070f0efca96227a863e
+NoReinit = 1
 
 MAC = Poly1305
 Key = 36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000
 Input = 416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f
 Output = f3477e7cd95417af89a6b8794c310cf0
+NoReinit = 1
 
 MAC = Poly1305
 Key = 1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0
 Input = 2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e
 Output = 4541669a7eaaee61e708dc7cbcc5eb62
+NoReinit = 1
 
 # If one uses 130-bit partial reduction, does the code handle the case where partially reduced final result is not fully reduced?
 MAC = Poly1305
 Key = 0200000000000000000000000000000000000000000000000000000000000000
 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
 Output = 03000000000000000000000000000000
+NoReinit = 1
 
 # What happens if addition of s overflows modulo 2^128?
 MAC = Poly1305
 Key = 02000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
 Input = 02000000000000000000000000000000
 Output = 03000000000000000000000000000000
+NoReinit = 1
 
 # What happens if data limb is all ones and there is carry from lower limb?
 MAC = Poly1305
 Key = 0100000000000000000000000000000000000000000000000000000000000000
 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11000000000000000000000000000000
 Output = 05000000000000000000000000000000
+NoReinit = 1
 
 # What happens if final result from polynomial part is exactly 2^130-5?
 MAC = Poly1305
 Key = 0100000000000000000000000000000000000000000000000000000000000000
 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE01010101010101010101010101010101
 Output = 00000000000000000000000000000000
+NoReinit = 1
 
 # What happens if final result from polynomial part is exactly 2^130-6?
 MAC = Poly1305
 Key = 0200000000000000000000000000000000000000000000000000000000000000
 Input = FDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
 Output = FAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
+NoReinit = 1
 
 # Taken from poly1305_internal_test.c
 # More RFC7539
@@ -70,6 +79,7 @@
 Input = 43727970746f6772617068696320466f72756d2052657365617263682047726f7570
 Key = 85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b
 Output = a8061dc1305136c6c22b8baf0c0127a9
+NoReinit = 1
 
 # test vectors from "The Poly1305-AES message-authentication code"
 
@@ -77,22 +87,26 @@
 Input = f3f6
 Key = 851fc40c3467ac0be05cc20404f3f700580b3b0f9447bb1e69d095b5928b6dbc
 Output = f4c633c3044fc145f84f335cb81953de
+NoReinit = 1
 
 # No input?
 # # MAC = Poly1305
 # Input =
 # Key = a0f3080000f46400d0c7e9076c834403dd3fab2251f11ac759f0887129cc2ee7
 # Output = dd3fab2251f11ac759f0887129cc2ee7
+# NoReinit = 1
 
 MAC = Poly1305
 Input = 663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136
 Key = 48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef
 Output = 0ee1c16bb73f0f4fd19881753c01cdbe
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = 5154ad0d2cb26e01274fc51148491f1b
+NoReinit = 1
 
 # self-generated vectors exercise "significant" length such that* are handled by different code paths
 
@@ -100,46 +114,55 @@
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = 812059a5da198637cac7c4a631bee466
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = 5b88d7f6228b11e2e28579a5c0c1f761
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = bbb613b2b6d753ba07395b916aaece15
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = c794d7057d1778c4bbee0a39b3d97342
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = ffbcb9b371423152d7fca5ad042fbaa9
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee466
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = 069ed6b8ef0f207b3e243bb1019fe632
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = cca339d9a45fa2368c2c68b3a4179133
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = 53f6e828a2f0fe0ee815bf0bd5841a34
+NoReinit = 1
 
 MAC = Poly1305
 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761
 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57
 Output = b846d44e9bbd53cedffbfbb6b7fa4933
+NoReinit = 1
 
 # 4th power of the key spills to 131th bit in SIMD key setup
 
@@ -147,6 +170,7 @@
 Input = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
 Key = ad628107e8351d0f2c231a05dc4a410600000000000000000000000000000000
 Output = 07145a4c02fe5fa32036de68fabe9066
+NoReinit = 1
 
 # poly1305_ieee754.c failed this in final stage
 
@@ -154,6 +178,7 @@
 Input = 842364e156336c0998b933a6237726180d9e3fdcbde4cd5d17080fc3beb49614d7122c037463ff104d73f19c12704628d417c4c54a3fe30d3c3d7714382d43b0382a50a5dee54be844b076e8df88201a1cd43b90eb21643fa96f39b518aa8340c942ff3c31baf7c9bdbf0f31ae3fa096bf8c63030609829fe72e179824890bc8e08c315c1cce2a83144dbbff09f74e3efc770b54d0984a8f19b14719e63635641d6b1eedf63efbf080e1783d32445412114c20de0b837a0dfa33d6b82825fff44c9a70ea54ce47f07df698e6b03323b53079364a5fc3e9dd034392bdde86dccdda94321c5e44060489336cb65bf3989c36f7282c2f5d2b882c171e74
 Key = 95d5c005503e510d8cd0aa072c4a4d066eabc52d11653df47fbf63ab198bcc26
 Output = f248312e578d9d58f8b7bb4d19105431
+NoReinit = 1
 
 # AVX2 in poly1305-x86.pl failed this with 176+32 split
 
@@ -161,6 +186,7 @@
 Input = 248ac31085b6c2adaaa38259a0d7192c5c35d1bb4ef39ad94c38d1c82479e2dd2159a077024b0589bc8a20101b506f0a1ad0bbab76e83a83f1b94be6beae74e874cab692c5963a75436b776121ec9f62399a3e66b2d22707dae81933b6277f3c8516bcbe26dbbd86f373103d7cf4cad1888c952118fbfbd0d7b4bedc4ae4936aff91157e7aa47c54442ea78d6ac251d324a0fbe49d89cc3521b66d16e9c66a3709894e4eb0a4eedc4ae19468e66b81f271351b1d921ea551047abcc6b87a901fde7db79fa1818c11336dbc07244a40eb
 Key = 000102030405060708090a0b0c0d0e0f00000000000000000000000000000000
 Output = bc939bc5281480fa99c6d68c258ec42f
+NoReinit = 1
 
 # test vectors from Google
 
@@ -169,26 +195,31 @@
 # Input =
 # Key = c8afaac331ee372cd6082de134943b174710130e9f6fea8d72293850a667d86c
 # Output = 4710130e9f6fea8d72293850a667d86c
+# NoReinit = 1
 
 MAC = Poly1305
 Input = 48656c6c6f20776f726c6421
 Key = 746869732069732033322d62797465206b657920666f7220506f6c7931333035
 Output = a6f745008f81c916a20dcc74eef2b2f0
+NoReinit = 1
 
 MAC = Poly1305
 Input = 0000000000000000000000000000000000000000000000000000000000000000
 Key = 746869732069732033322d62797465206b657920666f7220506f6c7931333035
 Output = 49ec78090e481ec6c26b33b91ccc0307
+NoReinit = 1
 
 MAC = Poly1305
 Input = 89dab80b7717c1db5db437860a3f70218e93e1b8f461fb677f16f35f6f87e2a91c99bc3a47ace47640cc95c345be5ecca5a3523c35cc01893af0b64a620334270372ec12482d1b1e363561698a578b359803495bb4e2ef1930b17a5190b580f141300df30adbeca28f6427a8bc1a999fd51c554a017d095d8c3e3127daf9f595
 Key = 2d773be37adb1e4d683bf0075e79c4ee037918535a7f99ccb7040fb5f5f43aea
 Output = c85d15ed44c378d6b00e23064c7bcd51
+NoReinit = 1
 
 MAC = Poly1305
 Input = 000000000000000b170303020000000006db1f1f368d696a810a349c0c714c9a5e7850c2407d721acded95e018d7a85266a6e1289cdb4aeb18da5ac8a2b0026d24a59ad485227f3eaedbb2e7e35e1c66cd60f9abf716dcc9ac42682dd7dab287a7024c4eefc321cc0574e16793e37cec03c5bda42b54c114a80b57af26416c7be742005e20855c73e21dc8e2edc9d435cb6f6059280011c270b71570051c1c9b3052126620bc1e2730fa066c7a509d53c60e5ae1b40aa6e39e49669228c90eecb4a50db32a50bc49e90b4f4b359a1dfd11749cd3867fcf2fb7bb6cd4738f6a4ad6f7ca5058f7618845af9f020f6c3b967b8f4cd4a91e2813b507ae66f2d35c18284f7292186062e10fd5510d18775351ef334e7634ab4743f5b68f49adcab384d3fd75f7390f4006ef2a295c8c7a076ad54546cd25d2107fbe1436c840924aaebe5b370893cd63d1325b8616fc4810886bc152c53221b6df373119393255ee72bcaa880174f1717f9184fa91646f17a24ac55d16bfddca9581a92eda479201f0edbf633600d6066d1ab36d5d2415d71351bbcd608a25108d25641992c1f26c531cf9f90203bc4cc19f5927d834b0a47116d3884bbb164b8ec883d1ac832e56b3918a98601a08d171881541d594db399c6ae6151221745aec814c45b0b05b565436fd6f137aa10a0c0b643761dbd6f9a9dcb99b1a6e690854ce0769cde39761d82fcdec15f0d92d7d8e94ade8eb83fbe0
 Key = 99e5822dd4173c995e3dae0ddefb97743fde3b080134b39f76e9bf8d0e88d546
 Output = 2637408fe13086ea73f971e3425e2820
+NoReinit = 1
 
 # test vectors from Hanno Bock
 
@@ -196,26 +227,31 @@
 Input = cccccccccccccccccccccccccccccccccccccccccccccccccc80ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccceccccccccccccccccccccccccccccccccccccc5cccccccccccccccccccccccccccccccccccccccccce3ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccaccccccccccccccccccccce6cccccccccc000000afccccccccccccccccccfffffff5000000000000000000000000000000000000000000000000000000ffffffe70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000719205a8521dfc
 Key = 7f1b02640000000000000000000000000000000000000000cccccccccccccccc
 Output = 8559b876eceed66eb37798c0457baff9
+NoReinit = 1
 
 MAC = Poly1305
 Input = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa000000000000000000800264
 Key = e00016000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaa
 Output = 00bd1258978e205444c9aaaa82006fed
+NoReinit = 1
 
 MAC = Poly1305
 Input = 02fc
 Key = 0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
 Output = 06120c0c0c0c0c0c0c0c0c0c0c0c0c0c
+NoReinit = 1
 
 MAC = Poly1305
 Input = 7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7a7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b5c7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6e7b007b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7a7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b5c7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6e7b001300000000b300000000000000000000000000000000000000000000f20000000000000000000000000000000000002000efff0009000000000000000000000000100000000009000000640000000000000000000000001300000000b300000000000000000000000000000000000000000000f20000000000000000000000000000000000002000efff00090000000000000000007a000010000000000900000064000000000000000000000000000000000000000000000000fc
 Key = 00ff000000000000000000000000000000000000001e00000000000000007b7b
 Output = 33205bbf9e9f8f7212ab9e2ab9b7e4a5
+NoReinit = 1
 
 MAC = Poly1305
 Input = 77777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777ffffffe9e9acacacacacacacacacacac0000acacec0100acacac2caca2acacacacacacacacacacac64f2
 Key = 0000007f0000007f01000020000000000000cf77777777777777777777777777
 Output = 02ee7c8c546ddeb1a467e4c3981158b9
+NoReinit = 1
 
 # test vectors from Andrew Moon - nacl
 
@@ -223,48 +259,56 @@
 Input = 8e993b9f48681273c29650ba32fc76ce48332ea7164d96a4476fb8c531a1186ac0dfc17c98dce87b4da7f011ec48c97271d2c20f9b928fe2270d6fb863d51738b48eeee314a7cc8ab932164548e526ae90224368517acfeabd6bb3732bc0e9da99832b61ca01b6de56244a9e88d5f9b37973f622a43d14a6599b1f654cb45a74e355a5
 Key = eea6a7251c1e72916d11c2cb214d3c252539121d8e234e652d651fa4c8cff880
 Output = f3ffc7703f9400e52a7dfb4b3d3305d9
+NoReinit = 1
 
 # wrap 2^130-5
 MAC = Poly1305
 Input = ffffffffffffffffffffffffffffffff
 Key = 0200000000000000000000000000000000000000000000000000000000000000
 Output = 03000000000000000000000000000000
+NoReinit = 1
 
 # wrap 2^128
 MAC = Poly1305
 Input = 02000000000000000000000000000000
 Key = 02000000000000000000000000000000ffffffffffffffffffffffffffffffff
 Output = 03000000000000000000000000000000
+NoReinit = 1
 
 # limb carry
 MAC = Poly1305
 Input = fffffffffffffffffffffffffffffffff0ffffffffffffffffffffffffffffff11000000000000000000000000000000
 Key = 0100000000000000000000000000000000000000000000000000000000000000
 Output = 05000000000000000000000000000000
+NoReinit = 1
 
 # 2^130-5
 MAC = Poly1305
 Input = fffffffffffffffffffffffffffffffffbfefefefefefefefefefefefefefefe01010101010101010101010101010101
 Key = 0100000000000000000000000000000000000000000000000000000000000000
 Output = 00000000000000000000000000000000
+NoReinit = 1
 
 # 2^130-6
 MAC = Poly1305
 Input = fdffffffffffffffffffffffffffffff
 Key = 0200000000000000000000000000000000000000000000000000000000000000
 Output = faffffffffffffffffffffffffffffff
+NoReinit = 1
 
 # 5*H+L reduction intermediate
 MAC = Poly1305
 Input = e33594d7505e43b900000000000000003394d7505e4379cd01000000000000000000000000000000000000000000000001000000000000000000000000000000
 Key = 0100000000000000040000000000000000000000000000000000000000000000
 Output = 14000000000000005500000000000000
+NoReinit = 1
 
 # 5*H+L reduction final
 MAC = Poly1305
 Input = e33594d7505e43b900000000000000003394d7505e4379cd010000000000000000000000000000000000000000000000
 Key = 0100000000000000040000000000000000000000000000000000000000000000
 Output = 13000000000000000000000000000000
+NoReinit = 1
 
 # Here are 4 duplicated cases for Poly1305 by EVP_PKEY
 MAC = Poly1305 by EVP_PKEY
diff -Nru openssl-3.0.2/test/recipes/70-test_tls13hrr.t openssl-3.0.3/test/recipes/70-test_tls13hrr.t
--- openssl-3.0.2/test/recipes/70-test_tls13hrr.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/70-test_tls13hrr.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -37,7 +37,8 @@
 
 use constant {
     CHANGE_HRR_CIPHERSUITE => 0,
-    CHANGE_CH1_CIPHERSUITE => 1
+    CHANGE_CH1_CIPHERSUITE => 1,
+    DUPLICATE_HRR => 2
 };
 
 #Test 1: A client should fail if the server changes the ciphersuite between the
@@ -50,7 +51,7 @@
 }
 my $testtype = CHANGE_HRR_CIPHERSUITE;
 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
-plan tests => 2;
+plan tests => 3;
 ok(TLSProxy::Message->fail(), "Server ciphersuite changes");
 
 #Test 2: It is an error if the client changes the offered ciphersuites so that
@@ -66,6 +67,19 @@
 $proxy->start();
 ok(TLSProxy::Message->fail(), "Client ciphersuite changes");
 
+#Test 3: A client should fail with unexpected_message alert if the server
+#        sends more than 1 HRR
+my $fatal_alert = 0;
+$proxy->clear();
+if (disabled("ec")) {
+    $proxy->serverflags("-curves ffdhe3072");
+} else {
+    $proxy->serverflags("-curves P-256");
+}
+$testtype = DUPLICATE_HRR;
+$proxy->start();
+ok($fatal_alert, "Server duplicated HRR");
+
 sub hrr_filter
 {
     my $proxy = shift;
@@ -86,6 +100,39 @@
         return;
     }
 
+    if ($testtype == DUPLICATE_HRR) {
+        # We're only interested in the HRR
+        # and the unexpected_message alert from client
+        if ($proxy->flight == 4) {
+            $fatal_alert = 1
+                if @{$proxy->record_list}[-1]->is_fatal_alert(0) == 10;
+            return;
+        }
+        if ($proxy->flight != 3) {
+            return;
+        }
+
+        # Find ServerHello record (HRR actually) and insert after that
+        my $i;
+        for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
+            next;
+        }
+        my $hrr_record = ${$proxy->record_list}[$i];
+        my $dup_hrr = TLSProxy::Record->new(3,
+            $hrr_record->content_type(),
+            $hrr_record->version(),
+            $hrr_record->len(),
+            $hrr_record->sslv2(),
+            $hrr_record->len_real(),
+            $hrr_record->decrypt_len(),
+            $hrr_record->data(),
+            $hrr_record->decrypt_data());
+
+        $i++;
+        splice @{$proxy->record_list}, $i, 0, $dup_hrr;
+        return;
+    }
+
     # CHANGE_CH1_CIPHERSUITE
     if ($proxy->flight != 0) {
         return;
Binary files /tmp/9_taQ3JHlR/openssl-3.0.2/test/recipes/80-test_cmsapi_data/encryptedData.der and /tmp/fsBZvQ1B_c/openssl-3.0.3/test/recipes/80-test_cmsapi_data/encryptedData.der differ
diff -Nru openssl-3.0.2/test/recipes/80-test_cmsapi.t openssl-3.0.3/test/recipes/80-test_cmsapi.t
--- openssl-3.0.2/test/recipes/80-test_cmsapi.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/80-test_cmsapi.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -17,5 +17,6 @@
 plan tests => 1;
 
 ok(run(test(["cmsapitest", srctop_file("test", "certs", "servercert.pem"),
-             srctop_file("test", "certs", "serverkey.pem")])),
+             srctop_file("test", "certs", "serverkey.pem"),
+             srctop_file("test", "recipes", "80-test_cmsapi_data", "encryptedData.der")])),
              "running cmsapitest");
diff -Nru openssl-3.0.2/test/recipes/80-test_ocsp.t openssl-3.0.3/test/recipes/80-test_ocsp.t
--- openssl-3.0.2/test/recipes/80-test_ocsp.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/80-test_ocsp.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -35,6 +35,7 @@
         $untrusted = $CAfile;
     }
     my $expected_exit = shift;
+    my $nochecks = shift;
     my $outputfile = basename($inputfile, '.ors') . '.dat';
 
     run(app(["openssl", "base64", "-d",
@@ -45,7 +46,8 @@
                            "-partial_chain", @check_time,
                            "-CAfile", catfile($ocspdir, $CAfile),
                            "-verify_other", catfile($ocspdir, $untrusted),
-                           "-no-CApath", "-no-CAstore"])),
+                           "-no-CApath", "-no-CAstore",
+                           $nochecks ? "-no_cert_checks" : ()])),
                   $title); });
 }
 
@@ -55,143 +57,149 @@
     plan tests => 7;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
+              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "ND2.ors", "ND2_Issuer_Root.pem", "", 0);
+              "ND2.ors", "ND2_Issuer_Root.pem", "", 0, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "ND3.ors", "ND3_Issuer_Root.pem", "", 0);
+              "ND3.ors", "ND3_Issuer_Root.pem", "", 0, 0);
     test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
-              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
+              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "D1.ors", "D1_Issuer_ICA.pem", "", 0);
+              "D1.ors", "D1_Issuer_ICA.pem", "", 0, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "D2.ors", "D2_Issuer_Root.pem", "", 0);
+              "D2.ors", "D2_Issuer_Root.pem", "", 0, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "D3.ors", "D3_Issuer_Root.pem", "", 0);
+              "D3.ors", "D3_Issuer_Root.pem", "", 0, 0);
 };
 
 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
+              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
+              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
+              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
+              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
+              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
+              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
+              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
+              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
+              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
+              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
+              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
+              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
     plan tests => 3;
 
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
-    plan tests => 3;
+    plan tests => 6;
 
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
+    test_ocsp("DELEGATED; Root CA -> Intermediate CA",
+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
+    test_ocsp("DELEGATED; Root CA -> EE",
+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
+    test_ocsp("DELEGATED; Intermediate CA -> EE",
+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 1);
 };
 
 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
+              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
+              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
+              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
+              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
+              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
+              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
+              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
+              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
+              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
+              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
+              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
+              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1, 0);
 };
 
 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
@@ -199,17 +207,17 @@
 
     # Expect success, because we're explicitly trusting the issuer certificate.
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
+              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0, 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
+              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0, 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
+              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0, 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
+              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0, 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
+              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0, 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
+              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0);
 };
 
 subtest "=== OCSP API TESTS===" => sub {
diff -Nru openssl-3.0.2/test/recipes/90-test_sslapi_data/dhparams.pem openssl-3.0.3/test/recipes/90-test_sslapi_data/dhparams.pem
--- openssl-3.0.2/test/recipes/90-test_sslapi_data/dhparams.pem	1970-01-01 01:00:00.000000000 +0100
+++ openssl-3.0.3/test/recipes/90-test_sslapi_data/dhparams.pem	2022-05-03 15:32:01.000000000 +0200
@@ -0,0 +1,122 @@
+-----BEGIN PKCS7-----
+MIIIGAYJKoZIhvcNAQcCoIIICTCCCAUCAQExADALBgkqhkiG9w0BBwGgggY8MIIE
+cjCCBBygAwIBAgIQeS+OJfWJUZAx6cX0eAiMjzANBgkqhkiG9w0BAQQFADBiMREw
+DwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNV
+BAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIw
+HhcNOTYwNzE5MDAwMDAwWhcNOTcwMzMwMjM1OTU5WjCB1TERMA8GA1UEBxMISW50
+ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2ln
+biBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMSgwJgYDVQQLEx9E
+aWdpdGFsIElEIENsYXNzIDEgLSBTTUlNRSBUZXN0MUcwRQYDVQQLEz53d3cudmVy
+aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEuMCBJbmMuIGJ5IFJlZi4sTElBQi5M
+VEQoYyk5NjBbMA0GCSqGSIb3DQEBAQUAA0oAMEcCQA7LvHEIAiQ5+4gDYvJGnGAq
+UM5GXyG11diEXmIEZTHUZhorooX5sr8IIjSXiPY59YYUFSvAaharFM1xaBN8zNEC
+AwEAAaOCAjkwggI1MAkGA1UdEwQCMAAwggImBgNVHQMEggIdMIICGTCCAhUwggIR
+BgtghkgBhvhFAQcBATCCAgAWggGrVGhpcyBjZXJ0aWZpY2F0ZSBpbmNvcnBvcmF0
+ZXMgYnkgcmVmZXJlbmNlLCBhbmQgaXRzIHVzZSBpcyBzdHJpY3RseSBzdWJqZWN0
+IHRvLCB0aGUgVmVyaVNpZ24gQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1l
+bnQgKENQUyksIGF2YWlsYWJsZSBhdDogaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t
+L0NQUy0xLjA7IGJ5IEUtbWFpbCBhdCBDUFMtcmVxdWVzdHNAdmVyaXNpZ24uY29t
+OyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMuLCAyNTkzIENvYXN0IEF2ZS4s
+IE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBUZWwuICsxICg0MTUpIDk2MS04
+ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2lnbiwgSW5jLiAgQWxsIFJpZ2h0
+cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVTIERJU0NMQUlNRUQgYW5kIExJ
+QUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcBAQGhDgYMYIZIAYb4RQEHAQEC
+MC8wLRYraHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEu
+AzANBgkqhkiG9w0BAQQFAANBAMCYDuSb/eIlYSxY31nZZTaCZkCSfHjlacMofExr
+cF+A2yHoEuT+eCQkqM0pMNHXddUeoQ9RjV+VuMBNmm63DUYwggHCMIIBbKADAgEC
+AhB8CYTq1bkRFJBYOd67cp9JMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT
+MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD
+QTAeFw05NjA3MTcwMDAwMDBaFw05NzA3MTcyMzU5NTlaMGIxETAPBgNVBAcTCElu
+dGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNp
+Z24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjBcMA0GCSqGSIb3
+DQEBAQUAA0sAMEgCQQDsVzrNgnDhbAJZrWeLd9g1vMZJA2W67D33TTbga6yMt+ES
+TWEywhS6RNP+fzLGg7utinjH4tL60cXa0G27GDsLAgMBAAGjIjAgMAsGA1UdDwQE
+AwIBBjARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQECBQADQQAUp6bRwkaD
+2d1MBs/mjUcgTI2fXVmW8tTm/Ud6OzUwpC3vYgybiOOA4f6mOC5dbyUHrLOsrihU
+47ZQ0Jo1DUfboYIBrTCBwTBtMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT
+MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD
+QRcNOTYwNzE3MTc0NDA5WhcNOTgwNzE3MDAwMDAwWjANBgkqhkiG9w0BAQIFAANB
+AHitA0/xAukCjHzeh1AMT/l2oC68N+yFb+aJPHBBMxc6gG2MaKjBNwb5hcXUllMl
+ExONA3ju10f7owIq3s3wx10wgeYwgZEwDQYJKoZIhvcNAQECBQAwYjERMA8GA1UE
+BxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytW
+ZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyFw05NjA3
+MTcxNzU5MjlaFw05NzA3MTgwMDAwMDBaMA0GCSqGSIb3DQEBAgUAA0EAubVWYTsW
+sQmste9f+UgMw8BkjDlM25fwQLrCfmmnLxjewey10kSROypUaJLb+r4oRALc0fG9
+XfZsaiiIgotQHjEA
+-----END PKCS7-----
+-----BEGIN CERTIFICATE-----
+MIIHBzCCBO+gAwIBAgIRAIx3oACP9NGwxj2fOkiDjWswDQYJKoZIhvcNAQEMBQAw
+fTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSUwIwYDVQQD
+ExxTZWN0aWdvIFJTQSBUaW1lIFN0YW1waW5nIENBMB4XDTIwMTAyMzAwMDAwMFoX
+DTMyMDEyMjIzNTk1OVowgYQxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy
+IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28g
+TGltaXRlZDEsMCoGA1UEAwwjU2VjdGlnbyBSU0EgVGltZSBTdGFtcGluZyBTaWdu
+ZXIgIzIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCRh0ssi8HxHqCe
+0wfGAcpSsL55eV0JZgYtLzV9u8D7J9pCalkbJUzq70DWmn4yyGqBfbRcPlYQgTU6
+IjaM+/ggKYesdNAbYrw/ZIcCX+/FgO8GHNxeTpOHuJreTAdOhcxwxQ177MPZ45fp
+yxnbVkVs7ksgbMk+bP3wm/Eo+JGZqvxawZqCIDq37+fWuCVJwjkbh4E5y8O3Os2f
+UAQfGpmkgAJNHQWoVdNtUoCD5m5IpV/BiVhgiu/xrM2HYxiOdMuEh0FpY4G89h+q
+fNfBQc6tq3aLIIDULZUHjcf1CxcemuXWmWlRx06mnSlv53mTDTJjU67MximKIMFg
+xvICLMT5yCLf+SeCoYNRwrzJghohhLKXvNSvRByWgiKVKoVUrvH9Pkl0dPyOrj+l
+cvTDWgGqUKWLdpUbZuvv2t+ULtka60wnfUwF9/gjXcRXyCYFevyBI19UCTgqYtWq
+yt/tz1OrH/ZEnNWZWcVWZFv3jlIPZvyYP0QGE2Ru6eEVYFClsezPuOjJC77FhPfd
+Cp3avClsPVbtv3hntlvIXhQcua+ELXei9zmVN29OfxzGPATWMcV+7z3oUX5xrSR0
+Gyzc+Xyq78J2SWhi1Yv1A9++fY4PNnVGW5N2xIPugr4srjcS8bxWw+StQ8O3ZpZe
+lDL6oPariVD6zqDzCIEa0USnzPe4MQIDAQABo4IBeDCCAXQwHwYDVR0jBBgwFoAU
+GqH4YRkgD8NBd0UojtE1XwYSBFUwHQYDVR0OBBYEFGl1N3u7nTVCTr9X05rbnwHR
+rt7QMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoG
+CCsGAQUFBwMIMEAGA1UdIAQ5MDcwNQYMKwYBBAGyMQECAQMIMCUwIwYIKwYBBQUH
+AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMEQGA1UdHwQ9MDswOaA3oDWGM2h0
+dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1JTQVRpbWVTdGFtcGluZ0NBLmNy
+bDB0BggrBgEFBQcBAQRoMGYwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQuc2VjdGln
+by5jb20vU2VjdGlnb1JTQVRpbWVTdGFtcGluZ0NBLmNydDAjBggrBgEFBQcwAYYX
+aHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEMBQADggIBAEoDeJBC
+M+x7GoMJNjOYVbudQAYwa0Vq8ZQOGVD/WyVeO+E5xFu66ZWQNze93/tk7OWCt5XM
+V1VwS070qIfdIoWmV7u4ISfUoCoxlIoHIZ6Kvaca9QIVy0RQmYzsProDd6aCApDC
+LpOpviE0dWO54C0PzwE3y42i+rhamq6hep4TkxlVjwmQLt/qiBcW62nW4SW9RQiX
+gNdUIChPynuzs6XSALBgNGXE48XDpeS6hap6adt1pD55aJo2i0OuNtRhcjwOhWIN
+oF5w22QvAcfBoccklKOyPG6yXqLQ+qjRuCUcFubA1X9oGsRlKTUqLYi86q501oLn
+wIi44U948FzKwEBcwp/VMhws2jysNvcGUpqjQDAXsCkWmcmqt4hJ9+gLJTO1P22v
+n18KVt8SscPuzpF36CAT6Vwkx+pEC0rmE4QcTesNtbiGoDCni6GftCzMwBYjyZHl
+QgNLgM7kTeYqAT7AXoWgJKEXQNXb2+eYEKTx6hkbgFT6R4nomIGpdcAO39BolHmh
+oJ6OtrdCZsvZ2WsvTdjePjIeIOTsnE1CjZ3HM5mCN0TUJikmQI54L7nu+i/x8Y/+
+ULh43RSW3hwOcLAqhWqxbGjpKuQQK24h/dN8nTfkKgbWw/HXaONPB3mBCBP+smRe
+6bE85tB4I7IJLOImYr87qZdRzMdEMoGyr8/f
+-----END CERTIFICATE-----
+-----BEGIN DH PARAMETERS-----
+MIIBDAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAgICB/8=
+-----END DH PARAMETERS-----
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDNAIHqeyrh6gbV
+n3xz2f+5SglhXC5Lp8Y2zvCN01M+wxhVJbAVx2m5mnfWclv5w1Mqm25fZifV+4UW
+B2jT3anL01l0URcX3D0wnS/EfuQfl+Mq23+d2GShxHZ6Zm7NcbwarPXnUX9LOFlP
+6psF5C1a2pkSAIAT5FMWpNm7jtCGuI0odYusr5ItRqhotIXSOcm66w4rZFknEPQr
+LR6gpLSALAvsqzKPimiwBzvbVG/uqYCdKEmRKzkMFTK8finHZY+BdfrkbzQzL/h7
+yrPkBkm5hXeGnaDqcYNT8HInVIhpE2SHYNEivmduD8SD3SD/wxvalqMZZsmqLnWt
+A95H4cRPAgMBAAECggEAYCl6x5kbFnoG1rJHWLjL4gi+ubLZ7Jc4vYD5Ci41AF3X
+ziktnim6iFvTFv7x8gkTvArJDWsICLJBTYIQREHYYkozzgIzyPeApIs3Wv8C12cS
+IopwJITbP56+zM+77hcJ26GCgA2Unp5CFuC/81WDiPi9kNo3Oh2CdD7D+90UJ/0W
+glplejFpEuhpU2URfKL4RckJQF/KxV+JX8FdIDhsJu54yemQdQKaF4psHkzwwgDo
+qc+yfp0Vb4bmwq3CKxqEoc1cpbJ5CHXXlAfISzUjlcuBzD/tW7BDtp7eDAcgRVAC
+XO6MX0QBcLYSC7SOD3R7zY9SIRCFDfBDxCjf0YcFMQKBgQD2+WG0fLwDXTrt68fe
+hQqVa2Xs25z2B2QGPxWqSFU8WNly/mZ1BW413f3De/O58vYi7icTNyVoScm+8hdv
+6PfD+LuRujdN1TuvPeyBTSvewQwf3IjN0Wh28mse36PwlBl+301C/x+ylxEDuJjK
+hZxCcocIaoQqtBC7ac8tNa9r4wKBgQDUfnJKf/QQSLJwwlJKQQGHi3MVm7c9PbwY
+eyIOY1s1NPluJDoYTZP4YLa/u2txwe2aHh9FhYMCPDAelqaSwaCLU9DsnKkQEA2A
+RR47fcagG6xK7O+N95iEa8I1oIy7os9MBoBMwRIZ6VYIxxTj8UMNSR+tu6MqV1Gg
+T5d0WDTJpQKBgCHyRSu5uV39AoyRS/eZ8cp36JqV1Q08FtOE+EVfi9evnrPfo9WR
+2YQt7yNfdjCo5IwIj/ZkLhAXlFNakz4el2+oUJ/HKLLaDEoaCNf883q6rh/zABrK
+HcG7sF2d/7qhoJ9/se7zgjfZ68zHIrkzhDbd5xGREnmMJoCcGo3sQyBhAoGAH3UQ
+qmLC2N5KPFMoJ4H0HgLQ6LQCrnhDLkScSBEBYaEUA/AtAYgKjcyTgVLXlyGkcRpg
+esRHHr+WSBD5W+R6ReYEmeKfTJdzyDdzQE9gZjdyjC0DUbsDwybIu3OnIef6VEDq
+IXK7oUZfzDDcsNn4mTDoFaoff5cpqFfgDgM43VkCgYBNHw11b+d+AQmaZS9QqIt7
+aF3FvwCYHV0jdv0Mb+Kc1bY4c0R5MFpzrTwVmdOerjuuA1+9b+0Hwo3nBZM4eaBu
+SOamA2hu2OJWCl9q8fLCT69KqWDjghhvFe7c6aJJGucwaA3Uz3eLcPqoaCarMiNH
+fMkTd7GabVourqIZdgvu1Q==
+-----END PRIVATE KEY-----
diff -Nru openssl-3.0.2/test/recipes/90-test_sslapi.t openssl-3.0.3/test/recipes/90-test_sslapi.t
--- openssl-3.0.2/test/recipes/90-test_sslapi.t	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/recipes/90-test_sslapi.t	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -32,14 +32,22 @@
 ok(run(test(["sslapitest", srctop_dir("test", "certs"),
              srctop_file("test", "recipes", "90-test_sslapi_data",
                          "passwd.txt"), $tmpfilename, "default",
-             srctop_file("test", "default.cnf")])),
+             srctop_file("test", "default.cnf"),
+             srctop_file("test",
+                         "recipes",
+                         "90-test_sslapi_data",
+                         "dhparams.pem")])),
              "running sslapitest");
 
 unless ($no_fips) {
     ok(run(test(["sslapitest", srctop_dir("test", "certs"),
                  srctop_file("test", "recipes", "90-test_sslapi_data",
                              "passwd.txt"), $tmpfilename, "fips",
-                 srctop_file("test", "fips-and-base.cnf")])),
+                 srctop_file("test", "fips-and-base.cnf"),
+                 srctop_file("test",
+                             "recipes",
+                             "90-test_sslapi_data",
+                             "dhparams.pem")])),
                  "running sslapitest");
 }
 
diff -Nru openssl-3.0.2/test/siphash_internal_test.c openssl-3.0.3/test/siphash_internal_test.c
--- openssl-3.0.2/test/siphash_internal_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/siphash_internal_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -262,8 +262,10 @@
 
     /* Use invalid hash size */
     return TEST_int_eq(SipHash_set_hash_size(&siphash, 4), 0)
+           && TEST_false(SipHash_Final(&siphash, output, 0))
            /* Use hash size = 8 */
            && TEST_true(SipHash_set_hash_size(&siphash, 8))
+           && TEST_false(SipHash_Final(&siphash, output, 8))
            && TEST_true(SipHash_Init(&siphash, key, 0, 0))
            && TEST_true(SipHash_Final(&siphash, output, 8))
            && TEST_int_eq(SipHash_Final(&siphash, output, 16), 0)
diff -Nru openssl-3.0.2/test/sslapitest.c openssl-3.0.3/test/sslapitest.c
--- openssl-3.0.2/test/sslapitest.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/sslapitest.c	2022-05-03 15:32:01.000000000 +0200
@@ -94,6 +94,7 @@
 static char *privkey8192 = NULL;
 static char *srpvfile = NULL;
 static char *tmpfilename = NULL;
+static char *dhfile = NULL;
 
 static int is_fips = 0;
 
@@ -9384,6 +9385,68 @@
     SSL_CTX_free(cctx);
     return testresult;
 }
+
+/*
+ * Test that the lifetime hint of a TLSv1.3 ticket is no more than 1 week
+ * 0 = TLSv1.2
+ * 1 = TLSv1.3
+ */
+static int test_ticket_lifetime(int idx)
+{
+    SSL_CTX *cctx = NULL, *sctx = NULL;
+    SSL *clientssl = NULL, *serverssl = NULL;
+    int testresult = 0;
+    int version = TLS1_3_VERSION;
+
+#define ONE_WEEK_SEC (7 * 24 * 60 * 60)
+#define TWO_WEEK_SEC (2 * ONE_WEEK_SEC)
+
+    if (idx == 0) {
+#ifdef OPENSSL_NO_TLS1_2
+        return TEST_skip("TLS 1.2 is disabled.");
+#else
+        version = TLS1_2_VERSION;
+#endif
+    }
+
+    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
+                                       TLS_client_method(), version, version,
+                                       &sctx, &cctx, cert, privkey)))
+        goto end;
+
+    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
+                                      &clientssl, NULL, NULL)))
+        goto end;
+
+    /*
+     * Set the timeout to be more than 1 week
+     * make sure the returned value is the default
+     */
+    if (!TEST_long_eq(SSL_CTX_set_timeout(sctx, TWO_WEEK_SEC),
+                      SSL_get_default_timeout(serverssl)))
+        goto end;
+
+    if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
+        goto end;
+
+    if (idx == 0) {
+        /* TLSv1.2 uses the set value */
+        if (!TEST_ulong_eq(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), TWO_WEEK_SEC))
+            goto end;
+    } else {
+        /* TLSv1.3 uses the limited value */
+        if (!TEST_ulong_le(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), ONE_WEEK_SEC))
+            goto end;
+    }
+    testresult = 1;
+
+end:
+    SSL_free(serverssl);
+    SSL_free(clientssl);
+    SSL_CTX_free(sctx);
+    SSL_CTX_free(cctx);
+    return testresult;
+}
 #endif
 /*
  * Test that setting an ALPN does not violate RFC
@@ -9457,6 +9520,172 @@
     return testresult;
 }
 
+/*
+ * Test SSL_CTX_set1_verify/chain_cert_store and SSL_CTX_get_verify/chain_cert_store.
+ */
+static int test_set_verify_cert_store_ssl_ctx(void)
+{
+   SSL_CTX *ctx = NULL;
+   int testresult = 0;
+   X509_STORE *store = NULL, *new_store = NULL,
+              *cstore = NULL, *new_cstore = NULL;
+
+   /* Create an initial SSL_CTX. */
+   ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
+   if (!TEST_ptr(ctx))
+       goto end;
+
+   /* Retrieve verify store pointer. */
+   if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
+       goto end;
+
+   /* Retrieve chain store pointer. */
+   if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
+       goto end;
+
+   /* We haven't set any yet, so this should be NULL. */
+   if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
+       goto end;
+
+   /* Create stores. We use separate stores so pointers are different. */
+   new_store = X509_STORE_new();
+   if (!TEST_ptr(new_store))
+       goto end;
+
+   new_cstore = X509_STORE_new();
+   if (!TEST_ptr(new_cstore))
+       goto end;
+
+   /* Set stores. */
+   if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, new_store)))
+       goto end;
+
+   if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, new_cstore)))
+       goto end;
+
+   /* Should be able to retrieve the same pointer. */
+   if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
+       goto end;
+
+   if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
+       goto end;
+
+   if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore))
+       goto end;
+
+   /* Should be able to unset again. */
+   if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, NULL)))
+       goto end;
+
+   if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, NULL)))
+       goto end;
+
+   /* Should now be NULL. */
+   if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
+       goto end;
+
+   if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
+       goto end;
+
+   if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
+       goto end;
+
+   testresult = 1;
+
+end:
+   X509_STORE_free(new_store);
+   X509_STORE_free(new_cstore);
+   SSL_CTX_free(ctx);
+   return testresult;
+}
+
+/*
+ * Test SSL_set1_verify/chain_cert_store and SSL_get_verify/chain_cert_store.
+ */
+static int test_set_verify_cert_store_ssl(void)
+{
+   SSL_CTX *ctx = NULL;
+   SSL *ssl = NULL;
+   int testresult = 0;
+   X509_STORE *store = NULL, *new_store = NULL,
+              *cstore = NULL, *new_cstore = NULL;
+
+   /* Create an initial SSL_CTX. */
+   ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
+   if (!TEST_ptr(ctx))
+       goto end;
+
+   /* Create an SSL object. */
+   ssl = SSL_new(ctx);
+   if (!TEST_ptr(ssl))
+       goto end;
+
+   /* Retrieve verify store pointer. */
+   if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
+       goto end;
+
+   /* Retrieve chain store pointer. */
+   if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
+       goto end;
+
+   /* We haven't set any yet, so this should be NULL. */
+   if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
+       goto end;
+
+   /* Create stores. We use separate stores so pointers are different. */
+   new_store = X509_STORE_new();
+   if (!TEST_ptr(new_store))
+       goto end;
+
+   new_cstore = X509_STORE_new();
+   if (!TEST_ptr(new_cstore))
+       goto end;
+
+   /* Set stores. */
+   if (!TEST_true(SSL_set1_verify_cert_store(ssl, new_store)))
+       goto end;
+
+   if (!TEST_true(SSL_set1_chain_cert_store(ssl, new_cstore)))
+       goto end;
+
+   /* Should be able to retrieve the same pointer. */
+   if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
+       goto end;
+
+   if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
+       goto end;
+
+   if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore))
+       goto end;
+
+   /* Should be able to unset again. */
+   if (!TEST_true(SSL_set1_verify_cert_store(ssl, NULL)))
+       goto end;
+
+   if (!TEST_true(SSL_set1_chain_cert_store(ssl, NULL)))
+       goto end;
+
+   /* Should now be NULL. */
+   if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
+       goto end;
+
+   if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
+       goto end;
+
+   if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
+       goto end;
+
+   testresult = 1;
+
+end:
+   X509_STORE_free(new_store);
+   X509_STORE_free(new_cstore);
+   SSL_free(ssl);
+   SSL_CTX_free(ctx);
+   return testresult;
+}
+
+
 static int test_inherit_verify_param(void)
 {
     int testresult = 0;
@@ -9498,7 +9727,42 @@
     return testresult;
 }
 
-OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config\n")
+static int test_load_dhfile(void)
+{
+#ifndef OPENSSL_NO_DH
+    int testresult = 0;
+
+    SSL_CTX *ctx = NULL;
+    SSL_CONF_CTX *cctx = NULL;
+
+    if (dhfile == NULL)
+        return 1;
+
+    if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_client_method()))
+        || !TEST_ptr(cctx = SSL_CONF_CTX_new()))
+        goto end;
+
+    SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);
+    SSL_CONF_CTX_set_flags(cctx,
+                           SSL_CONF_FLAG_CERTIFICATE
+                           | SSL_CONF_FLAG_SERVER
+                           | SSL_CONF_FLAG_FILE);
+
+    if (!TEST_int_eq(SSL_CONF_cmd(cctx, "DHParameters", dhfile), 2))
+        goto end;
+
+    testresult = 1;
+end:
+    SSL_CONF_CTX_free(cctx);
+    SSL_CTX_free(ctx);
+
+    return testresult;
+#else
+    return TEST_skip("DH not supported by this build");
+#endif
+}
+
+OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config dhfile\n")
 
 int setup_tests(void)
 {
@@ -9528,7 +9792,8 @@
             || !TEST_ptr(srpvfile = test_get_argument(1))
             || !TEST_ptr(tmpfilename = test_get_argument(2))
             || !TEST_ptr(modulename = test_get_argument(3))
-            || !TEST_ptr(configfile = test_get_argument(4)))
+            || !TEST_ptr(configfile = test_get_argument(4))
+            || !TEST_ptr(dhfile = test_get_argument(5)))
         return 0;
 
     if (!TEST_true(OSSL_LIB_CTX_load_config(libctx, configfile)))
@@ -9754,10 +10019,14 @@
 #endif
 #ifndef OSSL_NO_USABLE_TLS1_3
     ADD_TEST(test_sni_tls13);
+    ADD_ALL_TESTS(test_ticket_lifetime, 2);
 #endif
     ADD_TEST(test_inherit_verify_param);
     ADD_TEST(test_set_alpn);
+    ADD_TEST(test_set_verify_cert_store_ssl_ctx);
+    ADD_TEST(test_set_verify_cert_store_ssl);
     ADD_ALL_TESTS(test_session_timeout, 1);
+    ADD_TEST(test_load_dhfile);
     return 1;
 
  err:
diff -Nru openssl-3.0.2/test/ssl_old_test.c openssl-3.0.3/test/ssl_old_test.c
--- openssl-3.0.2/test/ssl_old_test.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/ssl_old_test.c	2022-05-03 15:32:01.000000000 +0200
@@ -216,7 +216,7 @@
 
     if (servername) {
         if (s_ctx2 != NULL && sn_server2 != NULL &&
-            !strcasecmp(servername, sn_server2)) {
+            !OPENSSL_strcasecmp(servername, sn_server2)) {
             BIO_printf(bio_stdout, "Switching server context.\n");
             SSL_set_SSL_CTX(s, s_ctx2);
         }
diff -Nru openssl-3.0.2/test/v3nametest.c openssl-3.0.3/test/v3nametest.c
--- openssl-3.0.2/test/v3nametest.c	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/test/v3nametest.c	2022-05-03 15:32:01.000000000 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2012-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -15,10 +15,6 @@
 #include "internal/nelem.h"
 #include "testutil.h"
 
-#ifdef OPENSSL_SYS_WINDOWS
-# define strcasecmp _stricmp
-#endif
-
 static const char *const names[] = {
     "a", "b", ".", "*", "@",
     ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
@@ -287,7 +283,7 @@
     int failed = 0;
 
     for (; *pname != NULL; ++pname) {
-        int samename = strcasecmp(nameincert, *pname) == 0;
+        int samename = OPENSSL_strcasecmp(nameincert, *pname) == 0;
         size_t namelen = strlen(*pname);
         char *name = OPENSSL_malloc(namelen + 1);
         int match, ret;
diff -Nru openssl-3.0.2/tools/c_rehash.in openssl-3.0.3/tools/c_rehash.in
--- openssl-3.0.2/tools/c_rehash.in	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/tools/c_rehash.in	2022-05-03 15:32:01.000000000 +0200
@@ -1,7 +1,7 @@
 #!{- $config{HASHBANGPERL} -}
 {- use OpenSSL::Util; -}
 # {- join("\n# ", @autowarntext) -}
-# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -152,6 +152,23 @@
     return ($is_cert, $is_crl);
 }
 
+sub compute_hash {
+    my $fh;
+    if ( $^O eq "VMS" ) {
+        # VMS uses the open through shell
+        # The file names are safe there and list form is unsupported
+        if (!open($fh, "-|", join(' ', @_))) {
+            print STDERR "Cannot compute hash on '$fname'\n";
+            return;
+        }
+    } else {
+        if (!open($fh, "-|", @_)) {
+            print STDERR "Cannot compute hash on '$fname'\n";
+            return;
+        }
+    }
+    return (<$fh>, <$fh>);
+}
 
 # Link a certificate to its subject name hash value, each hash is of
 # the form <hash>.<n> where n is an integer. If the hash value already exists
@@ -161,10 +178,12 @@
 
 sub link_hash_cert {
     my $fname = $_[0];
-    $fname =~ s/\"/\\\"/g;
-    my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;
+    my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash,
+                                       "-fingerprint", "-noout",
+                                       "-in", $fname);
     chomp $hash;
     chomp $fprint;
+    return if !$hash;
     $fprint =~ s/^.*=//;
     $fprint =~ tr/://d;
     my $suffix = 0;
@@ -202,10 +221,12 @@
 
 sub link_hash_crl {
     my $fname = $_[0];
-    $fname =~ s/'/'\\''/g;
-    my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;
+    my ($hash, $fprint) = compute_hash($openssl, "crl", $crlhash,
+                                       "-fingerprint", "-noout",
+                                       "-in", $fname);
     chomp $hash;
     chomp $fprint;
+    return if !$hash;
     $fprint =~ s/^.*=//;
     $fprint =~ tr/://d;
     my $suffix = 0;
diff -Nru openssl-3.0.2/util/libcrypto.num openssl-3.0.3/util/libcrypto.num
--- openssl-3.0.2/util/libcrypto.num	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/util/libcrypto.num	2022-05-03 15:32:01.000000000 +0200
@@ -5425,3 +5425,5 @@
 ASN1_TIME_print_ex                      5553	3_0_0	EXIST::FUNCTION:
 EVP_PKEY_get0_provider                  5554	3_0_0	EXIST::FUNCTION:
 EVP_PKEY_CTX_get0_provider              5555	3_0_0	EXIST::FUNCTION:
+OPENSSL_strcasecmp                      5556	3_0_3	EXIST::FUNCTION:
+OPENSSL_strncasecmp                     5557	3_0_3	EXIST::FUNCTION:
diff -Nru openssl-3.0.2/util/markdownlint.rb openssl-3.0.3/util/markdownlint.rb
--- openssl-3.0.2/util/markdownlint.rb	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/util/markdownlint.rb	2022-05-03 15:32:01.000000000 +0200
@@ -5,8 +5,9 @@
 
 # Use --- and === for H1 and H2.
 rule 'MD003', :style => :setext_with_atx
-# Code blocks are indented
-rule 'MD046', :style => :indented
+# Code blocks may be fenced or indented, both are OK...
+# but they must be consistent throughout each file.
+rule 'MD046', :style => :consistent
 
 # Bug in mdl, https://github.com/markdownlint/markdownlint/issues/313
 exclude_rule 'MD007'
diff -Nru openssl-3.0.2/util/missingssl.txt openssl-3.0.3/util/missingssl.txt
--- openssl-3.0.2/util/missingssl.txt	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/util/missingssl.txt	2022-05-03 15:32:01.000000000 +0200
@@ -9,12 +9,9 @@
 SSL_CTX_get0_certificate(3)
 SSL_CTX_get0_ctlog_store(3)
 SSL_CTX_get0_privatekey(3)
-SSL_CTX_get_ssl_method(3)
 SSL_CTX_set0_ctlog_store(3)
 SSL_CTX_set_client_cert_engine(3)
 SSL_CTX_set_not_resumable_session_callback(3)
-SSL_CTX_set_purpose(3)
-SSL_CTX_set_trust(3)
 SSL_SRP_CTX_free(3)
 SSL_SRP_CTX_init(3)
 SSL_add_ssl_module(3)
@@ -29,11 +26,9 @@
 SSL_set_SSL_CTX(3)
 SSL_set_debug(3)
 SSL_set_not_resumable_session_callback(3)
-SSL_set_purpose(3)
 SSL_set_session_secret_cb(3)
 SSL_set_session_ticket_ext(3)
 SSL_set_session_ticket_ext_cb(3)
-SSL_set_trust(3)
 SSL_srp_server_param_with_username(3)
 SSL_test_functions(3)
 SSL_trace(3)
diff -Nru openssl-3.0.2/util/other.syms openssl-3.0.3/util/other.syms
--- openssl-3.0.2/util/other.syms	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/util/other.syms	2022-05-03 15:32:01.000000000 +0200
@@ -459,6 +459,8 @@
 SSL_CTX_disable_ct                      define
 SSL_CTX_generate_session_ticket_fn      define
 SSL_CTX_get0_chain_certs                define
+SSL_CTX_get0_chain_cert_store           define
+SSL_CTX_get0_verify_cert_store          define
 SSL_CTX_get_default_read_ahead          define
 SSL_CTX_get_extra_chain_certs           define
 SSL_CTX_get_extra_chain_certs_only      define
@@ -531,6 +533,8 @@
 SSL_disable_ct                          define
 SSL_get0_chain_certs                    define
 SSL_get0_session                        define
+SSL_get0_chain_cert_store               define
+SSL_get0_verify_cert_store              define
 SSL_get1_curves                         define
 SSL_get1_groups                         define
 SSL_get_cipher                          define
diff -Nru openssl-3.0.2/VERSION.dat openssl-3.0.3/VERSION.dat
--- openssl-3.0.2/VERSION.dat	2022-03-15 15:30:24.000000000 +0100
+++ openssl-3.0.3/VERSION.dat	2022-05-03 15:32:01.000000000 +0200
@@ -1,7 +1,7 @@
 MAJOR=3
 MINOR=0
-PATCH=2
+PATCH=3
 PRE_RELEASE_TAG=
 BUILD_METADATA=
-RELEASE_DATE="15 Mar 2022"
+RELEASE_DATE="3 May 2022"
 SHLIB_VERSION=3