It turns out that intialization may change the error number, so we
need to preserve the system error number in functions where
initialization is called for.
These are ERR_get_state() and err_shelve_state()

Fixes #7897
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7902)

(cherry picked from commit 91c5473035aaf2c0d86e4039c2a29a5b70541905)

Fixes #7657
Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7877)

(cherry picked from commit 4128136a28c3b7d3878daed728c49f18eb950adc)

Fixes #7650
Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7876)

(cherry picked from commit 55833a8de70589a5000044b6291e190f5a3826ae)

Fixes #7117
Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7880)

(cherry picked from commit 4fea7005c3d08ed0d575bdea5082b7b0ce355237)

It turned out that .S files aren't to be treated as lightly as I
thought.  They need to go through a preprocessing step, which .s files
don't need to.

Corrects #7703
Reviewed-by: NTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7889)

(cherry picked from commit e436664828429a23bf210710ede34203bdfdc2b8)

Fixes #7883
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7884)

(cherry picked from commit 00eb879f74971e3c048286ef44f6f544676f90d7)

CLA: trivial
Signed-off-by: NJakub Jelen <jjelen@redhat.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7887)

(cherry picked from commit 829800b0735ab99a0962418180cb076ff8081028)

Reviewed-by: NTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7885)

(cherry picked from commit 7a8a35ff0ce0c25a36b494a4c7e3f5f390679e6e)

There was a trailing :w at a line, which didn't make sense in context
of the sentence/styling. Removed it, because I think it's a leftover
vi command.

CLA: trivial
Signed-off-by: NTobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7875)

(cherry picked from commit 143b631639f95822e5e00768254fa35c787f6396)

Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/7748)

(cherry picked from commit 6de98b4fb6265f8a4b2e5b599d6714ff937dca6b)

Check that s is less than the order before attempting to verify the
signature as per RFC8032 5.2.7

Fixes #7706
Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/7748)

(cherry picked from commit 08afd2f37a4465c90b9b9e2081c9e8df4726db89)

Digest must be able to do partial-state copy to be used.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 16e252a01b754a13e83d5e5e87afbe389997926b)

Make CTR mode behave like a stream cipher.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit b5015e834aa7d3f0a5d7585a8fae05cecbdbb848)

The engine needs a custom cipher context copy function to open a new
/dev/crypto session.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 6d99e238397859f2df58c60e28905193b2dd6762)

Close the session in digest_cleanup instead of digest_final.  A failure
in closing the session does not mean a previous successful digest final
has failed as well.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit a67203a19d379a8cc8b369587c60c46eb4e19014)

If the source ctx has not been initialized, don't initialize the copy
either.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit ae8183690fa53b978d4647563f5a521c4cafe94c)

Return failure when the digest_ctx is null in digest_update and
digest_final, and when md is null in digest_final.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 4d9f99654441e36fdcb49540a1dbc9d4c70ccb68)

Call functions to prepare methods after confirming that /dev/crytpo was
sucessfully open and that the destroy function has been set.
Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit d9d4dff5c640990d45af115353fc9f88a497a56c)

Signed-off-by: NEneas U de Queiroz <cote2004-github@yahoo.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit eb3fe0ee5411449230cff46b7f13ebef37aa950e)

Fixes #7727
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7756)

(cherry picked from commit 7ffb7fbe8c1c1bc467993389478d2ea6f00e1860)

For the same reasons as in the previous commit we must preserve errno
across dlopen calls. Some implementations (e.g. solaris) do not preserve
errno even on a successful dlopen call.

Fixes #6953
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7680)

(cherry picked from commit 3cb4e7dc1cf92022f62b9bbdd59695885a1265ff)

This function can end up being called during ERR_get_error() if we are
initialising. ERR_get_error() must preserve errno since it gets called via
SSL_get_error(). If that function returns SSL_ERROR_SYSCALL then you are
supposed to inspect errno.
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7680)

(cherry picked from commit 71b1ceffc4c795f5db21861dd1016fbe23a53a53)

Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7852)

(cherry picked from commit f2f734d4f9e34643a1d3e5b79d2447cd643519f8)

Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7852)

(cherry picked from commit a8bf2f8f24bda57c860e4356f31264fff63fe8b9)

Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7850)

(cherry picked from commit 91d0fd1c2753f0f7d6e0953eed3cfb6eb96d8ff4)

It turns out that the strictness that was implemented in
EVP_PKEY_asn1_new() (see Github openssl/openssl#6880) was badly placed
for some usages, and that it's better to do this check only when the
method is getting registered.

Fixes #7758
Reviewed-by: NTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7847)

(cherry picked from commit a86003162138031137727147c9b642d99db434b1)

Reviewed-by: NPaul Yang <yang.yang@baishancloud.com>
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7705)

(cherry picked from commit 56bc3ea0a49b8aa99a4b031e7cb48ea87fe28e2d)

Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7750)

(cherry picked from commit 425dde5d75a6ffff9a1027107711b99da39e3519)

Fixes #7698
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7750)

(cherry picked from commit 3a17b9a46ecf54a30073534dff04e3223ff98813)

Fix some issues in tls13_hkdf_expand() which impact the above function
for TLSv1.3. In particular test that we can use the maximum label length
in TLSv1.3.
Reviewed-by: NTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7755)

(cherry picked from commit 0fb2815b873304d145ed00283454fc9f3bd35e6b)

This reverts commit ec0c5f5693e39c5a013f81e6dd9dfd09ec65162d.

SSL_export_keying_material() may use longer label lengths.

Fixes #7712
Reviewed-by: NTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7755)

(cherry picked from commit ed371b8cbac0d0349667558c061c1ae380cf75eb)

Fixed-top interfaces tolerate zero-padded inputs and facilitate
constant-time-ness. bn_div_fixed_top tolerates zero-padded dividend,
but not divisor. It's argued that divisor's length is public even
when value is secret.

[extended tests]
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 3a4a88f436ed1dd1165e0b59c1ca4a25e9e1d690)

and add template for constant-time bn_div_3_words.
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 3da2e9c4ee45989a426ff513dc6c6250d1e460de)

Reviewed-by: NPaul Dale <paul.dale@oracle.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 31703da3b8e743c07a9fdb6025aa526594c2a319)

It's being replaced with constant-time alternative.
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit b34446cca2b1814fa674adc8076707d2b65a697f)

Reviewed-by: NPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7697)

(cherry picked from commit e65a79d2aae76c27d68587ff66cb6b65a3283e50)

Check that s is less than the order before attempting to verify the
signature as per RFC8032 5.1.7

Fixes #7693
Reviewed-by: NPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7697)

(cherry picked from commit 0ac8f35c04c4fcdee421170ae6351e42b9e84ce4)

Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7744)

(cherry picked from commit 7b4a3515a4ddb567d48000e61d7cb640d0c5f261)

Copy of RSA_padding_check_PKCS1_type_2 with a twist that rejects padding
if nul delimiter is preceded by 8 consecutive 0x03 bytes.
Reviewed-by: NRichard Levitte <levitte@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(cherry picked from commit 603221407ddc6404f8c417c6beadebf84449074c)

And make RSAErr call unconditional.
Reviewed-by: NRichard Levitte <levitte@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>
(cherry picked from commit 75f5e944be97f28867e7c489823c889d89d0bd06)