Commit d16f2aac50 for strongswan.org

commit d16f2aac50a24e200a9ce51a91ad911106c6c24c
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Nov 3 17:57:36 2026 +0100

    openssl: Whitelist ML-DSA parameter callback in leak-detective

    For some reason OSSL_PROVIDER_add_conf_parameter() does not show up
    in the backtraces in our testing environment based on Debian trixie.
    We could potentially enable BFD-based backtraces, but that adds overhead.
    So we use this workaround instead.  We should potentially re-check
    once we update to Debian forky.

diff --git a/src/libstrongswan/plugins/openssl/Makefile.am b/src/libstrongswan/plugins/openssl/Makefile.am
index 30edffa000..079fc4cde0 100644
--- a/src/libstrongswan/plugins/openssl/Makefile.am
+++ b/src/libstrongswan/plugins/openssl/Makefile.am
@@ -6,6 +6,10 @@ if USE_WINDOWS
 AM_CPPFLAGS += -DNOCRYPT
 endif

+if USE_LEAK_DETECTIVE
+AM_CPPFLAGS += -DLEAK_DETECTIVE
+endif
+
 AM_CFLAGS = \
 	$(PLUGIN_CFLAGS)

diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c
index df167bad14..ae7af87772 100644
--- a/src/libstrongswan/plugins/openssl/openssl_plugin.c
+++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c
@@ -851,7 +851,12 @@ static int concat_ossl_providers(OSSL_PROVIDER *provider, void *cbdata)
 /**
  * Callback to add ml-dsa parameters to loaded providers
  */
-static int add_ml_dsa_ossl_params(OSSL_PROVIDER *provider, void *cbdata)
+#ifndef LEAK_DETECTIVE
+/* make this non-static if leak detective is enabled so we can whitelist it as
+ * OSSL_PROVIDER_add_conf_parameter does sometimes not show up in backtraces */
+static
+#endif
+int add_ml_dsa_ossl_params(OSSL_PROVIDER *provider, void *cbdata)
 {
 	/* prefer seed-only format but allow priv-only if we loaded a priv-only
 	 * key and need to re-encode it again (e.g. in swanctl after decrypting
diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c
index f8605cdbb8..8cdf3c47c1 100644
--- a/src/libstrongswan/utils/leak_detective.c
+++ b/src/libstrongswan/utils/leak_detective.c
@@ -611,6 +611,7 @@ static char *whitelist[] = {
 	"OSSL_PROVIDER_try_load_ex",
 	"OSSL_PROVIDER_load",
 	"OSSL_PROVIDER_add_conf_parameter",
+	"add_ml_dsa_ossl_params",
 	"RAND_get0_private",
 	"RAND_get0_public",
 	"RAND_priv_bytes",