Merge ~lucaskanashiro/ubuntu/+source/openvpn:openssl-3-support into ubuntu/+source/openvpn:ubuntu/jammy-devel

[Lucas Kanashiro]

Backport upstream patch set to better support OpenSSL 3 in Jammy. I am still trying to the define a valid test plan for this SRU, but I think we can start with the review in parallel.

The proposed package is available here:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/testing/

autopkgtest is still happy:

autopkgtest [11:37:04]: @@@@@@@@@@@@@@@@@@@@ summary
server-setup-with-ca PASS
server-setup-with-static-key PASS

[Robie Basak (racb)]

I think you're going to need one SRU bug in Launchpad per issue being fixed. Then SRU verification would proceed on each one individually, with a test plan to verify each cherry-pick individually. The changelog entry would then also identify each fix (description and purpose) individually.

Did any of the patches need adjusting for the backport, or did they all apply cleanly?

Are they all justifiable for SRU?

[Christian Ehrhardt  (paelzer)]

@Robie - actually while I agree this is "the usual way" we have in many cases done it exactly as proposed (=> One bug, many patches - as long as it is thematically or feature wise one thing). Look for example at the qemu or libvirt changelog which always seems to come in a barrage of patches per feature/context.

All the patches here are about one problem, the incomplete support/tolerance for openssl 3.
Some patches help directly, some other patches are paving the way.

Gladly the patch descriptions are quite good describing rather exactly what they change - I feel it would be burdensome and not very helpful to copy and paste the very same into 7 bugs.

And in addition the reporter is not a random person, but an active upstream maintainer that directly hand picked us what we'd need.
^^ we could note that in the [Other Info] section BTW

I'd suggest a middle ground to avoid letting this case drown and stall in process.

How about deriving several individual testcases out of the patches?
Obvisouly not those that just restructure things - but each functional change/help could become a testcase. But on just one bug with one impact/reasoning/regression would make it more doable.

In any case I agree we will need a good SRU bug, but as mentioned would like to suggest we avoid proliferation by doing it in just the one bug we have.

[Robie Basak (racb)]

I don't care much about the exact split of patches to bugs. More about what we're achieving by that. For example if you were to put "Make OpenSSL support better" I think that would be too vague and isn't really an SRU justification. Things like "Add insecure tls-cert-profile options", "Allow loading of non default providers" and "Fix allowing/showing unsupported ciphers and digests" each sound like separate user-facing changes/improvements though that need their own justifications, test cases and SRU verifications. The SRU team might come back and say that just one of them isn't justified, for example, but approve the others in principle. This would seem easier to me to use multiple bugs for.

[Christian Ehrhardt  (paelzer)]

@Lucas - since in our priority call we have put this somewhat later and you are not really waiting on review here right now - can you mark it as "WIP" to get off our to-be-reviewed list please?

Unmerged commits

48b9c0a... by Lucas Kanashiro on 2022-07-14

Update changelog

353ab62... by Lucas Kanashiro on 2022-07-14

d/p/openssl-3/*.patch: backport upstream patch set to better support OpenSSL 3 (LP: #1975574)

diff --git a/debian/changelog b/debian/changelog
index 29ee439..eef840b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openvpn (2.5.5-1ubuntu3.1) jammy; urgency=medium
+
+  * d/p/openssl-3/*.patch: backport upstream patch set to better support
+    OpenSSL 3 (LP: #1975574)
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 14 Jul 2022 11:21:14 -0300
+
 openvpn (2.5.5-1ubuntu3) jammy; urgency=medium
 
   * debian/patches/CVE-2022-0547.patch: updated to properly patch actual
diff --git a/debian/patches/openssl-3/0001-Add-insecure-tls-cert-profile-options.patch b/debian/patches/openssl-3/0001-Add-insecure-tls-cert-profile-options.patch
new file mode 100644
index 0000000..e111fa3
--- /dev/null
+++ b/debian/patches/openssl-3/0001-Add-insecure-tls-cert-profile-options.patch
@@ -0,0 +1,83 @@
+From 7b1b100557608db8a311d06f7578ceb7c4d33aa6 Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Fri, 29 Oct 2021 13:24:07 +0200
+Subject: [PATCH] Add insecure tls-cert-profile options
+
+The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it
+necessary to reallow them in certain deployments. Currently this works
+by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0".
+
+Add "insecure" as option to tls-cert-profile to allow setting a seclevel of 0.
+
+Patch v4: fix default accidentially changed to insecure
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Max Fillinger <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg23076.html
+Signed-off-by: Gert Doering <[e-mail]>
+(cherry picked from commit 23efeb7a0bd9e0a6d997ae6e77e0e04170da3e67)
+
+Origin: upstream, https://github.com/OpenVPN/openvpn/commit/7b1b100557608db8a3
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ doc/man-sections/tls-options.rst | 6 ++++++
+ src/openvpn/ssl_mbedtls.c        | 3 ++-
+ src/openvpn/ssl_openssl.c        | 4 ++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/doc/man-sections/tls-options.rst b/doc/man-sections/tls-options.rst
+index f0b6d3dc53..b7f4473917 100644
+--- a/doc/man-sections/tls-options.rst
++++ b/doc/man-sections/tls-options.rst
+@@ -369,6 +369,9 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa
+ 
+   The following profiles are supported:
+ 
++  :code:`insecure`
++      Identical for mbed TLS to `legacy`
++
+   :code:`legacy` (default)
+       SHA1 and newer, RSA 2048-bit+, any elliptic curve.
+ 
+@@ -381,6 +384,9 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa
+   This option is only fully supported for mbed TLS builds. OpenSSL builds
+   use the following approximation:
+ 
++  :code:`insecure`
++      sets "security level 0"
++
+   :code:`legacy` (default)
+       sets "security level 1"
+ 
+diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
+index 4a64e6d338..be0e57f154 100644
+--- a/src/openvpn/ssl_mbedtls.c
++++ b/src/openvpn/ssl_mbedtls.c
+@@ -330,7 +330,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
+ void
+ tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
+ {
+-    if (!profile || 0 == strcmp(profile, "legacy"))
++    if (!profile || 0 == strcmp(profile, "legacy")
++        || 0 == strcmp(profile, "insecure"))
+     {
+         ctx->cert_profile = openvpn_x509_crt_profile_legacy;
+     }
+diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
+index 595057d63d..016331897f 100644
+--- a/src/openvpn/ssl_openssl.c
++++ b/src/openvpn/ssl_openssl.c
+@@ -551,6 +551,10 @@ tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
+     {
+         SSL_CTX_set_security_level(ctx->ctx, 1);
+     }
++    else if (0 == strcmp(profile, "insecure"))
++    {
++        SSL_CTX_set_security_level(ctx->ctx, 0);
++    }
+     else if (0 == strcmp(profile, "preferred"))
+     {
+         SSL_CTX_set_security_level(ctx->ctx, 2);
diff --git a/debian/patches/openssl-3/0002-Refactor-early-initialisation-and-uninitialisation-into-methods.patch b/debian/patches/openssl-3/0002-Refactor-early-initialisation-and-uninitialisation-into-methods.patch
new file mode 100644
index 0000000..dcfbb66
--- /dev/null
+++ b/debian/patches/openssl-3/0002-Refactor-early-initialisation-and-uninitialisation-into-methods.patch
@@ -0,0 +1,71 @@
+From 3f25bf7f7c1f32c2d3ef5b52443c97553a6c8977 Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Thu, 12 May 2022 14:14:23 +0200
+Subject: [PATCH] Refactor early initialisation and uninitialisation into
+ methods
+
+This put the early initialisation and uninitialisation that needs to
+happen between option parsing and post processing into small methods.
+
+Cherry-pick of 97056dbf9 as prerequirement for the provider patch
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Gert Doering <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg24328.html
+Signed-off-by: Gert Doering <[e-mail]>
+
+Origin: upstream, https://github.com/OpenVPN/openvpn/commit/3f25bf7f7c1f32c2d3ef
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ src/openvpn/openvpn.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/src/openvpn/openvpn.c
++++ b/src/openvpn/openvpn.c
+@@ -105,6 +105,20 @@
+ 
+ #undef PROCESS_SIGNAL_P2P
+ 
++void init_early(struct context *c)
++{
++    net_ctx_init(c, &c->net_ctx);
++
++    /* init verbosity and mute levels */
++    init_verb_mute(c, IVM_LEVEL_1);
++
++}
++
++static void uninit_early(struct context *c)
++{
++    net_ctx_free(&c->net_ctx);
++}
++
+ 
+ /**************************************************************************/
+ /**
+@@ -193,10 +207,9 @@
+             open_plugins(&c, true, OPENVPN_PLUGIN_INIT_PRE_CONFIG_PARSE);
+ #endif
+ 
+-            net_ctx_init(&c, &c.net_ctx);
+-
+-            /* init verbosity and mute levels */
+-            init_verb_mute(&c, IVM_LEVEL_1);
++            /* Early initialisation that need to happen before option
++             * post processing and other early startup but after parsing */
++            init_early(&c);
+ 
+             /* set dev options */
+             init_options_dev(&c.options);
+@@ -308,7 +321,7 @@
+             env_set_destroy(c.es);
+             uninit_options(&c.options);
+             gc_reset(&c.gc);
+-            net_ctx_free(&c.net_ctx);
++            uninit_early(&c);
+         }
+         while (c.sig->signal_received == SIGHUP);
+     }
diff --git a/debian/patches/openssl-3/0003-Allow-loading-of-non-default-providers.patch b/debian/patches/openssl-3/0003-Allow-loading-of-non-default-providers.patch
new file mode 100644
index 0000000..9b0d335
--- /dev/null
+++ b/debian/patches/openssl-3/0003-Allow-loading-of-non-default-providers.patch
@@ -0,0 +1,293 @@
+From aef0e595132bd75b0a089e0536c7f910667f1c07 Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Thu, 12 May 2022 14:14:24 +0200
+Subject: [PATCH] Allow loading of non default providers
+
+This allows OpenVPN to load non-default providers. This is mainly
+useful for loading the legacy provider with --providers legacy default
+
+Cherry-pick of 08081aa0a153 to release/2.5. Changes.rst has been adjust to
+better fit the changes in 2.5.
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Gert Doering <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg24327.html
+Signed-off-by: Gert Doering <[e-mail]>
+
+Origin: backport, https://github.com/OpenVPN/openvpn/commit/aef0e595132bd75b0a08
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ Changes.rst                          | 20 ++++++++++++++++++
+ doc/man-sections/generic-options.rst | 12 +++++++++++
+ src/openvpn/crypto_backend.h         | 15 ++++++++++++++
+ src/openvpn/crypto_mbedtls.c         | 13 ++++++++++++
+ src/openvpn/crypto_mbedtls.h         |  3 +++
+ src/openvpn/crypto_openssl.c         | 31 ++++++++++++++++++++++++++++
+ src/openvpn/crypto_openssl.h         | 11 ++++++++++
+ src/openvpn/openvpn.c                | 15 +++++++++++++-
+ src/openvpn/options.c                |  8 +++++++
+ src/openvpn/options.h                |  9 ++++++++
+ 10 files changed, 136 insertions(+), 1 deletion(-)
+
+--- a/Changes.rst
++++ b/Changes.rst
+@@ -1,3 +1,23 @@
++Overview of changes in Ubuntu backport
++======================================
++
++New features
++------------
++- Limited OpenSSL 3.0 support
++    OpenSSL 3.0 support has been added. OpenSSL 3.0 support in 2.5 relies
++    on the compatiblity layer and full OpenSSL 3.0 support is coming with
++    OpenVPN 2.6. Only features that impact usage directly have been
++    backported:
++
++    ``--tls-cert-profile insecure``  has been added to allow selecting the
++    lowest  OpenSSL security level (not recommended, use only if you must).
++
++    OpenSSL 3.0 no longer supports the Blowfish (and other deprecated)
++    algorithm by default and the new option ``--providers`` allows loading
++    the legacy provider to renable these algorithms.
++
++
++
+ Overview of changes in 2.5.5
+ ============================
+ 
+--- a/doc/man-sections/generic-options.rst
++++ b/doc/man-sections/generic-options.rst
+@@ -252,6 +252,18 @@
+   This option solves the problem by persisting keys across :code:`SIGUSR1`
+   resets, so they don't need to be re-read.
+ 
++--providers providers
++  Load the list of (OpenSSL) providers. This is mainly useful for using an
++  external provider for key management like tpm2-openssl or to load the
++  legacy provider with
++
++  ::
++
++      --providers legacy default
++
++  Behaviour of changing this option between SIGHUP might not be well behaving.
++  If you need to change/add/remove this option, fully restart OpenVPN.
++
+ --remap-usr1 signal
+   Control whether internally or externally generated :code:`SIGUSR1` signals
+   are remapped to :code:`SIGHUP` (restart without persisting state) or
+--- a/src/openvpn/crypto_backend.h
++++ b/src/openvpn/crypto_backend.h
+@@ -78,6 +78,21 @@
+  */
+ void crypto_init_lib_engine(const char *engine_name);
+ 
++
++/**
++ * Load the given (OpenSSL) providers
++ * @param provider name of providers to load
++ * @return reference to the loaded provider
++ */
++provider_t *crypto_load_provider(const char *provider);
++
++/**
++ * Unloads the given (OpenSSL) provider
++ * @param provname  name of the provider to unload
++ * @param provider  pointer to the provider to unload
++ */
++void crypto_unload_provider(const char *provname, provider_t *provider);
++
+ #ifdef DMALLOC
+ /*
+  * OpenSSL memory debugging.  If dmalloc debugging is enabled, tell
+--- a/src/openvpn/crypto_mbedtls.c
++++ b/src/openvpn/crypto_mbedtls.c
+@@ -69,6 +69,19 @@
+         "available");
+ }
+ 
++provider_t *crypto_load_provider(const char *provider)
++{
++    if (provider)
++    {
++        msg(M_WARN, "Note: mbed TLS provider functionality is not available");
++    }
++    return NULL;
++}
++
++void crypto_unload_provider(const char *provname, provider_t *provider)
++{
++}
++
+ /*
+  *
+  * Functions related to the core crypto library
+--- a/src/openvpn/crypto_mbedtls.h
++++ b/src/openvpn/crypto_mbedtls.h
+@@ -48,6 +48,9 @@
+ /** Generic HMAC %context. */
+ typedef mbedtls_md_context_t hmac_ctx_t;
+ 
++/* Use a dummy type for the provider */
++typedef void provider_t;
++
+ /** Maximum length of an IV */
+ #define OPENVPN_MAX_IV_LENGTH   MBEDTLS_MAX_IV_LENGTH
+ 
+--- a/src/openvpn/crypto_openssl.c
++++ b/src/openvpn/crypto_openssl.c
+@@ -51,6 +51,10 @@
+ #include <openssl/rand.h>
+ #include <openssl/ssl.h>
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/provider.h>
++#endif
++
+ #if defined(_WIN32) && defined(OPENSSL_NO_EC)
+ #error Windows build with OPENSSL_NO_EC: disabling EC key is not supported.
+ #endif
+@@ -149,6 +153,33 @@
+ #endif
+ }
+ 
++provider_t *
++crypto_load_provider(const char *provider)
++{
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    /* Load providers into the default (NULL) library context */
++    OSSL_PROVIDER *prov = OSSL_PROVIDER_load(NULL, provider);
++    if (!prov)
++    {
++        crypto_msg(M_FATAL, "failed to load provider '%s'", provider);
++    }
++    return prov;
++#else  /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++    msg(M_WARN, "Note: OpenSSL provider functionality is not available");
++    return NULL;
++#endif
++}
++
++void crypto_unload_provider(const char *provname, provider_t *provider)
++{
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    if (!OSSL_PROVIDER_unload(provider))
++    {
++        crypto_msg(M_FATAL, "failed to unload provider '%s'", provname);
++    }
++#endif
++}
++
+ /*
+  *
+  * Functions related to the core crypto library
+--- a/src/openvpn/crypto_openssl.h
++++ b/src/openvpn/crypto_openssl.h
+@@ -33,6 +33,10 @@
+ #include <openssl/hmac.h>
+ #include <openssl/md5.h>
+ #include <openssl/sha.h>
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/provider.h>
++#endif
++
+ 
+ /** Generic cipher key type %context. */
+ typedef EVP_CIPHER cipher_kt_t;
+@@ -49,6 +53,13 @@
+ /** Generic HMAC %context. */
+ typedef HMAC_CTX hmac_ctx_t;
+ 
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++/* Use a dummy type for the provider */
++typedef void provider_t;
++#else
++typedef OSSL_PROVIDER provider_t;
++#endif
++
+ /** Maximum length of an IV */
+ #define OPENVPN_MAX_IV_LENGTH   EVP_MAX_IV_LENGTH
+ 
+--- a/src/openvpn/openvpn.c
++++ b/src/openvpn/openvpn.c
+@@ -112,14 +112,27 @@
+     /* init verbosity and mute levels */
+     init_verb_mute(c, IVM_LEVEL_1);
+ 
++    /* Initialise OpenSSL provider, this needs to be initialised this
++    * early since option post-processing and also openssl info
++    * printing depends on it */
++    for (int j=1; j < MAX_PARMS && c->options.providers.names[j]; j++)
++    {
++        c->options.providers.providers[j] =
++            crypto_load_provider(c->options.providers.names[j]);
++    }
+ }
+ 
+ static void uninit_early(struct context *c)
+ {
+     net_ctx_free(&c->net_ctx);
++    for (int j=1; j < MAX_PARMS && c->options.providers.providers[j]; j++)
++    {
++        crypto_unload_provider(c->options.providers.names[j],
++                               c->options.providers.providers[j]);
++    }
++    net_ctx_free(&c->net_ctx);
+ }
+ 
+-
+ /**************************************************************************/
+ /**
+  * OpenVPN's main init-run-cleanup loop.
+--- a/src/openvpn/options.c
++++ b/src/openvpn/options.c
+@@ -600,6 +600,7 @@
+     "                : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
+     "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
+     "                  (default=legacy).\n"
++    "--providers l   : A list l of OpenSSL providers to load.\n"
+     "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
+     "                  if no ACK from remote within n seconds (default=%d).\n"
+     "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
+@@ -8131,6 +8132,13 @@
+         options->keysize = keysize;
+     }
+ #endif
++    else if (streq(p[0], "providers") && p[1])
++    {
++        for (size_t j = 1; j < MAX_PARMS && p[j] != NULL;j++)
++        {
++            options->providers.names[j] = p[j];
++        }
++    }
+ #ifdef ENABLE_PREDICTION_RESISTANCE
+     else if (streq(p[0], "use-prediction-resistance") && !p[1])
+     {
+--- a/src/openvpn/options.h
++++ b/src/openvpn/options.h
+@@ -176,6 +176,14 @@
+     struct remote_entry *array[CONNECTION_LIST_SIZE];
+ };
+ 
++struct provider_list
++{
++    /* Names of the providers */
++    const char *names[MAX_PARMS];
++    /* Pointers to the loaded providers to unload them */
++    provider_t *providers[MAX_PARMS];
++};
++
+ enum vlan_acceptable_frames
+ {
+     VLAN_ONLY_TAGGED,
+@@ -519,6 +527,7 @@
+     const char *prng_hash;
+     int prng_nonce_secret_len;
+     const char *engine;
++    struct provider_list providers;
+     bool replay;
+     bool mute_replay_warnings;
+     int replay_window;
diff --git a/debian/patches/openssl-3/0004-Fix-allowing-showing-unsupported-ciphers-digests.patch b/debian/patches/openssl-3/0004-Fix-allowing-showing-unsupported-ciphers-digests.patch
new file mode 100644
index 0000000..8bd98cf
--- /dev/null
+++ b/debian/patches/openssl-3/0004-Fix-allowing-showing-unsupported-ciphers-digests.patch
@@ -0,0 +1,136 @@
+From 3690939126cf84b166157bad96e724caea61346d Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Thu, 12 May 2022 14:14:28 +0200
+Subject: [PATCH] Fix allowing/showing unsupported ciphers and digests
+
+This is a minimal version to hide the non-supported ciphers in these
+show-cipher/show-digests listings. It also adds code to the kt_md_get/
+kt_cipher_get functions to error out early instead of getting an ugly
+backtrace with OpenSSL errors later when actually trying to use the
+ciphers.
+
+This allows make check to work again on with OpenSSL 3.0.
+
+The changes are kept minimal to  avoid pulling in all the other refactoring
+for OpenSSL 3.0.
+
+This commit is partly cherry-picked from ab3f32b9.
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Gert Doering <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg24334.html
+Signed-off-by: Gert Doering <[e-mail]>
+
+Origin: upstream, https://github.com/OpenVPN/openvpn/commit/3690939126cf84b1
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ src/openvpn/crypto_openssl.c | 52 +++++++++++++++++++++++++++++++++---
+ 1 file changed, 48 insertions(+), 4 deletions(-)
+
+--- a/src/openvpn/crypto_openssl.c
++++ b/src/openvpn/crypto_openssl.c
+@@ -170,7 +170,8 @@
+ #endif
+ }
+ 
+-void crypto_unload_provider(const char *provname, provider_t *provider)
++void
++crypto_unload_provider(const char *provname, provider_t *provider)
+ {
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+     if (!OSSL_PROVIDER_unload(provider))
+@@ -360,7 +361,11 @@
+                        || cipher_kt_mode_aead(cipher)
+                        ))
+         {
+-            cipher_list[num_ciphers++] = cipher;
++            /* Check explicit availibility (for OpenSSL 3.0) */
++            if (cipher_kt_get(cipher_kt_name(cipher)))
++            {
++                cipher_list[num_ciphers++] = cipher;
++            }
+         }
+         if (num_ciphers == (sizeof(cipher_list)/sizeof(*cipher_list)))
+         {
+@@ -393,6 +398,13 @@
+ }
+ 
+ void
++print_digest(EVP_MD *digest, void *unused)
++{
++    printf("%s %d bit digest size\n", EVP_MD_name(digest),
++           EVP_MD_size(digest) * 8);
++}
++
++void
+ show_available_digests(void)
+ {
+     int nid;
+@@ -405,16 +417,21 @@
+            "the --auth option.\n\n");
+ #endif
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    EVP_MD_do_all_provided(NULL, print_digest, NULL);
++#else
+     for (nid = 0; nid < 10000; ++nid)
+     {
+         const EVP_MD *digest = EVP_get_digestbynid(nid);
+         if (digest)
+         {
+-            printf("%s %d bit digest size\n",
+-                   OBJ_nid2sn(nid), EVP_MD_size(digest) * 8);
++            /* We cast the const away so we can keep the function prototype
++             * compatible with EVP_MD_do_all_provided */
++            print_digest((EVP_MD *)digest, NULL);
+         }
+     }
+     printf("\n");
++#endif
+ }
+ 
+ void
+@@ -645,6 +662,19 @@
+     ciphername = translate_cipher_name_from_openvpn(ciphername);
+     cipher = EVP_get_cipherbyname(ciphername);
+ 
++    /* This is a workaround for OpenSSL 3.0 to infer if the cipher is valid
++     * without doing all the refactoring that OpenVPN 2.6 has. This will
++     * not support custom algorithm from providers but at least ignore
++     * algorithms that are not available without providers (legacy) */
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    EVP_CIPHER *tmpcipher = EVP_CIPHER_fetch(NULL, ciphername, NULL);
++    if (!tmpcipher)
++    {
++        cipher = NULL;
++    }
++    EVP_CIPHER_free(tmpcipher);
++#endif
++
+     if (NULL == cipher)
+     {
+         crypto_msg(D_LOW, "Cipher algorithm '%s' not found", ciphername);
+@@ -945,6 +975,20 @@
+     const EVP_MD *md = NULL;
+     ASSERT(digest);
+     md = EVP_get_digestbyname(digest);
++
++    /* This is a workaround for OpenSSL 3.0 to infer if the digest is valid
++     * without doing all the refactoring that OpenVPN 2.6 has. This will
++     * not support custom algorithm from providers but at least ignore
++     * algorithms that are not available without providers (legacy) */
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    EVP_MD *tmpmd = EVP_MD_fetch(NULL, digest, NULL);
++    if (!tmpmd)
++    {
++        md = NULL;
++    }
++    EVP_MD_free(tmpmd);
++#endif
++
+     if (!md)
+     {
+         crypto_msg(M_FATAL, "Message hash algorithm '%s' not found", digest);
diff --git a/debian/patches/openssl-3/0005-Add-message-when-decoding-PKCS12-file-fails.patch b/debian/patches/openssl-3/0005-Add-message-when-decoding-PKCS12-file-fails.patch
new file mode 100644
index 0000000..e725da9
--- /dev/null
+++ b/debian/patches/openssl-3/0005-Add-message-when-decoding-PKCS12-file-fails.patch
@@ -0,0 +1,44 @@
+From 1f54811e92c89fe07d7cea8339e928980bfe0536 Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Tue, 19 Oct 2021 20:31:22 +0200
+Subject: [PATCH] Add message when decoding PKCS12 file fails.
+
+Currently we never display the OpenSSL error stack when decoding a
+PCKS12 file fails. With LibreSSL defaulting to RC2-40-CBC, the failure
+might not be a wrong password but can actually be an unsupported encoding,
+seeing the error stack is really helpful (example from OpenSSL 3.0):
+
+error:0308010C:digital envelope routines:inner_evp_generic_fetch:
+  unsupported:crypto/evp/evp_fetch.c:346:Global default library
+  context, Algorithm (RC2-40-CBC : 0), Properties ()
+
+to pinpoint the issue
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Gert Doering <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg23017.html
+Signed-off-by: Gert Doering <[e-mail]>
+(cherry picked from commit 6ac4e63c577986ec11eae3519fe8516e8ca8ac0f)
+
+Origin: upstream, https://github.com/OpenVPN/openvpn/commit/1f54811e92c89fe07d7cea
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ src/openvpn/ssl_openssl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
+index 016331897f..e0360f75b9 100644
+--- a/src/openvpn/ssl_openssl.c
++++ b/src/openvpn/ssl_openssl.c
+@@ -825,6 +825,8 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
+         ca = NULL;
+         if (!PKCS12_parse(p12, password, &pkey, &cert, &ca))
+         {
++            crypto_msg(M_WARN, "Decoding PKCS12 failed. Probably wrong password "
++                               "or unsupported/legacy encryption");
+ #ifdef ENABLE_MANAGEMENT
+             if (management && (ERR_GET_REASON(ERR_peek_error()) == PKCS12_R_MAC_VERIFY_FAILURE))
+             {
diff --git a/debian/patches/openssl-3/0006-Translate-OpenSSL-3.0-digest-names-to-OpenSSL-1.1-digest-names.patch b/debian/patches/openssl-3/0006-Translate-OpenSSL-3.0-digest-names-to-OpenSSL-1.1-digest-names.patch
new file mode 100644
index 0000000..6b680c6
--- /dev/null
+++ b/debian/patches/openssl-3/0006-Translate-OpenSSL-3.0-digest-names-to-OpenSSL-1.1-digest-names.patch
@@ -0,0 +1,91 @@
+From b158125f67b49149ffd3e2617479fbd27860713c Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Mon, 23 May 2022 12:35:45 +0200
+Subject: [PATCH] Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest
+ names
+
+Since we used the OpenSSL <=1.1 names as part of our OCC message, they
+are now unfortunately part of our wire protocol.
+
+OpenSSL 3.0 will still accept the "old" names so we do not need to use
+this translation table for forward lookup, only for returning the name
+with md_kt_name()
+
+Backport of master commit 88342ed8277c5797.
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Antonio Quartulli <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg24424.html
+Signed-off-by: Gert Doering <[e-mail]>
+
+Origin: upstream, https://github.com/OpenVPN/openvpn/commit/b158125f67b49149ffd3e
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ src/openvpn/crypto_openssl.c | 39 ++++++++++++++++++++++++++++++++++--
+ 1 file changed, 37 insertions(+), 2 deletions(-)
+
+--- a/src/openvpn/crypto_openssl.c
++++ b/src/openvpn/crypto_openssl.c
+@@ -400,7 +400,7 @@
+ void
+ print_digest(EVP_MD *digest, void *unused)
+ {
+-    printf("%s %d bit digest size\n", EVP_MD_name(digest),
++    printf("%s %d bit digest size\n", md_kt_name(digest),
+            EVP_MD_size(digest) * 8);
+ }
+ 
+@@ -1003,6 +1003,28 @@
+     return md;
+ }
+ 
++/* Since we used the OpenSSL <=1.1 names as part of our OCC message, they
++ * are now unfortunately part of our wire protocol.
++ *
++ * OpenSSL 3.0 will still accept the "old" names so we do not need to use
++ * this translation table for forward lookup, only for returning the name
++ * with md_kt_name() */
++const cipher_name_pair digest_name_translation_table[] = {
++    { "BLAKE2s256", "BLAKE2S-256"},
++    { "BLAKE2b512", "BLAKE2B-512"},
++    { "RIPEMD160", "RIPEMD-160" },
++    { "SHA224", "SHA2-224"},
++    { "SHA256", "SHA2-256"},
++    { "SHA384", "SHA2-384"},
++    { "SHA512", "SHA2-512"},
++    { "SHA512-224", "SHA2-512/224"},
++    { "SHA512-256", "SHA2-512/256"},
++    { "SHAKE128", "SHAKE-128"},
++    { "SHAKE256", "SHAKE-256"},
++};
++const size_t digest_name_translation_table_count =
++    sizeof(digest_name_translation_table) / sizeof(*digest_name_translation_table);
++
+ const char *
+ md_kt_name(const EVP_MD *kt)
+ {
+@@ -1010,7 +1032,20 @@
+     {
+         return "[null-digest]";
+     }
+-    return EVP_MD_name(kt);
++
++    const char *name = EVP_MD_name(kt);
++
++    /* Search for a digest name translation */
++    for (size_t i = 0; i < digest_name_translation_table_count; i++)
++    {
++        const cipher_name_pair *pair = &digest_name_translation_table[i];
++        if (!strcmp(name, pair->lib_name))
++        {
++            name = pair->openvpn_name;
++        }
++    }
++
++    return name;
+ }
+ 
+ unsigned char
diff --git a/debian/patches/openssl-3/0007-Allow-running-a-default-configuration-with-TLS-libraries-without-BF-CBC.patch b/debian/patches/openssl-3/0007-Allow-running-a-default-configuration-with-TLS-libraries-without-BF-CBC.patch
new file mode 100644
index 0000000..3686200
--- /dev/null
+++ b/debian/patches/openssl-3/0007-Allow-running-a-default-configuration-with-TLS-libraries-without-BF-CBC.patch
@@ -0,0 +1,194 @@
+From cf5864f5922e4f40357d9f75a35cd448e671dddf Mon Sep 17 00:00:00 2001
+From: Arne Schwabe <[e-mail]>
+Date: Fri, 3 Jun 2022 11:52:19 +0200
+Subject: [PATCH] Allow running a default configuration with TLS libraries
+ without BF-CBC
+
+Modern TLS libraries might drop Blowfish by default or distributions
+might disable Blowfish in OpenSSL/mbed TLS. We still signal OCC
+options with BF-CBC compatible strings. To avoid requiring BF-CBC
+for this, special this one usage of BF-CBC enough to avoid a hard
+requirement on Blowfish in the default configuration.
+
+This patch is cherry-picked from 79ff3f79 and the missing
+ciphername = "none"; has been added in the OCC code.
+
+Due to uncrustify complains, a few extra whitespace fixes had to be
+done to options.c.
+
+Signed-off-by: Arne Schwabe <[e-mail]>
+Acked-by: Gert Doering <[e-mail]>
+Message-Id: <[e-mail]>
+URL: https://www.mail-archive.com/[e-mail]/msg24456.html
+Signed-off-by: Gert Doering <[e-mail]>
+
+Origin: backport, https://github.com/OpenVPN/openvpn/commit/cf5864f5922e4f40357d
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1975574
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Update: 2022-07-14
+---
+ src/openvpn/crypto_backend.h |  2 ++
+ src/openvpn/init.c           | 37 ++++++++++++++++-----
+ src/openvpn/options.c        | 62 ++++++++++++++++++++++++++++--------
+ 3 files changed, 80 insertions(+), 21 deletions(-)
+
+--- a/src/openvpn/crypto_backend.h
++++ b/src/openvpn/crypto_backend.h
+@@ -256,6 +256,8 @@
+  * The returned name is normalised to the OpenVPN config name in case the
+  * name differs from the name used by the crypto library.
+  *
++ * Returns [null-cipher] in case the cipher_kt is NULL.
++ *
+  * @param cipher_kt     Static cipher parameters
+  *
+  * @return a statically allocated string describing the cipher.
+--- a/src/openvpn/init.c
++++ b/src/openvpn/init.c
+@@ -2764,14 +2764,35 @@
+ #endif /* if P2MP */
+         }
+ 
+-        /* Do not warn if we only have BF-CBC in options->ciphername
+-         * because it is still the default cipher */
+-        bool warn = !streq(options->ciphername, "BF-CBC")
+-             || options->enable_ncp_fallback;
+-        /* Get cipher & hash algorithms */
+-        init_key_type(&c->c1.ks.key_type, options->ciphername, options->authname,
+-                      options->keysize, true, warn);
+-
++        /*
++         * BF-CBC is allowed to be used only when explicitly configured
++         * as NCP-fallback or when NCP has been disabled or explicitly
++         * allowed in the in ncp_ciphers list.
++         * In all other cases do not attempt to initialize BF-CBC as it
++         * may not even be supported by the underlying SSL library.
++         *
++         * Therefore, the key structure has to be initialized when:
++         * - any non-BF-CBC cipher was selected; or
++         * - BF-CBC is selected and NCP is disabled (explicit request to
++         *   use the BF-CBC cipher); or
++         * - BF-CBC is selected, NCP is enabled and fallback is enabled
++         *   (BF-CBC will be the fallback).
++         * - BF-CBC is in data-ciphers and we negotiate to use BF-CBC:
++         *   If the negotiated cipher and options->ciphername are the
++         *   same we do not reinit the cipher
++         *
++         * Note that BF-CBC will still be part of the OCC string to retain
++         * backwards compatibility with older clients.
++         */
++        if (!streq(options->ciphername, "BF-CBC") || !options->ncp_enabled
++            || (options->ncp_enabled && tls_item_in_cipher_list("BF-CBC", options->ncp_ciphers))
++            || options->enable_ncp_fallback)
++        {
++            /* Do not warn if the if the cipher is used only in OCC */
++            bool warn = !options->ncp_enabled || options->enable_ncp_fallback;
++            init_key_type(&c->c1.ks.key_type, options->ciphername, options->authname,
++                          options->keysize, true, warn);
++        }
+         /* Initialize PRNG with config-specified digest */
+         prng_init(options->prng_hash, options->prng_nonce_secret_len);
+ 
+--- a/src/openvpn/options.c
++++ b/src/openvpn/options.c
+@@ -1132,7 +1132,7 @@
+ #ifndef ENABLE_SMALL
+ 
+ static void
+-show_dhcp_option_list(const char *name, const char * const*array, int len)
++show_dhcp_option_list(const char *name, const char *const *array, int len)
+ {
+     int i;
+     for (i = 0; i < len; ++i)
+@@ -3100,7 +3100,7 @@
+         if (!o->ncp_enabled)
+         {
+             msg(M_USAGE, "--ncp-disable needs an explicit --cipher or "
+-                         "--data-ciphers-fallback config option");
++                "--data-ciphers-fallback config option");
+         }
+ 
+         msg(M_WARN, "--cipher is not set. Previous OpenVPN version defaulted to "
+@@ -3678,9 +3678,30 @@
+     {
+         struct frame fake_frame = *frame;
+         struct key_type fake_kt;
+-        init_key_type(&fake_kt, o->ciphername, o->authname, o->keysize, true,
+-                      false);
++
+         frame_remove_from_extra_frame(&fake_frame, crypto_max_overhead());
++
++
++        /* o->ciphername might be BF-CBC even though the underlying SSL library
++         * does not support it. For this reason we workaround this corner case
++         * by pretending to have no encryption enabled and by manually adding
++         * the required packet overhead to the MTU computation.
++         */
++        const char *ciphername = o->ciphername;
++
++        if (strcmp(o->ciphername, "BF-CBC") == 0)
++        {
++            /* none has no overhead, so use this to later add only --auth
++             * overhead */
++
++            /* overhead of BF-CBC: 64 bit block size, 64 bit IV size */
++            frame_add_to_extra_frame(&fake_frame, 64/8 + 64/8);
++            ciphername = "none";
++        }
++
++        init_key_type(&fake_kt, ciphername, o->authname, o->keysize, true,
++                      false);
++
+         crypto_adjust_frame_parameters(&fake_frame, &fake_kt, o->replay,
+                                        cipher_kt_mode_ofb_cfb(fake_kt.cipher));
+         frame_finalize(&fake_frame, o->ce.link_mtu_defined, o->ce.link_mtu,
+@@ -3850,18 +3871,33 @@
+                + (TLS_SERVER == true)
+                <= 1);
+ 
+-        init_key_type(&kt, o->ciphername, o->authname, o->keysize, true,
+-                      false);
++        /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
++         * to work here in the default configuration */
++        const char *ciphername = o->ciphername;
++        int keysize;
++
++        if (strcmp(o->ciphername, "BF-CBC") == 0)
++        {
++            init_key_type(&kt, "none", o->authname, o->keysize, true,
++                          false);
++            keysize = 128;
++        }
++        else
++        {
++            init_key_type(&kt, o->ciphername, o->authname, o->keysize, true,
++                          false);
++            ciphername = cipher_kt_name(kt.cipher);
++            keysize = kt.cipher_length * 8;
++        }
+         /* Only announce the cipher to our peer if we are willing to
+          * support it */
+-        const char *ciphername = cipher_kt_name(kt.cipher);
+         if (p2p_nopull || !o->ncp_enabled
+             || tls_item_in_cipher_list(ciphername, o->ncp_ciphers))
+         {
+             buf_printf(&out, ",cipher %s", ciphername);
+         }
+         buf_printf(&out, ",auth %s", md_kt_name(kt.digest));
+-        buf_printf(&out, ",keysize %d", kt.cipher_length * 8);
++        buf_printf(&out, ",keysize %d", keysize);
+         if (o->shared_secret_file)
+         {
+             buf_printf(&out, ",secret");
+@@ -6165,9 +6201,9 @@
+         }
+     }
+ #ifdef TARGET_LINUX
+-    else if (streq (p[0], "bind-dev") && p[1])
++    else if (streq(p[0], "bind-dev") && p[1])
+     {
+-        VERIFY_PERMISSION (OPT_P_SOCKFLAGS);
++        VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
+         options->bind_dev = p[1];
+     }
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index 4b24781..b652911 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,11 @@ systemd.patch
 openvpn-fips-2.4.patch
 OpenSSL3.patch
 CVE-2022-0547.patch
+# Upstream patches to better support OpenSSL 3
+openssl-3/0001-Add-insecure-tls-cert-profile-options.patch
+openssl-3/0002-Refactor-early-initialisation-and-uninitialisation-into-methods.patch
+openssl-3/0003-Allow-loading-of-non-default-providers.patch
+openssl-3/0004-Fix-allowing-showing-unsupported-ciphers-digests.patch
+openssl-3/0005-Add-message-when-decoding-PKCS12-file-fails.patch
+openssl-3/0006-Translate-OpenSSL-3.0-digest-names-to-OpenSSL-1.1-digest-names.patch
+openssl-3/0007-Allow-running-a-default-configuration-with-TLS-libraries-without-BF-CBC.patch