Added documentation of the addition of group tuples in openSSL 3.5
in HISTORY section of SSL_CTX_set1_curves.pod.
CLA: trivial
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 24 13:13:26 2026
(Merged from https://github.com/openssl/openssl/pull/32007)
EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured
signature digest rejected a valid signature whose recovered payload is
empty, instead of returning success with a recovered length of zero.
RSA_public_decrypt() returns -1 on error and otherwise the number of
recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5
signature that encodes an empty payload. Pull request #28306 ("Make
error checks on RSA_public_decrypt() consistent") changed the error
check in the raw, no-digest verify-recover path from "ret < 0" to
"ret <= 0", so a valid zero recovered length was mistaken for an error.
Restore the "< 0" check in that branch only, leaving the digest-aware
PKCS#1, X9.31, PSS and ordinary verification paths untouched.
Add test_RSA_verify_recover_empty_payload, which performs a complete
zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and
fails on the unmodified implementation specifically at the
EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same
signature and reports a zero-byte result.
The behavior regressed as a result of #28306.
Fixes#32000
Assisted-by: OpenCode:GLM-5.2
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Fri Jul 24 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32001)
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.
Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.
Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.
Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)
The LoongArch SHA dispatch shim uses the same deprecated typed
interfaces as the RISC-V shim. Switch its entry points to void *
so it no longer depends on deprecated SHA context types.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:31 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
The RISC-V MD5 and SHA dispatch files use low-level digest context
types that are hidden in no-deprecated builds. Switch their shim
entry points to void * so they no longer depend on deprecated typed
interfaces.
Update the local MD5 declaration to match the untyped shim
interface.
Fixes: openssl/openssl#29357
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:30 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
Fuzz OSSL_ECHSTORE_read_echconfiglist with raw
fuzzer input in stage 1. Then fixup the starting
bytes to reach deeper code withotu relying only on
corpus. Fixup is done for binary encoding only (not base64).
Assisted-by: ChatGPT:gpt-5.5
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 13:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/32021)
Document that a generated key is returned separately from its generation
context and that a new key-bound context is needed for subsequent
operations. Correct the encrypt and decrypt initialization descriptions
and examples accordingly.
Correct two copy-and-paste errors in the verify-recover documentation:
describe its initializer as starting a verify-recover operation and refer
to EVP_PKEY_verify_recover() when discussing its input.
Fixes#31989
Assisted-by: Grok:Grok-4.5
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 23 08:29:24 2026
(Merged from https://github.com/openssl/openssl/pull/31995)
Coverity caught some potential overflows in do_name_ex. Seems unlikely
to occur, but lets just do all the adds under safe_math to ensure we
don't overflow our buffer length.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695278
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 08:24:23 2026
(Merged from https://github.com/openssl/openssl/pull/31992)
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents")
Signed-off-by: Todd Short <todd.short@me.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
- Do not reject external PSKs when client-side sid_ctx is set, fixed
by copying the sid_ctx into the pending session.
Tests added for this and also the server side sid_ctx issues.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:06 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969
Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5
Fixes: 70741ee62a "Configurations/unix-Makefile.tmpl: make cleanup faster"
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
As the latter was deprecated in commit f584ae959c "Let's support
multiple names for certificate verification".
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
...instead of defining it (incorrectly).
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad "Convert demos to primary build system"
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: dad45ea769 "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb "Add demo QUIC non-blocking server"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b5 "MVP demo TLS
server", which, while was applied after 2000281dad "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b5 "MVP demo TLS server"
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
This change documents the new Configure option, `--manpage-format`.
Address formatting issues and expound on the `Reconfigure` section.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:30 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Introduced in commit 05301b100f (PR #25918).
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Jul 20 09:47:35 2026
(Merged from https://github.com/openssl/openssl/pull/31874)
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Cover the success path (state advances to FINISHED_WRITING, empty body)
and the invalid-state error path.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:47 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Parameterize prime_ssl() by message type and extract a generic
finish_msg() so the scaffolding is reusable by other client construct
tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:45 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
The msg_cb message callback used by the -msg option only recognised
DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as
"Not TLS data or unknown version" instead of being decoded. Add
DTLS1_2_VERSION to the recognised version check and to the ssl_versions
lookup table, and wrap the now-overlong condition.
Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and
DTLSv1.2, logging the protocol messages via -msg, and checks that every
record is decoded (no "Not TLS data or unknown version" lines).
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jul 20 09:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/31994)
The internal provider test intentionally retains its configured provider
when OPENSSL_cleanup() is skipped under OSSL_USE_VALGRIND. The existing
suppression accounts for this state but no longer matches the provider
activation stack because provider_init() appears between
OSSL_provider_init() and provider_activate().
Add the missing frame so the provider context and its diagnostic strings
are correctly suppressed.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:11 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The QUIC radix test creates a new thread-local key for each script but
only clears the associated value during teardown. The key itself
is never deleted.
Delete the thread-local key after all child threads have joined and the
main-thread value has been cleared.
1,536 bytes in 3 blocks are still reachable in loss record 873 of 915
at 0x488D0B0: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
by 0x49561CF: pthread_setspecific@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
by 0x5C0FD7: CRYPTO_THREAD_set_local (threads_pthread.c:1030)
by 0x41132F: radix_thread_init (quic_bindings.c:570)
by 0x4114F7: bindings_process_init (quic_bindings.c:604)
by 0x422563: test_script (main.c:28)
by 0x5152DF: run_tests (driver.c:518)
by 0x517447: main (main.c:52)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:10 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The test provider's fake AES-128-GCM cipher works by running the real
sub-cipher for its side effects and then copying the memdup'd input
back over the output buffer, so the "encrypted" record is really the
plaintext.
In a TLS record the buffer handed to the cipher reserves an
uninitialised 8-byte explicit IV at the front and a 16-byte auth tag
at the end for the cipher to fill. OPENSSL_memdup() duplicated those
uninitialised IV/tag regions, and the subsequent memcpy(out, inbuf, inl)
copied them into out. That output was then written to the socket,
triggering valgrind's "Syscall param write(buf) points to uninitialised
byte(s)":
at sock_write (bss_sock.c:155)
by bwrite_conv (bio_meth.c:79)
by BIO_write (bio_lib.c:397)
by statem_flush (statem.c:963)
by ossl_statem_client_post_work (statem_clnt.c:881)
...
Track whether EVP_CTRL_AEAD_TLS1_AAD was set (recorded in
set_ctx_params) and, when encrypting a TLS record, copy only the
plaintext payload back, leaving the explicit IV and tag that the real
sub-cipher actually produced intact.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:08 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Append the %p (process ID) placeholder to valgrind's --log-file in
both app() and test(). When a test spawns multiple processes sharing
the same result index, they previously wrote to the same log file and
clobbered each other's output. Using %p gives each process its own
log, so no valgrind findings are lost.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:07 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The new edge case tests cover potential parser invariant violations
fixed in the prior commit.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 20 07:12:31 2026
(Merged from https://github.com/openssl/openssl/pull/31926)
- Don't attempt to float its keyshare if any
- Include active tuple in memmove() that excises a newly empty closed tuple.
Add comments to clarify the logic.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 20 07:12:30 2026
(Merged from https://github.com/openssl/openssl/pull/31926)
WRAP[] lists mix OpenSSL functions with libc/POSIX ones such as read()
or socket(), which mkwraps.pl reported as "declaration not found" since
it only searched the project's INCLUDE[] directories.
Fall back to the C compiler's default include search paths for functions
missing from the project headers. They are queried lazily, only on such
a miss, so the all-OpenSSL case still does not walk /usr/include. Parse
the glibc trailing attribute macros (__THROW, __wur, ...) and restrict
qualifier, and add --cc and --no-system.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 20 07:00:57 2026
(Merged from https://github.com/openssl/openssl/pull/31936)
For GCM-SIV:
1. AAD must precede the payload
2. the payload must be single shot
(2) was already happening, this change moves from a silent fail to
an explicit error message for multiple update calls on the payload.
For (1), this change unifies the logic for (2) one level up in the wrapper.
So the code previously allowed (1), and now errors out after this change.
Follow-up to #31906
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 06:56:04 2026
(Merged from https://github.com/openssl/openssl/pull/31940)
The -keyform (OPT_KEYFORM) option of the dgst app was not exercised by
any test. Add a subtest that converts the RSA test keys to DER and
then signs and verifies with -keyform DER, covering the option for both
the private and public key loading paths.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 06:40:45 2026
(Merged from https://github.com/openssl/openssl/pull/31946)
If pkcs11-provider external test fails, only output of failed tests
is printed.
Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
MergeDate: Mon Jul 20 06:29:41 2026
(Merged from https://github.com/openssl/openssl/pull/31947)
The -text option of the dsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testdsa.pem keypair rather
than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 06:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/31949)
This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)
The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.
Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.
We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().
ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.
Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.
Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.
Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.
Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.
Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Jul 18 12:53:26 2026
(Merged from https://github.com/openssl/openssl/pull/31927)
The -encopt option of the pkey app was not exercised by any test; the
existing ML-DSA codec tests only used genpkey -encopt and pkey with
-provparam. Re-encode the seed-priv key into each supported PKCS#8
output format via 'pkey -encopt output_formats:<form>' and check the
result matches the reference for that form. A control compares against
the default (no -encopt) encoding so the match is attributed to -encopt
rather than the default behaviour.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:51:40 2026
(Merged from https://github.com/openssl/openssl/pull/31951)
The -text option was not exercised for the ec or ecparam apps. Add a
subtest to 15-test_ec.t that prints a private and a public EC key and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testec-p256.pem keypair as
well as the curve identification. Add a subtest to 15-test_ecparam.t
that prints named and explicit parameters, checking the named form emits
the expected curve OID and NIST name while the explicit form emits the
field parameters and no OID.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:47:12 2026
(Merged from https://github.com/openssl/openssl/pull/31952)
RADIX framework keeps objects needed by test scripts
in two places:
- hash table bound to radix process (`RP()->objs`), all
objects are stored there
- slot which is an array bound to radix thread (`RT()->slot[]`)
The `slot` is an array which is used to pass arguments
to RADIX ops. The typically script is doing something
like this:
```
OP_SELECT_SSL(0, C); /* places 'C' object to slot 0 in thread */
OP_FUNC(print_ssl); /* calls print_ssl function, which prints object */
```
All objects are managed by RADIX framework, scripts have very
limited options to control object's lifetime. The only way for
scripts to let object go is to use `OP_UNBIND()`. The operation
removes the object from hastable (`RP()->objs`) and frees the
object afterwards. This is good enough as long a all tests
are running in single thread. Currently `OP_UNBIND()` is
required when test needs to accept/create more than one stream.
The test has two options. It can use unique name for each
stream it creates/accepts:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_ACCEPT_STREAM_WAIT(C, C1, 0);
OP_ACCEPT_STREAM_WAIT(C, C2, 0);
```
Or script may re-use the same variable for stream,
in that case `OP_UNBIND()` is needed:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
```
Unfortunately `OP_UNBIND()` can not be used when test
uses more than one thread due to missing locking of `RP()->objs`.
Introducing a locking scheme seems to be bit invasive change,
The OP_BIND() here hopes to be sufficient and good enough for now.
The idea is as follows:
- `OP_BIND()` allows script to insert empty object
into `RP()->objs` OP_BIND() is supposed to run before
script spawns thread(s). No manipulation of `RP()->objs`
is allowed after threads are spawned, operations
OP_BIND()/OP_UNBIND() are not thread safe.
- Introduce `OP_F_REPLACE_STREAM` flag which tells
`OP_ACCEPT_STREAM_WAIT()`/`OP_NEW_STREAM()` to re-use
existing id for stream. This `_REPLACE_` flag requires
read-only access to `RP()->objs` hash table.
- change introduces a per radix object mutex so object can
be updated safely w.r.t. RADIX thread which ticks SSL object
bound in radix object.
The guideline for tests which require more then one thread
is as follows:
- the first thread creates complete set of empty objects
for all threads.
- each test thread gets its own set of variables, so it
can populate them later during test with SSL objects
- objects are not supposed to be shared between threads
This is a snippet of script executed by main thread before
additional threads are spawned:
```
...
OP_BIND(C1); /* stream id for child */
OP_BIND(S1); /* stream id for parent */
OP_SPAWN_THREAD(child);
for (i = 0; i < 10; i++) {
OP_NEW_STREAM(S, S1, OP_F_REPLACE_STREAM);
OP_WRITE_B(S1, "foo");
OP_CONCLUDE(S1);
}
```
This snippet comes from child:
```
for (i = 0; i < 10; i++) {
OP_ACCEPT_STREAM_WAIT(C, C1, OP_F_REPLACE_STREAM);
OP_READ_EXPECT_B(C1, "foo");
OP_EXPECT_FIN(C1);
}
```
As you can see parent and child don't use OP_BIND()/OP_UNBIND()
after child thread is spawned.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri Jul 17 08:02:04 2026
(Merged from https://github.com/openssl/openssl/pull/31821)
The seeding macro logic was mixed up and incompletely applied. The
macro logic was also cleaned up.
Co-authored-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 17 04:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31970)
The tests addded in commit d8a7e8e uncovered an odd error case.
https://github.com/openssl/openssl/actions/runs/29303845665/job/86993085732
Is failing when attempting to read in a der file converting from a
corresponding PEM file containing DSA parameters.
Interestingly The problem was only occuring when:
1) The input was a DER file
and
2) Blake2 was not configured
Doing some tracing of the decoder operation showed that this is occuring
because the OSSL_STORE lookup used to find the proper decoder uses a
"first successful decode wins" approach, after which the loading code
checks to see if the decoded type matches the expected key type.
When decoding PEM, this isn't a problem, as the PEM armoring gives the
decoder a hint as to why type of data the input file is.
But with DER, there is no such hint, and we're at the mercy of whichever
decoder happens to decode the data correctly first. Normally it works
just fine, but when features are disabled or enabled, the order in which
the decoders are attempted may change, affecting the outcome. In this
particular case, disabling blake2 caused the DHX decoder to be attempted
first, which decodes the input der file without issue. That in turn
caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting
a DSA key), and so the test fails.
Fortunately, the code that the dsaparam applet uses to do this decode
provides a keytype hint, which we can use to guide the decode process.
keep the old store lookup method around in case anyone doesn't pass a
uri that is a file path or provide a keytype, but if we do both those
things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell
the decoder that we want to decode the input data as the expected type
(in this case a DSA key).
Fixes#31944
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Thu Jul 16 15:28:32 2026
(Merged from https://github.com/openssl/openssl/pull/31954)
This fixes failing rand mfail test when jitter used
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:18:29 2026
(Merged from https://github.com/openssl/openssl/pull/31938)
The -gendelta, -key and -keyform options of the crl app were previously
untested. It adds a subtest that generates two CRLs with an incrementing
crlNumber and then uses -gendelta with -key to produce a delta CRL,
checking the result carries a Delta CRL Indicator. It also loads the
signing key from DER via -keyform DER, and checks that a mismatching
-keyform and a missing -key both make -gendelta fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:05:31 2026
(Merged from https://github.com/openssl/openssl/pull/31910)
Add coverage for encrypting the generated private key with a cipher,
checking it can only be read back with the correct passphrase, and that
a cipher is rejected together with the -genparam option.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/31893)
Run the fuzz corpora under mfail in addition to the normal path, so the
existing inputs also exercise malloc-failure handling. The fuzz.pl harness
sizes the mfail runs to a time budget and, on a leak, bisects down to the
exact file and injection point. Adds a budgeted asan/ubsan CI job to run it.
Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:43 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
It also fixes related memory leaks and removes extensive asserts that
should not be present in fuzzy tests.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:42 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
This adds an initial setup for unit testing on Windows that allows
mocking of system functions using Detour library. This works only for
library functions and not object function like wrap so it is a bit
limited but it is still useful for BIO mocking.
An initial BIO bss_dgram test is added covering the Windows specific
parts.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:00:35 2026
(Merged from https://github.com/openssl/openssl/pull/31915)
The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
routines through call_internal(), which on non-Win64 emitted a call to
the public global symbol by its bare name. These calls textually
precede the callees' .globl declarations, so x86_64-xlate.pl never
prepends the platform's leading underscore to the referenced symbol.
On ELF (Linux) that is harmless since symbols carry no leading
underscore, but on Mach-O (macOS) the call references the un-decorated
SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
_SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
breaking the darwin64-x86_64 link of libcrypto:
SHA3_shake128_x4_inc_absorb_avx512vl
SHA3_shake256_x4_inc_absorb_avx512vl
SHA3_shake128_x4_inc_squeeze_avx512vl
SHA3_shake256_x4_inc_squeeze_avx512vl
Call the local .L_<name> entry label instead -- the same address as the
public symbol and the pattern the finalize calls already use -- so the
reference resolves locally and these internal routines cannot be
interposed. The Win64 path is unchanged.
Fixes: https://github.com/openssl/openssl/issues/31941
Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration")
Assisted-by: Pi:z-ai/glm-5.2
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 14 12:33:50 2026
(Merged from https://github.com/openssl/openssl/pull/31942)
Create dummy encoder/decoder and store algs in p_ossltest.
They do nothing, except return algorithms on query. This allows our
unit test 30-test_evp_list_noncache.t to exercise the refcounting of
these objects when the provider requests no caching
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
https://github.com/openssl/openssl/pull/31782
Fixed method refcounting for EVP objects when the provider they are
fetched from requests no-caching, but I neglected to add simmilar
refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a
different fetch path (these use inner_[decoder|encoder|loader]_fetch
rather than inner_evp_generic_fetch.
They got missed because the p_ossltest provider that we use to test
these paths don't provide these objects, so the path never got
exercised.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:36 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Add a new CI workflow that runs AVX512 specific tests under Intel SDE
v10.8, since GitHub Actions runners do not currently have AVX512
hardware.
SDE emulates AVX512 instructions and spoofs CPUID so the AVX512 code
paths can be exercised.
Two jobs are included: linux (ubuntu-latest) and windows (windows-2022).
Each job builds OpenSSL with no-shared and enable-fips, then runs the
following tests under `sde64 -icx` (Icelake Server):
- ml_dsa_internal_test: exercises AVX512VL ML-DSA sampling
- sha3_x4_internal_test: exercises AVX512VL SHAKE x4 functions
- openssl fipsinstall: runs the full FIPS KAT suite (including ML-DSA
and SHA3 self-tests) against the FIPS provider under emulation
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:57 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Add a new `sha3_x4_internal_test` target and recipe to validate the
internal SHAKE x4 implementation against scalar SHA3 reference paths.
Cover SHAKE-128 and SHAKE-256 in one-shot and incremental modes, plus
multi-absorb and multi-squeeze cases across varied input and output
sizes. Tests are skipped when AVX512VL extensions are not available.
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:55 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Changes:
- Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported.
- Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl).
- Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules.
- Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable.
Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns
either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending
on the build and CPU capabilities.
- Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc,
included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined.
Co-authored-by: Tomasz Kantecki <tomasz.kantecki@intel.com>
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:54 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Make the check correctly handle versions such as '3.00rc8'.
It was incorrectly expecting major.minor.patch.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Mon Jul 13 15:48:03 2026
(Merged from https://github.com/openssl/openssl/pull/31420)
Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged
initialization. If no key has been installed, update still dispatched
into the uninitialized Poly1305 state, which can crash on POLY1305_ASM
builds.
Guard update with the same key_set check used by final and report no key set.
Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before
calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE.
Fixes#31332
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 13 15:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/31382)
The -sigopt and -vfyopt options of the x509 app were previously
untested. It adds a subtest that signs a certificate from a CSR with
-sigopt rsa_padding_mode:pss and verifies the issued certificate uses
the rsassaPss signature algorithm, and that verifies an SM2 CSR whose
self-signature uses a non-default distinguishing id supplied via
-vfyopt. It also checks that an unknown -sigopt or -vfyopt makes the
command fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:41:57 2026
(Merged from https://github.com/openssl/openssl/pull/31908)
A late AAD update (AAD supplied after the payload has started) must be
rejected, and reported the same way, for every AEAD. #31673 checked this
for ChaCha20-Poly1305 alone, so this change extends it to all AEADs.
test_evp_aead_late_aad covers both the encrypt and decrypt directions and
asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 13 15:40:39 2026
(Merged from https://github.com/openssl/openssl/pull/31906)
The -pkeyopt option of the req app was previously untested. It adds a
subtest that generates an EC request with -pkeyopt
ec_paramgen_curve:P-384 and verifies the selected curve is used, and
that an unknown -pkeyopt value makes the command fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:36:42 2026
(Merged from https://github.com/openssl/openssl/pull/31905)
Add coverage for the -rev option of the pkeyutl app, checking that the
input buffer is reversed before the operation and that -rev is rejected
together with raw input.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/31891)
Add coverage for the DER (ASN.1) output of the dsaparam app, exercising
both the parameter output (i2d_KeyParams_bio) and the -genkey private key
output (i2d_PrivateKey_bio).
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31888)
Add coverage for the -modulus option of the dsa app, checking the
public value is printed for both private and public key input.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:31:54 2026
(Merged from https://github.com/openssl/openssl/pull/31887)
Exercise the previously uncovered show_digests() path in dgst app by
adding a subtest that runs "openssl dgst -list". It checks the header
and that sha256 and sha512 are listed, without assuming the full set of
digests which depends on the build configuration.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:05:45 2026
(Merged from https://github.com/openssl/openssl/pull/31886)
Add test/ocsptest.c, exercising check_cert_ocsp_resp() in x509_vfy.c
through X509_verify_cert() with X509_V_FLAG_OCSP_RESP_CHECK and
responses attached via X509_STORE_CTX_set_ocsp_resp(). This path was
previously only covered indirectly through the TLS multi-stapling
tests in sslapitest.c.
The test builds signed OCSP responses at run time from a flat
root -> leaf PKI (the root is both the trust anchor and the authorized
responder), and covers the good, grace-period, non-successful status,
expired, no-response, and wrong-certificate cases, plus a mfail run
over the success path. The PKI is generated by the test-tools ocsptest
command.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31828)
Cover the previously untested -RSAPublicKey_in and -RSAPublicKey_out
options of the rsa app, which select the PKCS#1 RSAPublicKey structure
rather than the SubjectPublicKeyInfo used by -pubin/-pubout. The new
subtest checks that the RSA PUBLIC KEY header is written, that the
encoding round-trips, and that it is interchangeable with the
SubjectPublicKeyInfo form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:01:22 2026
(Merged from https://github.com/openssl/openssl/pull/31802)
Exercise the previously untested -param_enc option of the ecparam app
by round-tripping the secp384r1 fixtures between named_curve and
explicit encodings (compared byte for byte against the reference
files), and check that an invalid value is rejected.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Exercise the previously untested -param_enc option of the ec app,
covering named_curve and explicit parameter encodings (compared
against checked-in reference encodings) as well as rejection of an
invalid value.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Exercise the previously untested -ec_param_enc option for pkey,
covering named_curve and explicit parameter encodings as well as
rejection of the option on a non-EC key.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:59:39 2026
(Merged from https://github.com/openssl/openssl/pull/31798)
The fake cipher provider was only available in-process, linked into test
binaries via fake_cipher_start(). To exercise app success paths (e.g.
skeyutl -genkey) the openssl app needs to load it as a provider module the
same way it loads legacy.
Make test/fake_cipherprov.c dual-buildable: drop the testutil dependency so
the source links cleanly into a module, add an OSSL_provider_init entry point
under FAKE_CIPHER_AS_MODULE, and add a fake-cipher MODULES target in
test/build.info. Also implement skeymgmt generate so opaque key generation
works, and cover the skeyutl -genkey success path in 20-test_skeyutl.t.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:58:53 2026
(Merged from https://github.com/openssl/openssl/pull/31781)
In FIPS mode EC keygen was doing 3 self tests.
ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and
ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and
comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4.
These tests covered both Keygen PCT for Key Agreement and Signatures.
ossl_ec_key_pairwise_check() was also being called from within ec_gen().
The advice from Atsec (lab) is that the sign/verify test within
ecdsa_keygen_pairwise_test() is sufficient according to the updated
rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of
the generated key is unknown at the time of key generation.
Detected during testing of Jipher by Roshith Alankandy (Oracle).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:47:00 2026
(Merged from https://github.com/openssl/openssl/pull/31761)
Introduce `reduce_twice_signed` that reduces from `(-2q,q)` to `[0,q)`.
Fix `montgomery_multiplication_vectorized` in `ml_dsa_ntt_vec128.c`
by calling `reduce_twice_signed` at the end of the computation ensuring
that the result is in `[0,q)` and not only in `(-2q,q)` or `(-q,q)`.
Do not call `reduce_once_signed` in `ossl_poly_ntt_mult_scalar_vec128`
and at the end of `ossl_ml_dsa_poly_ntt_inverse_vec128` anymore as it is
not necessary anymore after `reduce_twice_signed`.
Without this fix, keygen, sign or verify might fail or produce wrong
results.
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Mon Jul 13 14:45:11 2026
(Merged from https://github.com/openssl/openssl/pull/31744)
The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.
With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.
RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.
Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.
Closes#31635Closes#26101Closes#31629
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:41:34 2026
(Merged from https://github.com/openssl/openssl/pull/31695)
We do this odd thing in rio_notifier. when we initalize it, we call a
run_once routine to call WSAStartup(), create a lock and init a
refcount. The purpose of those last two items is to track the refcount
so that we record how many times we init that rio notifier. when the
refcount reaches zero, we tear down the windows socket api by calling
WSA cleanup, destroy the lock and refcount, and then re-initzlize the
run_once gate.
That last step is sketchy. Even though our implementations of run_once
allow doing so, we should never be re-initing those gates, as its going
to be very prone to races, and they are, well, run_once, so we should
only run them once.
It would be nice to get rid of that behavior, which we can fortunately
do.
https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-wsastartup
Indicates that WSAStartup is internally refcounted, so instead of just
calling it once and tracking when we need to correspondingly call
WSACleanup(), just call it every time we initalize an rio_notifier
object, and call WSACleanup when we tear it down. The Winsock api will
take care of knowing when it actually needs to be cleaned up for us. As
such we can eliminate the run_once routine, the refcount and the lock
entirely.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 13 14:26:58 2026
(Merged from https://github.com/openssl/openssl/pull/31777)
Sampled tests cap allocation-failure injection at a fixed number of
sampled points, running exhaustively when the allocation count is below
that. Non-sampled tests fall back to counting only on non-cached-fetch
builds, where exhaustive injection is impractical.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 09:43:50 2026
(Merged from https://github.com/openssl/openssl/pull/31780)
asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers
commonly loop, decoding concatenated DER values until the call fails, and
rely on a failure with no queued error to recognise a clean end of input.
CPython's ssl module does this in _add_ca_certs() when loading the Windows
certificate store via SSLContext.load_verify_locations(cadata=...); it
re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
fatal.
Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
The rewrite in commit 35852da1d9 carried this behaviour forward. As a
result Python 3 on Windows fails to initialise an SSLContext with:
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
middle of an object (some bytes already buffered), or on an EOF while still
inside an indefinite-length value awaiting its end-of-contents octets - all
of which are genuine truncation. A clean EOF at a top-level object boundary
again fails without queuing an error, restoring the long-standing behaviour
that looping callers depend on.
Add regression tests covering the clean-EOF, truncated, indefinite-length
truncation and partial-header cases, and document the read behaviour in
ASN1_item_d2i_bio(3).
Fixes#31807
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 08:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/31818)
Similar to Windows CE, Windows Itanium has not had a
toolchain to work on it since VS 2010, and Windows
server 2008 was the last thing that ran on it.
This does *not* change the other (linux, HPUX) targets
which have modern toolchain support, and likely even still
run these days.
While never letting go seems noble when you won't share
the door you're floating on, the time has come.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 17:39:39 2026
(Merged from https://github.com/openssl/openssl/pull/31913)
Add NAME_CONSTRAINTS_check() coverage for empty directoryName
subtrees in both excluded and permitted constraints.
The tests assert the existing results in ordinary builds and catch
the NULL memcmp() argument when run under UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:03 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.
Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.
Fixes#31687Fixes#31688
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
Add memory-failure injection coverage to rand_test for the full
RAND_bytes_ex/RAND_priv_bytes_ex stack on a fresh library context, the
SEED-SRC entropy acquisition and the CTR-DRBG operations with a
TEST-RAND parent. The cipher fetches used by the DRBG setup are warmed
up outside the injection window so that the injection targets the RAND
machinery itself.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
The DRBG instantiation probes the parent nonce callback with a NULL
output buffer to obtain the nonce length before requesting the actual
nonce. The generate mode branch of test_rng_nonce() wrote the bytes
without checking the output pointer, crashing when TEST-RAND with
generate=1 is used as a DRBG parent. The entropy-buffer branch already
handles a NULL output correctly.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Fixed invalid-pointer-pair in the existing branch by ensuring thisex != NULL
before subtraction.
Fixes#31689
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:40:21 2026
(Merged from https://github.com/openssl/openssl/pull/31875)
Specifically bring them closer to the suggested naming conventions
and make them clang-format compliant.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:20 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
To be at the prototype site in the internal header file.
The major reason *Why* we would like to have Doxygen style comments
describing what internals do is so that they work with modern IDE's
since most common ones support them.
It's wonderful to be looking at an internal function, thinking "wtf is this",
and be able to hover over it and - boink - up comes the docs. This
typically only works (or works better) when the Doxygen comment is
at the prototype site, not if it is at the implementation site.
This also reinforces the requirement that "yes you do this for shared
functions but you don't need to for statics".
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:18 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
So this repatriates DOCUMENTATION.MD from the web page to the
code base, and links both STYLE.MD and DOCUMENTATION.MD from
CONTRIBUTING.MD
It does a large rototilling of STYLE.MD to address many of the
outstanding concerns noted when I started this before clang-format
last year, and brings us roughly in line with the things that are
addressed in similar style guides for other projects.
Most of the changed or updated reccomendations reflect what we
currently have been doing, or have expressed as a desire to
move to in the future.
Most larger "OpenSSL-isms" I've tried to explicitly call out
to make this a more cohesive and useful guide for a new contributor
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:16 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
This is effectively, the current coding style policy web page
changed to accomodate clang-format. This is more or less the
same file I have had in the various clang-format sample PR's since
September.
It does include an additional sections on Integers and on
Return Values that are not in the original coding style
policy
It is changed from the September version in that it does not
have mention of keeping include files self contained. I believe
that is achievable and desirable, but I think should be done
as a separate change from this.
There were a number of issues brought up in discussion of this
file in the clang-format PR's. I recorded those in 818, 819,
820, 821, 822, 823, 824, 825, and 826, which we can
link in there to the appropriate section of the document.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:13 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
The thread-assisted idle test advances fake time in 10ms steps while the
connection is kept alive solely by the background assist thread sending
keepalive PINGs. The test stepped fake time without checking that a due
keepalive had actually been sent, so whether it went out before the
server's idle deadline lapsed depended on thread scheduling - hence the
intermittent failure.
Now, before each step, check the event timeout (next_deadline minus
fake-now): while a keepalive is still due to be sent it stays at zero, so we
wake the assist thread and re-check without advancing until it goes positive
(or the existing real-time watchdog fires). Only then do we step fake time.
The negotiated 30s idle timeout and 60s idle duration are unchanged, so the
keepalive is still required and still tested; only the race is removed.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:33:45 2026
(Merged from https://github.com/openssl/openssl/pull/31746)
MinGW-w64 has provided bcrypt headers and import libraries since
version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding
path for supported MSVC builds. Enable the existing direct
BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or
newer, and link MinGW builds with bcrypt alongside the other Windows
import libraries.
Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined
by both the 32-bit and 64-bit MinGW-w64 toolchains.
Builds targeting older Windows versions keep the CryptoAPI fallback
because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is
below 0x0600.
Fixes#13878
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 12:05:09 2026
(Merged from https://github.com/openssl/openssl/pull/13882)
Spotted by idrassi on review. thanks!
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:21 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Now that C99 is the base level, and we are no longer supporting old
GCC's, The ossl_bio__printf__ / ossl_test__printf__ indirection only existed
to pick the gnu_printf attribute over the printf attribute for MinGW's MS-CRT printf, but
MinGW is already excluded by the outer guard, so we can use the modern attribute
everywhere this code runs.
Spotted by idrassi on review, thanks!.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:19 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
The minimum gcc to compile our code appears to be version 9, and
we are now C99.
All these older checks become a tautology on anything that will
build a modern OpenSSL tree, so clean this up.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:17 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
The only Watcom-specific code in the tree was a <tchar.h> _vsntprintf
mapping in crypto/cryptlib.c. There is no Watcom entry in Configurations/,
no CI job builds with Watcom, and the tree has had no other Watcom-aware
code in many years. The _vsntprintf symbol is supplied by <tchar.h>
on every supported Windows toolchain (MSVC, MinGW), so the conditional
fallback is dead.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Decouple the ec_point_formats extension from TLS 1.2 X.509
selection and acceptance. Remove tls1_check_pkey_comp() and its
callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3
disregards the extension already, and we can decode any point form
a peer might send, so refusing a compressed peer cert in TLS 1.2
because we didn't advertise compressed buys nothing.
The RFC 4492/8422 section 5.1.2 requirement that the peer's list
contain "uncompressed" used to be enforced in a final hook on the
client side only. Move it to the two points where the negotiated
ciphersuite is known: the client's ServerHello parse hook, and the
server's ServerHello construct hook. Both sites fire the alert
only when an ECC TLS 1.2 ciphersuite has been negotiated, so a
missing "uncompressed" is ignored under TLS 1.3 or a non-ECC
cipher. The client- and server-side parse hooks now share one
function.
Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL;
our own list is built directly inside the constructors. The
peer's list continues to be stored verbatim, and is also exposed
through the SSL_get0_ec_point_formats() accessor (now documented).
New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS
1.2 vs 1.3) plus that a compressed point form EC cert is usable on
both sides without any opt-in.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.
Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped. Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.
EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.
Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
This is a helper script that can be used to provide a boilerplate code.
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:15 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
This adds the unit testing framework that extends the build so it can
be enabled and tests are built. It is executed as part of the test
using a recipe which executes all unit tests.
The documentation is added with more info about writing the unit tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
The unit-test configure option exists only to expose the
SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
Instead of renaming it, deprecate the option and the SSL_test_functions()
function so both can be removed in OpenSSL 5.0.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:13 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
This is used for adding per target --wrap ld flags for each listed
function.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:12 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)
Commit 774525b38b moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.
Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.
Fixes#31755
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)
Set a verify tag while decrypting (which must succeed) before
attempting the read, so the test asserts that a tag cannot be read
back while decrypting even when one is _actually_ present.
This isolates direction logic from tag present logic.
Follow-up to #31734
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:06:40 2026
(Merged from https://github.com/openssl/openssl/pull/31826)
The NID_keyBag branch of dump_certs_pkeys_bag() was not exercised.
Export a file with -keypbe NONE and dump it, checking the key bag is
reported and its private key is output.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 18:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/31665)
Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.
The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.
Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.
SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).
SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().
SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Usually Emscripten emulates `/dev/urandom`, but in some cases,
like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms,
where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed
its PRNG. This fixes that by instead using the POSIX function it
implements, like which was already done for WASI.
See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 17:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31882)
(cherry picked from commit dc219a0408)
We've been concerned about ubsan errors comming with more recent
versions of clang. specifically versions of clang later than 17
generate hundreds of function pointer type validation errors, i.e.
assigning a function of type void (*)(TYPE *) to a function pointer of
type void (*)(void *).
Fixing these requires the creation of lots of thunk function that get
littered through the code base, and are generally unpleasant to carry.
A better fix requires siginficant code refactoring, and potentially
large changes to our ABI, which we can't support until the next major
release.
So, for now, just suppress those ubsan errors, so we can more properly
deal with the issue when we are able.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 16:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31837)
The standalone property_memfail.c program is superseded by memory-failure
tests added directly to property_test.c using the MFAIL harness. They
cover the same property store API surface under allocation failure
injection: ossl_method_store_new, ossl_method_store_add,
ossl_method_store_cache_set and the providerless ossl_method_store_cache_get
lookup, plus the method == NULL cache_set branch.
Unlike the old NO_CHECK-only program, the new tests run as checked mfail
tests, verifying both clean error propagation and the absence of reference
leaks on every failure path. The old program also relied on a stale,
pre-lockless STORED_ALGORITHMS layout to poke the cache directly, which no
longer matches property.c.
Drop property_memfail.c along with its wiring in test/build.info and the
90-test_memfail.t recipe.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 13:05:16 2026
(Merged from https://github.com/openssl/openssl/pull/31880)
They are failing and thus the coveralls output is not produced.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 12:20:03 2026
(Merged from https://github.com/openssl/openssl/pull/31878)
BIO_vprintf() first formats into a 512-byte stack buffer. Since
vsnprintf() returns the required length excluding the NUL, a return
value of 512 means truncation. The old strict greater-than check
therefore wrote the truncated buffer for exactly 512-byte output.
Use >= for the realloc path and add boundary coverage for 511-, 512-
and 513-byte outputs.
Fixes: a29d157fdb "Replace homebrewed implementation of *printf*() functions with libc"
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31842)
Commit aa4b47483f "Fix util/mkinstallvars.pl to treat LIBDIR
and libdir correctly" added more logs while bc44134c32 "Configure:
Remove extensive debug output by default" was under review, so those
were missed.
Complements: bc44134c32 "Configure: Remove extensive debug output by default"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 11:03:11 2026
(Merged from https://github.com/openssl/openssl/pull/31843)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:22 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:20 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:18 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:16 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:15 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Since return is an operator and not a function, parentheses
are not required.
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:13 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:11 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Replace #ifdef HTTP_DAEMON with #ifndef OPENSSL_NO_POSIX_IO for code
that only requires POSIX {,f}stat(), improving portability.
Retain syslog() call only when HTTP_DAEMON is defined, use
BIO_printf(bio_err) otherwise.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:43 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
Call stat() instead of fstat() when the FILE pointer provided
by BIO_get_fp() is unavailable (as it may be the case in case of UPLINK
builds).
Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:42 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
On Windows with UPLINK enabled, BIO_get_fp() may return a FILE * pointer
incompatible with the C runtime. Ensure that it returns NULL instead,
preventing undefined behavior in applications. Update the documentation
to include the missing return type for BIO_[gs]et_fp() and remove
the mention that BIO_get_fp() never returns 0, as it does so now
when NULL fp is returned.
Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:40 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
EVP_MD_CTX_copy_ex() might crash on an NULL pointer access when an
inconsistent context is copied. This happens when a context is copied
where digest is set but algctx is NULL, i.e. due to an incomplete
initialization.
The copyctx shortcut for cases where the in and out contexts use the
exact same digest call the copyctx function attempting to copy
the algctx, but it does not check if algctx is NULL on the in or out
contexts.
Fix this by only taking the copyctx shortcut if algctx is non-NULL on
both, in and out. Otherwise use the full copy path which will only
duplicate the algctx if it is non-NULL.
Closes: https://github.com/openssl/openssl/issues/31831
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31867)
This is because ML-KEM change from #31432 is not backported there.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 7 16:36:07 2026
(Merged from https://github.com/openssl/openssl/pull/31870)
when sk_X509_OBJECT_push() fails after x509_object_dup() has already
allocated the duplicate, the dup is neither stored on the destination
stack nor freed: the error path only pop_free()s the stack the dup was
never pushed onto, so it is leaked.
Set env ASAN_OPTIONS in test explicitly to detect_leaks=1 to force
ASAN to fail the test. Otherwise, the test reports ok even with valid
leak.
Fixes: 08cecb4448 "Add X509_STORE_get1_objects"
Fixes: https://github.com/openssl/openssl/issues/31771
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 7 07:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/31784)
The new statem client tests added in comimt c36a9b4 assume that if
OPENSSL_NO_DTLS is not defined, that we have DTLS support, but we have
this odd setup in which we can have DTLS enabled, but DTLS1_2 disabled,
in which case the needed support isn't present, and the test fails.
why we have it setup that way, I'm not sure, but we should only run the
dtls tests if both DTLS and DTLS1_2 support is available.
Fixes#31851
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 6 09:42:44 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
This tests handshake level phase using mfail covering SSL_do_handshake.
It is a test for #31323.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:57:38 2026
(Merged from https://github.com/openssl/openssl/pull/31324)
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:53:24 2026
(Merged from https://github.com/openssl/openssl/pull/30857)
This function should never have existed. Its a TOCTOU waiting to
happen. Now that we've eliminated all internal uses, and given that its
an internal function, send it to a nice farm upstate, where it can run
and play with all the other functions that shouldn't have been.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
BIO_free_all makes use of CRYPTO_GET_REF to determine if there is
another user of a BIO chain at some artibrary point within the chain.
But CRYPTO_GET_REF is begging for a TOCTOU error, and so we're
deprecating it.
replace the use of GET_REF with an internal version of BIO_free that
returns the value of the resultant ref count, and use that instead, so
we are TOCTOU free
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:13 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
CRYPTO_GET_REF is almost by definition a TOCTOU race, and we shouldn't
use it.
As part of the effort to deprecate it, eliminate its use from
sslapitest.
Avoid the use-after-free possibility by getting a session with
SSL_get1_session (which increments the refcount) and freeing it after
we're done with it.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:10 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
The -keyform, -CAform and -CAkeyform options were not covered. Add a
test that self-signs a CSR with a DER-encoded key and signs a CSR with
a DER-encoded CA cert and CA key.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/31733)
Cover the previously untested PVK code paths of the dsa app: round-trip
the test key through the PVK encoding (mirroring the existing rsa PVK
test, and skipped unless rc4, legacy and pvkkdf are enabled), and check
that requesting PVK output for a public key input is rejected.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:30:48 2026
(Merged from https://github.com/openssl/openssl/pull/31801)
Changed internal prov_drbg_st member variable from DRBG_STATUS
to int to reflect how it was actually used.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 3 19:29:47 2026
(Merged from https://github.com/openssl/openssl/pull/31745)
The CRL signature verification path was not exercised. Add a test that
verifies a CRL signature against its issuer certificate supplied via
-CAfile, -CAstore and -CApath.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31736)
The OPT_SET_SERIAL case in req_main() was not covered. Add a test that
generates a self-signed certificate with an explicit -set_serial value
and checks it, plus the error path when -set_serial is given twice.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:25:05 2026
(Merged from https://github.com/openssl/openssl/pull/31730)
Exercise the previously uncovered X509_V_FLAG_USE_DELTAS path in
get_delta_sk(): a current delta CRL revoking kLeaf must be honored.
The base and delta CRLs are generated by `ossl-test-tools crltest delta`.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jul 3 19:22:29 2026
(Merged from https://github.com/openssl/openssl/pull/31714)
The crls != NULL block of pkcs7 -print_certs was not exercised. Build
a PKCS#7 structure containing a CRL with crl2pkcs7 and check the CRL is
both printed and output in PEM form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 3 19:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/31666)
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously
merged adjacent entries with an in-place loop that called
sk_..._delete() after each merge, making the merge O(N^2) due to the
per-merge stack shift.
Replace the merge with a single linear sweep using a write index
distinct from the read cursor: mergeable entries fold into the
previous output's upper bound in O(1), non-mergeable entries are slid
forward into the write slot, and the source slot is set to NULL so the
ASN.1 free machinery cannot double-free on a subsequent abort.
Canonicalisation is now O(N log N) overall, bounded by the existing
sort.
Mixed-state-on-error safety is provided by the caller's normal
teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set
replaces without freeing the displaced value, and
ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on
an inner failure leaves the stack in a state that the choice's normal
free path handles cleanly.
New regression tests in test/v3ext.c at N=8192 cover the all-merge,
no-merge, interleaved (slide-forward), range-merge,
overlap-mid-sweep, and inverted-range-mid-sweep paths; the
mixed-state teardown invariant is exercised under ASan + UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Jul 3 19:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/31147)
Previously the cross-compile workflow only ran the EVP tests on pull
requests, with the full test suite done only for push events. Allow the
full suite to run on a pull request when it has the 'extended tests'
label which is already used for extended tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 3 14:39:38 2026
(Merged from https://github.com/openssl/openssl/pull/31705)
Use openssl list, which uses EVP_*_do_all_provided on non-caching
algorithms. The do_all_provided path callbacks expect the algorithms
that are looked up to be saveable via up_ref, so this, when run under
asan, makes for a good test to ensure we don't trigger any use after
free situations when not caching algs.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Add the ability to direct p_ossltest to request no caching so that we
can test the provider driver non-cache code path.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:15 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
We recently removed reference counting for EVP objects, but kept the
refcounting when we build with no-cached-fetch.
There is a corner case in which providers in builds that do caching may
still request non-caching by setting *no_cache = 1 in their query
operations.
OQS tripped over this here:
https://github.com/open-quantum-safe/oqs-provider/pull/787
When a provider requests no caching, we need to treat those algorithms
as though we are running in a no-cached-fetch build and still do ref
counting on them.
Teach our algorithms implementation to understand when a provider is
requesting non-caching, mark them as such and ref count only those.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:13 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Coverity complains that the switch statements in PEM_X509_INFO_read_bio_ex()
switches on PEM_INFO_NONE, while the enclosing condition
(itype != PEM_INFO_NONE) explicitly rules it out. Pacify it by changing
the switch case to default (not removing it to avoid triggering
-Werror=switch).
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695453
Complements: 0e8f2844ed "fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
This adds test for #31268 with using SSL_read for QUIC client and
forcing key update.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Jul 2 07:21:14 2026
(Merged from https://github.com/openssl/openssl/pull/31272)
evp_asym_cipher_from_algorithm, in its error path frees the allocated
cipher with EVP_ASM_CIPHER_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_asym_cipher_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695449
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:25 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_signature_from_algorithm, in its error path frees the allocated sig
with EVP_SIGNATURE_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_signature_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695450
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:23 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
keymgmt_from_algorithm, in its error path frees the allocated keymgmt
with EVP_KEYMGMT_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keymgmt_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695452
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:21 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_keyexch_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keyexch_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695455
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:18 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_kem_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_kem_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695456
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:16 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
The shutdown-side drain uses a TCP half-close and a fixed 500 ms
select() timeout to let peers consume buffered alerts before close.
Running it for DTLS/QUIC datagram connections causes an unnecessary
delay after the connection has otherwise completed.
Limit this workaround to non-DTLS, non-QUIC connections.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 13:35:53 2026
(Merged from https://github.com/openssl/openssl/pull/31558)
In www_body() and rev_body(), con = SSL_new(ctx) is called before
rpk_enable(con), but ownership of con is transferred to ssl_bio only
later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code
jumps to err: before that transfer without freeing con, leaking the SSL
object.
Add SSL_free(con) before goto err in both rpk_enable() failure paths,
matching the adjacent SSL_set_session_id_context() and BIO_new_socket()
error paths. sv_body() is unaffected because its err: block already
frees con.
The global rpk_files is not leaked. Its lifetime is managed
by s_server_main(), which frees it in the end cleanup block.
Resolves: https://github.com/openssl/openssl/issues/31769
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 12:04:13 2026
(Merged from https://github.com/openssl/openssl/pull/31789)
applink.c deliberately stores legacy CRT function pointers because
ms/uplink.h expects the old fopen and _open signatures. Keep the
table entries unchanged and suppress MSVC warning C4996 locally
around OPENSSL_Applink() instead of switching to fopen_s or
_sopen_s.
Fixes#8241
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 09:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/31765)
After the windows.h include optimization introduced in
commit 1eaf29ef6c, the _WIN32_WINNT default was changed, causing
performance regressions.
Currently, _WIN32_WINNT is defined as 0x0501, which means WinXP.
This causes the code to be compiled with WinXP-compatible code, notably
- without USE_RWLOCK
- using legacy thread implementation
- legacy RNG seeding (no BCryptGenRandom)
This patch increases the requirement to 0x600 (Windows Vista).
Note that code running on WinXP cannot currently be compiled with
any default configuration, as supported compilers generate executables
for Windows Vista and above.
If we provide some way to support WinXP, it can be done by
redefining _WIN32_WINNT.
Resolves: https://github.com/openssl/project/issues/2010
Fixes: 1eaf29ef6c "Remove direct includes of windows.h where possible"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
Current path for Windows RNG (for Vista and above) should
use BCryptGenRandom() function but the symbol is not included
in platform_symbols.
The issue was hidden before commit 1eaf29ef6c reordered
Windows header inclusion.
Moreover, a cast to ULONG is required for strict warnings build.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:17 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
For the re-init case where only the IV is specified, but no key, the 'nap'
field must also be initialized.
Instead of setting the s390 specific fields in a special case block, call
ctx->hw->init() also in this case. It performs the necessary setup already
(when the KM function code was once set already).
Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also
be called with a NULL key. It then only performs the IV setup as well as
setting up the 'nap'.
Closes: https://github.com/openssl/openssl/issues/31766
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Jul 1 09:12:26 2026
(Merged from https://github.com/openssl/openssl/pull/31775)
When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.
The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).
The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.
Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.
Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.
Fixes: 0499de5add "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)
When two providers cache the same nid and property query, the first one
to do so must own the providerless cache entry, so that a NULL-provider
lookup keeps resolving to that provider. This covers commit 9d476175d7.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 11:01:57 2026
(Merged from https://github.com/openssl/openssl/pull/31738)
The DTLS 1.2 tests exercise the same verification logic and confirm that the
behavior matches the TLS 1.2 implementation. The tests pass as expected and
provide additional coverage for DTLS 1.2 without requiring any functional
changes.
Fixes#31250
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 30 11:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/31389)
What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)
Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.
Fixes: https://github.com/openssl/openssl/issues/31195
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
Nothing set the "vfy" parameters in any of these functions to anything but 0.
Remove the parameter and stage things related to SSL_OP_SECOP to go away in the
future.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
I've been down this road a few times and nhorman@ just hit it.
While technically true, most of our opaque pointers have internal
defninitions. Stop people going down the garden path by explaining
what this is
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 09:51:37 2026
(Merged from https://github.com/openssl/openssl/pull/31708)
The signerfile != NULL block in smime_main(), reached when more than one
-signer is given (including the case where a preceding -inkey leaves
keyfile != NULL), was not exercised: the existing multi-signer tests run
through the cms command, and the smime app was only ever run with a
single signer. Add a two-signer test, with an explicit -inkey, to the
pkcs7 test set so it runs through smime when signing.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jun 30 08:57:47 2026
(Merged from https://github.com/openssl/openssl/pull/31675)
This tests memory failures in remote connection ID manager code.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:45 2026
(Merged from https://github.com/openssl/openssl/pull/31602)
Add a record layer test that executes qrx_process_pkt() under mfail
on a freshly created qrx whose rx_free freelist is empty. This
deterministically lands the qrx_ensure_free_rxe() call for the first
packet of a multi-packet datagram among the enumerated injection points
which is the precondition for triggering assert failure in
qrx_validate_hdr_early(). The test reuses rx_script_5's coalesced
Initial+Handshake+1-RTT datagram and only provides the Initial secret,
since the bug fires before any decryption is attempted.
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:00 2026
(Merged from https://github.com/openssl/openssl/pull/31331)
Add a new test which calls tls_construct_client_hello() directly,
creating an SSL_CONNECTION enough to invoke the construct function
without making a full handshake, then verifies the produced
ClientHello structurally and by round-tripping it through the
server-side tls_process_client_hello().
The covered branches include TLS 1.3 (with and without middlebox
compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS
cookie and client_random reuse paths, the deterministic error branches
(WPACKET overflow and no usable ciphers), and the ECH wrapper path
(happy path with server-side decryption, the TLS 1.2 version error, and
OOM). Out-of-memory branches are exercised with the mfail tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Previously this just resulted in the skip of the group but such failure
should result in a proper error. This is not a big issue but it impacts
mfail tests so it would be good to fail.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:47 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
We've tried to fix this properly using InitOnceExecuteOnce, but it
results in an ABI breakage, so we're doing it this way.
on windows, CRYPTO_THREAD_run_once, on weakly memory ordered systems,
may complete the write of the run once variable lock before some of the
writes made by the init callback routine complete. The result is that
on a heavily multithreaded application, other therads may see the data
that was meant to be in an initalized state, as in some erroneous
in-between state, leading to errors.
Fix it by inserting a full memory barrier after we return from the init
callback, and prior to setting the run once variable to ONCE_DONE.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 08:51:16 2026
(Merged from https://github.com/openssl/openssl/pull/31713)
The RIO notifier smoke test is currently limited to
Windows targets in both the build metadata and the
test recipe.
The test exercises the notifier abstraction and can
run on other platforms as well, so this removes the
Windows-only guards.
The test remains conditional on QUIC being enabled.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jun 30 08:49:54 2026
(Merged from https://github.com/openssl/openssl/pull/31494)
Also fixes a bug in the OP_STREAM_RESET macro
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 07:54:46 2026
(Merged from https://github.com/openssl/openssl/pull/31707)
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
The default provider stored two function pointers from the core
dispatch table (c_gettable_params, c_get_params) in file-scope statics,
written by ossl_default_provider_init() without any synchronization.
When OSSL_PROVIDER_load() is invoked from multiple threads concurrently,
TSAN reports a data race on both writes[1].
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the default provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
[1] https://github.com/openssl/openssl/issues/28935
CLA: trivial
Resolves: https://github.com/openssl/openssl/issues/28935
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:52 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
This slightly improves openssl pkey text coverage.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Jun 28 17:42:46 2026
(Merged from https://github.com/openssl/openssl/pull/31521)
Since tmpstring's ownership is transferred to tmp in ASN1_STRING_set0(),
it should be allocated using OPENSSL_strdup() and not strdup()
(as it will be freed with OPENSSL_free() in ASN1_STRING_clear_free()).
Also, don't try to free tmpstring on error, as at no point there is a jump
to err when tmpstring is allocated and not owned by tmp.
Reported by Coverity, issue 1695274.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695274
Fixes: 68c0321e90 "Provide ASN1_STRING_new_not_owned()"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 28 16:22:28 2026
(Merged from https://github.com/openssl/openssl/pull/31667)
This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly
written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1,
OFB128, CTR).
Expanding macro-generated functions improves overall code readability, allows
code navigation tools to properly index the function signatures, and provides
clearer stack traces during debugging.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are
shared across multiple hardware-specific provider implementations but lacked
the internal `ossl_` prefix. They have been renamed to
`ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update`
respectively to follow OpenSSL naming conventions and prevent potential
namespace collisions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from
individual mode-specific files into a single unified file
(cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to
improve code organization and maintainability.
Additionally, this change removes the unused `keybits` parameter from several
SPARC T4 hardware initialization routines to clean up the internal API.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and
XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file.
Centralizing the platform-specific logic simplifies the code structure and
improves maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:58 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
A new helper function, zvkned_key_schedule_supported, is introduced to
centralize the verification of 128-bit and 256-bit key lengths.
This replaces multiple duplicated, hardcoded checks across the RISC-V AES
implementations to improve code readability and maintainability. It also
ensures consistent check handling for XTS mode by correctly evaluating half
the key length.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:56 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM,
and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need
for separate files for GCM and CCM, and extracts RV64-specific XTS code from
the generic XTS hardware file, improving code organization.
Additionally, remove the unused `keybits` parameter from the RV64 AES hardware
retrieval functions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:54 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM,
and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the
need for separate files (`cipher_aes_gcm_hw_rv32i.c` and
`cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally,
unused `keybits` parameters are removed from the provider hardware
initialization functions to clean up the code.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:52 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the ARMv8-specific hardware implementations for AES GCM into a single
consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific
optimizations together to improve code organization and maintainability.
Additionally, remove the unused `keybits` parameter from the ARMv8 provider
functions to simplify the function signatures.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:50 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes
from individual mode files into a single consolidated file
(`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations
together, improving code organization and maintainability.
As part of this refactoring, the unused `keybits` parameter was removed from
several AES-NI provider functions, and necessary XTS initialization and
context copy functions were exported for shared use.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc`
to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW`
dispatch structure.
This refactoring removes standalone initialization wrappers and integrates the
s390x hardware backend more cleanly with the generic AES-XTS provider code. It
also reduces code duplication by relying on the generic layer for common
validations (such as the maximum blocks per data unit limit) before invoking
the hardware-specific stream cipher.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:46 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Replace complex AES XTS initialization and hardware selection macros
(`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and
`PROV_CIPHER_HW_select_xts`) with standard C functions.
Architecture-specific initializers, particularly for RISC-V, are consolidated
to evaluate CPU capabilities within dedicated initialization functions rather
than relying on macro expansion. This refactoring improves overall code
readability, maintainability, and simplifies debugging by eliminating opaque
multi-statement macros.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:44 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The hardware-specific AES CCM implementations were previously included
directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them
to standalone `.c` files and updates the build configuration, improving
modularity by treating them as separate compilation units.
Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new
`ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code
duplication, removes unsafe macro logic, and introduces proper error handling
during provider key initialization.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:42 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Replace architecture-specific `.inc` files with standalone `.c` files for AES
ciphers and consolidate CFB mode logic into these new modules.
This eliminates the direct inclusion of source files and compiles each
hardware implementation as a separate translation unit.
This refactoring simplifies code organization and remove macro
complexity that makes it hard to understand what is implemented and
where enhancing maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:40 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper
function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA
GCM, the macro expansion was manually inlined.
This refactoring eliminates a multi-line macro to improve debuggability and
type safety. Crucially, the new function checks the return value of the
underlying key setup routines, ensuring that key initialization failures are
now correctly caught and propagated instead of being ignored.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
These files have no reason not to be just regular .c files.
Additionally apply formatting fixes which were not done on .inc files
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:35 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
After removal of Win CE support in commit c60fddbbcf "Drop Windows CE
support.", this file is no longer used. Remove it.
Complements: c60fddbbcf "Drop Windows CE support."
Reported-by: Nikola Pajkovsky <nikolap@openssl.org>
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 17:36:16 2026
(Merged from https://github.com/openssl/openssl/pull/31718)
OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme. The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed. Add OPENSSL_free(scheme) before the goto.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: e599893a9f "x509: allow SAN URIs to contain userinfo"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: 4acc3e907d "Initial support for certificate policy checking and evaluation."
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Because the duplicate test expects the cache get operation to take
a reference count (which we no longer do), we need to not count it down
before checking the resulting ref count
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:17 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:13 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:05 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:02 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:00 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:51 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
The -cipher option was not covered. Add KRB5KDF test cases that
exercise it, both via -cipher and the equivalent -kdfopt cipher: form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:01:33 2026
(Merged from https://github.com/openssl/openssl/pull/31651)
Two subtest descriptions read "Ed2559" instead of "Ed25519".
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:37 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
The non-mmap buffer fallback in do_raw_keyop() for oneshot (only_nomd)
keys was never exercised on Unix, since any file with non-zero size
takes the mmap path and returns before reaching it. Signing and
verifying an empty file gives filesize 0, which skips the mmap block
(guarded by filesize > 0) and falls through to the buffer switch,
covering both the SIGN and VERIFY arms.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:36 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
ossl_lms_pubkey_decode() only freed pkey->encoded when the new public key
had a different length, so re-decoding a same-length key on the documented
repeated-call path overwrote the old buffer without freeing it. Always free
the existing buffer first.
Also clear pkey->encodedlen on the error path so a failed decode leaves the
key in a consistent state instead of keeping a stale length.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:58:46 2026
(Merged from https://github.com/openssl/openssl/pull/31345)
We want to add the printed out pubkey and not
just 1. Also add a comment clarifying intention of this
exercise.
Fixes 77c979faf4
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 16:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/31700)
Update the existing 4.0.0 changelog entry for the ERR state cleanup to list the removed ERR_FLAG_MARK, ERR_FLAG_CLEAR, and ERR_NUM_ERRORS macros.
Fixes#31056
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:37:57 2026
(Merged from https://github.com/openssl/openssl/pull/31598)
the d2i_*/i2d_* fp and bio wrappers for RSA_PUBKEY, the DSA and EC key
types, and the EVP_PKEY Private/PUBKEY converters passed their
type-specific functions to ASN1_{d2i,i2d}_{fp,bio}, which invoke them
through the generic d2i_of_void / i2d_of_void / void *(*)(void) pointer
types.
Add file-local thunks with the exact generic signatures that forward to
the concrete functions, and pass those instead of cast pointers. This
removes the mismatched calls while keeping the public API unchanged.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:13:01 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
use IMPLEMENT_ASN1_DUP_FUNCTION(GENERAL_NAME) so duplication goes
through ASN1_item_dup() instead of calling ASN1_dup() with cast
i2d/d2i function pointers. This avoids UBSan function type errors
while preserving the public GENERAL_NAME_dup() API.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:59 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
decode PEM payloads through the generated typed d2i_* functions in the
PEM read macros instead of routing them through the d2i_of_void
callback path. This avoids UBSan function type mismatch reports while
preserving the public PEM reader APIs.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:57 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:55 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
PEM_X509_INFO_read_bio_ex stored d2i_X509, d2i_X509_AUX, d2i_X509_CRL
or d2i_AutoPrivateKey -- each with a distinct, type-specific signature
returning X509*, X509_CRL* or EVP_PKEY* -- in a single d2i_of_void*
variable and dispatched through it:
d2i = (D2I_OF(void))d2i_X509;
...
d2i(pp, &p, len)
Replace the function-pointer dispatch with an enum tag
(pem_info_type) and a switch that calls each typed d2i_* directly
with the correctly type.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
d2i_OCSP_REQUEST/d2i_OCSP_RESPONSE are declared with type-specific
signatures returning OCSP_REQUEST*/OCSP_RESPONSE*, but the
d2i_OCSP_{REQUEST,RESPONSE}_bio macros routed them through
ASN1_d2i_bio_of -> ASN1_d2i_bio, which calls them via a
d2i_of_void* pointer:
void *(*)(void **, const unsigned char **, long)
The analogous i2d_OCSP_{REQUEST,RESPONSE}_bio macros did the same
through ASN1_i2d_bio_of -> ASN1_i2d_bio with i2d_of_void*.
Rewrite the macros to dispatch through
ASN1_item_d2i_bio/ASN1_item_i2d_bio with ASN1_ITEM_rptr(OCSP_*)
directly. This eliminates the function-pointer cast entirely; both old
and new paths bottom out in the same ASN1_item_d2i_ex / ASN1_item_i2d
call, so behavior is identical.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:50 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
ensure typed stack duplicates keep their compare, copy, and free thunks so
later operations do not call typed callbacks through erased void * function
pointer signatures.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:48 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
call OPENSSL_sk_set_thunks for sk_${nametype}_new and
sk_${nametype}_new_reserve, and wrap the long generated stack
constructor and deep-copy macros across multiple lines so the nested
thunk setup is easier to read and maintain.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:46 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Windows CE has been out of mainstream support since 2018
and will not have a modern toolchain capable of compiling
a modern OpenSSL.
The vc_wince_info Perl helper, the crypto/LPdir_wince.c
directory backend, and a long tail of _WIN32_WCE
/ OPENSSL_SYS_WINCE guards across the Windows code paths
get removed.
Spotted by idrassi.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:27:18 2026
(Merged from https://github.com/openssl/openssl/pull/31601)
Only PEM input/output was exercised. Add a subtest that round trips a
key through DER, for both unencrypted and encrypted PKCS#8.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:24:30 2026
(Merged from https://github.com/openssl/openssl/pull/31653)
ML tools do not satisfy the authorship requirement, so they are merely
used, and not "create" on their own.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Thu Jun 25 07:22:26 2026
(Merged from https://github.com/openssl/openssl/pull/31643)
Incorrect check for the upper bound allowed the value of 256 to slip
through, which could lead to OOB read one element beyound the end
of the os_toascii/os_toebcdic arrays. Fix that by changing
the comparison with 256 from strictly great to great-or-equal.
Found by cppcheck.
Fixes: a1df06b363 "This has been added to avoid the situation where some host ctype.h functions return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:19:30 2026
(Merged from https://github.com/openssl/openssl/pull/31661)
Apply change similar to the one made in d41a922519 "tls_common.c: prevent
max_early_data overflow in rlayer_early_data_count_ok()"
to ossl_early_data_count_ok(), that has similar logic in it
(as rlayer_early_data_count_ok() has been copied
from ossl_early_data_count_ok() in 9dd90232d5 "Move early data counting
out of the SSL object and into the record layer").
Complements: d41a922519 "tls_common.c: prevent max_early_data overflow in rlayer_early_data_count_ok()"
Fixes: 70ef40a05e "Check max_early_data against the amount of early data we actually receive"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:13:07 2026
(Merged from https://github.com/openssl/openssl/pull/31628)
Cover the help, option-parsing and error paths of the skeyutl command.
The successful -genkey path is not exercised as no built-in provider
implements opaque symmetric key generation yet.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:10:05 2026
(Merged from https://github.com/openssl/openssl/pull/31648)
This cover various function for SRTM.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:06:31 2026
(Merged from https://github.com/openssl/openssl/pull/31593)
Align behavior with AES GCM, which already rejects this misuse with a hard
error, by tracking whether plaintext processing has started and returning an
error if AAD is supplied afterwards.
Fixes#31188
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 07:01:44 2026
(Merged from https://github.com/openssl/openssl/pull/31673)
break long chain of MIDR_IS_CPU_MODEL() alternatives packed onto a
single line, which was effectively unreadable and impossible to review
or diff one model at a time.
move the OPENSSL_armcap_P feature-flag test to the front of the
expression so the guard is obvious before the model list. This is a
formatting-only change.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 06:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31664)
The -conv_form option was not covered. Add a subtest that checks a
valid form changes the public key encoding and that an invalid form
is rejected. The DER encodings are also compared against committed
reference files, as they are deterministic for testec-p256.pem.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 06:08:38 2026
(Merged from https://github.com/openssl/openssl/pull/31652)
ML-DSA keys should become immutable once key material has been added.
This is already the case for at least ML-KEM keys, and should generally
be the case across all key types.
- Added the requisite check in the key management provider ml_dsa_import()
function.
- Also, consolidated the ML-KEM checks in ml_kem_import(). These were
previously partly in ml_kem_key_fromdata().
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jun 25 02:03:35 2026
(Merged from https://github.com/openssl/openssl/pull/30421)
"gost2012_256/512" sigalgs aliases of IANA-GOST2012-GOST8912-GOST8912 equals
to sigalgs of LEAGACY-GOST2012-GOST8912-GOST8912 so we can't distinguish
between them for the legacy algorithm
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:04 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:02 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Avoid accessing src[len] by swapping the check order and bound check
the iterator variable before the access.
Found by cppcheck.
Fixes: cc4ea5e000 "Introduce new internal hashtable implementation"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jun 24 13:09:25 2026
(Merged from https://github.com/openssl/openssl/pull/31663)
As per RFC8446 this value must be ignored.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jun 24 13:06:55 2026
(Merged from https://github.com/openssl/openssl/pull/31662)
We document which names and name constraints will be evaluated
as well as the limits that will be placed on the evauluation on
a per certificate basis.
We call out in the BUGS section that the RFC 5280 requires a byte
per byte match of name constraints unless the higher level protocol
has defines a different matching method for wildcards. This
"deferall of specification" and corresponding lack of specification
by upper level protocols means that across implementations encountering
the default behaviour is to be expected, and that therefore relying
on excluded names to constrain signers in a PKI from signing wildcards
is ill advised.
This is then cross referenced in the documentation for X509_verify_cert
and the maximum possible comparisons which can be forces in a certificate
validtion noted in the BUGS section of X509_verify_cert.
Fixes: https://github.com/openssl/openssl/issues/30706
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun 24 13:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/31334)
TLS 1.3 reserves handshake message type 0 and must not silently
ignore HelloRequest records. The legacy client-side HelloRequest skip
path in tls_get_message_header() could run before the TLS 1.3 state
machine had a chance to reject the message, so a zero-length
HelloRequest injected after ClientHello was discarded instead of
triggering unexpected_message.
Restrict the skip to cases where TLS 1.3 is no longer possible.
Before ServerHello selects a version, s->version is the configured
maximum; after ServerHello or during renegotiation, it is the
negotiated version. Skip only when that value is below TLS 1.3,
preserving the existing TLS 1.2-and-below behavior.
Add TLSProxy regression tests covering rejection while TLS 1.3 is
possible and the preserved TLS 1.2 skip after ServerHello.
Fixes#31531
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 13:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31577)
This prevents a theoretically possible integer overflow
in OPENSSL_malloc(outlen + 1) at the end of ASN1_mbstring_ncopy,
when outlen is exactly INT_MAX.
That affects conversions from MBSTRING_ASC to MBSTRING_UTF8
and MBSTRING_UTF8 to MBSTRING_ASC,
because a terminating zero has to be added to the result.
And also conversions MBSTRING_BMP to MBSTRING_UTF8
in cases when UTF8 characters 0x800..0xFFFF are encoded
as 3-byte UTF8-characters and the resulting UTF8-string
is exactly INT_MAX in size.
Fixes: 97f6b621f7 ("Reject oversized inputs in ASN1_mbstring_ncopy()")
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 12:49:08 2026
(Merged from https://github.com/openssl/openssl/pull/31527)
A zero-length AEAD message driven through the one-shot EVP_Cipher() interface
must agree with the streaming EVP_CipherFinal_ex() path. This checks:
- an empty message yields the same tag via both interfaces
- the true tag passes verification on decrypt
- the modified tag fails verification on decrypt
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 24 12:47:11 2026
(Merged from https://github.com/openssl/openssl/pull/31555)
Document the propq argument in the Ed448 key generation, signing,
and verification helper comments.
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 24 11:00:00 2026
(Merged from https://github.com/openssl/openssl/pull/31599)
Reject negative indices before looking up the recipient info stack
entry. This makes negative out-of-range indices match the existing
behavior for too-large positive indices and avoids dereferencing
a NULL recipient info.
Add a regression test for the negative index case.
Resolves: https://github.com/openssl/openssl/issues/30910
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed Jun 24 09:10:22 2026
(Merged from https://github.com/openssl/openssl/pull/30914)
This problem resulted in the wrong location of openssl being used
for one step in subtest 7. The error condition is hidden if openssl
appears in the PATH.
Resolves: https://github.com/openssl/openssl/issues/31496
Fixes: 3638ffc380 "Refactor cache_objects() loop and object type handling"
Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Wed Jun 24 08:47:58 2026
(Merged from https://github.com/openssl/openssl/pull/31647)
ossl_ackm_on_rx_ack_frame() stored ack_ranges[0].end into
largest_acked_pkt[pkt_space] without checking it against the highest
packet number actually sent in that space. Because largest_acked_pkt
only ever increases and drives loss detection, an ACK acknowledging a
packet number that was never sent (up to 2**62 - 1) pins the value and
causes every in-flight and subsequently-sent packet to be declared lost,
permanently corrupting loss detection for the connection.
RFC 9000 s. 13.1 recommends treating an acknowledgment for a packet the
endpoint did not send as a connection error of type PROTOCOL_VIOLATION,
where it can be detected.
Reject any ACK whose largest acknowledged packet number exceeds the
highest packet number sent in that space; the bound, highest_sent, is
already tracked. The depacketiser raises PROTOCOL_VIOLATION when the ACK
manager rejects the frame.
Update the QUIC tests for the new behaviour: cases 7 and 8 now assert
rejection, case 14 covers the 2**62 - 1 boundary, two pre-existing
fixtures that acknowledged one packet past the highest sent are
corrected, and the "fictional PN" script now expects a PROTOCOL_VIOLATION
close.
Fixes: fa4e92a70a "QUIC ACK Manager, Statistics Manager and Congestion Control API"
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:36:27 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
RSA_PSS_PARAMS_dup() can return NULL on failure (e.g. memory
allocation failure). The subsequent code dereferenced dupkey->pss
unconditionally when checking dupkey->pss->maskGenAlgorithm, which
would result in a NULL pointer dereference.
Check the return value and jump to the error handling instead, which
properly frees the partially constructed key.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:32:24 2026
(Merged from https://github.com/openssl/openssl/pull/31619)
Update signature_tls13_scheme_list array in accordance with the current
state of the "TLS SignatureScheme" table at [1]; leave TLS 1.2 GOST
definitions be for now.
Note: these are used only for debugging output when -security_debug
option is provided to s_client/s_server commands.
[1] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jun 23 16:30:02 2026
(Merged from https://github.com/openssl/openssl/pull/31248)
The macro definitions for the SignatureScheme values and names
are available "include/internal/tlssigalgs.h" (contrary to what comment
says), use them and also order the items in the order they are present
in the header file.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jun 23 16:29:59 2026
(Merged from https://github.com/openssl/openssl/pull/31248)
key2ms_newctx() returned struct key2ms_ctx_st *, but is registered
as OSSL_FUNC_ENCODER_NEWCTX and called through OSSL_FUNC_encoder_newctx_fn
(void *(*)(void *)), which is a case of undefined behavior, flagged
by -fsanitize=function. Same class as [1], missed there.
Give it the correct signature and add the self-check forward
declaration, as key2ms_freectx() already has.
[1] https://github.com/openssl/openssl/pull/31078
CLA: trivial
Fixes: 0cc0164d19 "PROV: Add MSBLOB and PVK encoders"
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jun 23 14:45:54 2026
(Merged from https://github.com/openssl/openssl/pull/31189)
This slightly improves its coverage.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 14:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31589)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 13:16:52 2026
(Merged from https://github.com/openssl/openssl/pull/31249)
quic_multistream test to radix without dealing with conflict+rebase.
the idea is there will be one PR for each script, so more people
will be able to submit those PRs without rsiking a conflicts around
the scripts array. This should allow for smoot reciew/git push
flow.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 23 12:21:25 2026
(Merged from https://github.com/openssl/openssl/pull/31547)
Attempt to make the documentation match the code.
Not attempting to change what the code does at this point, it's
all very random, and since it's been there, it is effectively established
public API now.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 11:56:58 2026
(Merged from https://github.com/openssl/openssl/pull/31549)
Return 0 when the passed object to PKCS7_set_digest() is not of type PKCS7
digest.
Fixes: c5a5546389 "Add support for digested data PKCS#7 type."
Resolves: https://github.com/openssl/openssl/issues/31551
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jun 22 08:17:32 2026
(Merged from https://github.com/openssl/openssl/pull/31559)
The check referenced USE_INTERLOCKEDOR64, but the macro defined above
for MSVC (with the right architecture/version) and 64-bit MinGW is
OSSL_USE_INTERLOCKEDOR64. As a result, OSSL_ATOMICS_LOCKLESS was
never defined on Windows, even though those toolchains do provide
lockless atomics.
Reported-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Fixes: 26c5742393 "Use the actually correct define for solaris and gcc"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 07:22:31 2026
(Merged from https://github.com/openssl/openssl/pull/31600)
Make the local max_early_data variable uint64_t so an overflow
cannot occur if the max_early_data field in the record layer struct
has the maximum value: UNT32_MAX (0xFFFFFFFF).
Resolves: https://github.com/openssl/openssl/issues/31533
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Sun Jun 21 23:50:02 2026
(Merged from https://github.com/openssl/openssl/pull/31538)
Replace the per-call-site `(ASN1_aux_const_cb *)aux->asn1_cb` cast in
ASN1_item_ex_i2d() and asn1_item_print_ctx() with a shared helper,
ossl_asn1_aux_const_cb(), which invokes the legacy non-const callback
through its real type. This avoids the UBSAN function-pointer-type
mismatch while preserving backward compatibility.
Fixes: https://github.com/openssl/project/issues/1970
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 23:38:12 2026
(Merged from https://github.com/openssl/openssl/pull/31541)
In the HTTP/3 demo server's :path handler, when the path value does not
begin with '/', the value is copied into the fixed-size url[MAXURL]
buffer with memcpy(h3ssl->url, vvalue.base, len) and no terminator is
written. len is capped at MAXURL, so a :path value of MAXURL or more
bytes fills the entire buffer, overwriting the zeroes from the preceding
memset and leaving url without a NUL terminator. The buffer is later
used as a C string by strcat() and strcmp() when building the file name,
resulting in a heap out-of-bounds read and a possible overflow of the
filename[PATH_MAX] buffer. This is reachable from a client-supplied
:path header.
Cap the length at MAXURL - 1 so that the trailing byte zeroed by the
memset always remains, guaranteeing url is NUL-terminated in every
branch. The '/'-prefixed branches are unaffected as they already write
an explicit terminator within the smaller bound.
Fixes#31516
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 16:19:08 2026
(Merged from https://github.com/openssl/openssl/pull/31520)
This tests currently uncovered setup_peer function and some failure
scenarios in it.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 16:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31518)
On cygwin/msys systems that run on Windows, command line length is limited. using response file instead of putting objects on the command line will avoid this error
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 15:56:08 2026
(Merged from https://github.com/openssl/openssl/pull/23077)
Currently errors from s390x_mod_exp_hw() and s390x_crt() are silently
ignored and the software path is used as fallback.
Change this to only take the software path if s390x_mod_exp_hw() and
s390x_crt() returns 0 to indicate that it does not support the RSA
acceleration. In case of errors, return them to the caller. Errors could
be memory allocation failures or errors during BIGNUM calls. Those should
not be ignored, but reported as failure.
Note that it can happen that the ioctl's fail, but this is not to be
reported as error. Those are situations where for example no suitable
crypto adapter is available, or the file descriptor has been closed
by a sandbox. Those situations disable the RSA acceleration for further
RSA requests, but the current operation should still be performed via the
software fallback. For cases where the RSA key size is too large for
acceleration, the operation must also be performed via the software
fallback, and not reported as an error.
This also fixes failures of the test_rsa_pkcs1_mfail test case that found
the memory allocation failures that got ignored.
Resolves: https://github.com/openssl/openssl/issues/31480
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 21 14:19:54 2026
(Merged from https://github.com/openssl/openssl/pull/31482)
Currently errors from s390x_HMAC_init() are silently ignored and the software
path is used as fallback.
Change this to only take the software path if s390x_HMAC_init() returns -1
to indicate that it does not support the HMAC acceleration. In case of
errors, return them to the caller. Errors could be memory allocation
failures or errors during digest operations. Those should not be ignored,
but reported as failure.
This also fixes failures of the test_rsa_pkcs1_mfail test case that found
the memory allocation failures that got ignored.
References: https://github.com/openssl/openssl/issues/31480
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 21 14:19:53 2026
(Merged from https://github.com/openssl/openssl/pull/31482)
Store in_flight flag in a local variable for later use, as apkt->on_acked()
may free apkt.
Fixes: 427a02ad0a "QUIC ACKM: Don't record non-inflight packets in CC"
Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sun Jun 21 13:55:08 2026
(Merged from https://github.com/openssl/openssl/pull/31447)
It should be included via e_os.h instead.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jun 20 11:00:42 2026
(Merged from https://github.com/openssl/openssl/pull/31587)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Thu Jun 18 18:02:35 2026
(Merged from https://github.com/openssl/openssl/pull/31568)
ossl_method_store_cache_set inserts two entries per method: one keyed
on (nid, prop_query, prov) and one keyed on (nid, prop_query) with a
NULL provider, used to match "any provider" lookups.
Previously the set path always replaced the NULL-provider entry. When a
second provider cached the same nid, its method became the result for
"any provider" lookups, even though an earlier provider was already
cached. A shared nid could then resolve to the wrong provider: a
certificate's SPKI would decode through that provider's keymgmt and
X509_check_private_key would fail with a key value mismatch.
Only insert the NULL-provider entry when one does not already exist, so
the first provider to cache the nid owns it, matching the order
ossl_method_store_fetch would select.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Thu Jun 18 18:02:32 2026
(Merged from https://github.com/openssl/openssl/pull/31568)
newer versions of clang trigger ubsan warnings on the following
functions:
ossl_cmp_mock_srv_set1_refCert
ossl_cmp_mock_srv_set1_chainOut
ossl_cmp_mock_srv_set1_certOut
ossl_cmp_mock_srv_set1_newWithNew
ossl_cmp_mock_srv_set1_newWithOld
ossl_cmp_mock_srv_set1_oldWithNew
ossl_cmp_mock_srv_set1_caPubsOut
Due to the fact that the respective function prototypes don't match the
callback function pointer prototypes (the former use concrete strucuture
types while the latter uses a void pointer).
Fix it by bifurcating setup_cert[s] (the call-in fuctions) to have
variants that accept the expected type and corresponding callback
signature so that the above functions can be used without thunking
Fixesopenssl/project#1969
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 18 14:03:41 2026
(Merged from https://github.com/openssl/openssl/pull/31526)
check_flood_stats read the path challenge/response counters immediately
after the client's write returned, but the flood is delivered over a
real socket and processed by the connection's assist thread
asynchronously. Spin until the counters reach their expected values,
the same way check_rejected already does, instead of failing on the
first observation.
Observed failure:
https://github.com/openssl/openssl/actions/runs/27669771673/job/81831310551?pr=31538
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 18 13:07:27 2026
(Merged from https://github.com/openssl/openssl/pull/31561)
Commit 73188a01bd "doc: document EVP_PKEY_get_security_category function"
has added security level definitions as a table, that has been implemented
raw via "=begin" POD directives; while the formatting for "html"
and "text" (that is not even generated by the build system)
has been provided, "man" (arguably, the most relevant one)
has been omitted, surprisingly. Rescind that omission by providing
the respective table formatting for man.
Complements: 73188a01bd "doc: document EVP_PKEY_get_security_category function"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 18 12:35:47 2026
(Merged from https://github.com/openssl/openssl/pull/31410)
This covers currently uncovered check_crl_path and check_crl_chain
in x509_vfy.c. The mfail test tests the happy path and all memory
failures in it. In addition 3 error scenarios are tested.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:31:56 2026
(Merged from https://github.com/openssl/openssl/pull/31244)
Add client-side validation to check if session ticket lifetime
hints exceeds 7 days in TLS1.3 connections and caps it to the
maximum value of 7 days(604800 seconds).
Modified `CHANGES.md` with the description of updated change.
Resolves: #30808
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:25:33 2026
(Merged from https://github.com/openssl/openssl/pull/31174)
The configuration option has no effect. Remove it from the test matrix.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 18 12:20:37 2026
(Merged from https://github.com/openssl/openssl/pull/30767)
Since there is no atexit() handler installation after [1],
the associated configuratoin option (that was initially introduced
to support the configurations in question[2]) has no effect
and can be removed from NonStop configurations.
[1] https://github.com/openssl/openssl/pull/29385
[2] 99fb31c167 "Add atexit configuration option to using atexit() in libcrypto at build-time."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 18 12:20:36 2026
(Merged from https://github.com/openssl/openssl/pull/30767)
Having the diff available right away in the CI run logs aids evaluation
of severity of the merge conflicts.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 18 12:17:42 2026
(Merged from https://github.com/openssl/openssl/pull/31506)
Old OpenSSL had a FIPS_mode() function. AWS-LC-FIPS and BoringSSL-FIPS
still have the FIPS_mode() API. RHEL-derived systems also still provide
FIPS_mode() as a define in up-to-date OpenSSL. And feedback from
multiple large commercial software vendors is that there is a lot of
code out there that still has FIPS_mode() sprinkled all over the place.
Add `FIPS_mode()` as a convenience define to
`EVP_default_properties_is_fips_enabled(NULL)` which is a short-hand
to check if `fips=yes` property is currently enabled on the default
library context.
It is a hint of intent, but not a proof. If you are looking to
validate whether the default configuration is using a validated module,
many additional checks are needed; please consult the security policy
of the module you are using. We heavily discourage using this macro.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Jun 18 11:58:15 2026
(Merged from https://github.com/openssl/openssl/pull/30339)
The transient "seedbuf" value should not persist in keys that that are
loaded from the "expanded" form when "prefer_seed = no".
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 18 08:02:39 2026
(Merged from https://github.com/openssl/openssl/pull/31252)
EVP_PKEY_fromdata for the LMS keymgmt accepted an OSSL_PARAM[] that
omits OSSL_PKEY_PARAM_PUB_KEY, returning success with an LMS_KEY
whose lms_params and ots_params remain NULL. Without even basic
algorithm parameters (derived from the key content) the key is
malformed.
EVP_PKEY_fromdata for DH/DHX accepts an empty array and yields a
DH with NULL params.p / params.g. Several DH check entry points
(DH_check, DH_check_params, DH_check_pub_key) then read
dh->params.p / .g via BN_num_bits or BN_is_odd before any NULL
check. Add defensive guards at the top of each that report
failure via *ret without dereferencing NULL; the existing
return-1-with-flags contract is preserved.
A new test_fromdata in endecode_test drives every supported
keymgmt with an empty OSSL_PARAM[] for both EVP_PKEY_PUBLIC_KEY
and EVP_PKEY_KEYPAIR selections, and tests that any returned key
is sufficiently well behaved.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 18 08:02:33 2026
(Merged from https://github.com/openssl/openssl/pull/31252)
ossl_ml_kem_key_dup() left the (PUB|PRIV) selection case
unhandled, so EVP_PKEY_dup() silently returned NULL for
ML-KEM-512/768/1024. add_storage() also zeroed the duplicated
rho_pkhash, leaving the dup unequal to the original.
Add a parameterised dup sweep to test/endecode_test.c covering
every supported public-key algorithm in three shapes: full
keypair, public-only, and embryonic (parameters-only).
While here, stop endecode_test from silently passing when key
generation fails: setup_tests() now returns its accumulated
status, MAKE_*KEYS no longer short-circuits, and each
ADD_TEST_SUITE is now conditional on keygen success. Guard the
explicit-EC-curve tests with OPENSSL_NO_EC_EXPLICIT_CURVES.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 18 08:02:28 2026
(Merged from https://github.com/openssl/openssl/pull/31252)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun 17 16:22:20 2026
(Merged from https://github.com/openssl/openssl/pull/31468)
We expressly define EVP_*fetch apis as not guaranteeing which provider
and algorithm is sourced from. However, its likely that some users have
some inadvertent reliance on getting the same provider for a non
provider specific (and non property specific) fetch. While thats
generally bad practice (since we don't guarantee it), its particularly
hard to provide that behavior in the new cache infrastructure, so lets
save everyone some trouble by not changing that behavior needlessly.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 17 14:38:43 2026
(Merged from https://github.com/openssl/openssl/pull/31487)
from the conversation here:
https://github.com/openssl/openssl/pull/31018#discussion_r3386832056
@mattcaswell noted that while cleaning QUERY items and moving them to
the archive list, we do an atomic load of a QUERY's next pointer to
another shared query's next pointer. While its not been observed, it
may be possible for the clean operation to move an element to the
archive while a concurrent thread is prepending to the list, the result
being that the active (cache_list) list has a head pointer whos next
pointer points into the archive list.
The result of this would be subsequent lookups fail to find anything not
archived in the cache, and need to go through the slow
ossl_method_construct path again to slowly rebuild the cache. Thats not
catastrophic, but its definately a bug that will result in additional
memory allocations, along with entries that never get used again, and
possible memory leaks.
Switch the load_ptr call to be an atomic cmp_exch_ptr call to ensure
that the node being visited isn't mutated concurrently by both a thread
doing a clean and a list insert. This ensures that only one thread wins
the update, while the other restarts their operation.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 17 14:38:41 2026
(Merged from https://github.com/openssl/openssl/pull/31487)
As noted in this conversation:
https://github.com/openssl/openssl/pull/31018#discussion_r3386478127
While unlikely, it is possible that a single provider may provide an
algorithm for the same <name,operation_id,provider> tuple, differing
only by property query string. If, somehow the property strings for
those two algorithms hash to the same value, the property cache may
return the wrong algorithm.
This was mitigated prior to the introduction of the atomic link list
implementation by having the internal hash table do a collision check,
in which the full property string (along with the nid and provider
pointer) were compared byte-for-byte.
Fix this by re-introducing the same comparison. We already do a
comparison check on the exact nid value and provider pointer, so we now
store the property query for each QUERY and compare it to the query
string requsted using strcmp.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 17 14:38:39 2026
(Merged from https://github.com/openssl/openssl/pull/31487)
get_crl_score() is used when selecting a complete/base CRL. Its delta CRL rejection was chained after the extended CRL and IDP reason handling, so it could be skipped when extended CRL support was disabled, or when an IDP onlySomeReasons branch was taken.
As a result, a CRL with a Delta CRL Indicator could be scored as a complete/base CRL candidate. Since a delta CRL contains only changes relative to a base CRL, this could cause a previously revoked certificate to be accepted as valid when only the delta CRL is presented to the verifier.
Reject CRLs with base_crl_number unconditionally in get_crl_score() before IDP reason filtering. Delta CRLs are still considered by get_delta_sk() after a complete CRL is selected and check_delta_base() confirms compatibility.
Add verify recipe coverage for a delta CRL being rejected as a complete CRL, and for a delta CRL with IssuingDistributionPoint.onlySomeReasons being rejected under -extended_crl.
Reported-by: jujerpig (GitHub issue #31040)
Fixes#31040
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 17 08:53:02 2026
(Merged from https://github.com/openssl/openssl/pull/31044)
This fixes accidental version update in e2bd9f8c28 which is causing CI
failure for pkcs11-provider tests.
It needs to add xxd package that is used in the new hkdf test.
Fixes: e2bd9f8c28 "ml_kem: return an error on catastrophic failure in decap"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Mon Jun 15 20:23:25 2026
(Merged from https://github.com/openssl/openssl/pull/31522)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Mon Jun 15 19:24:43 2026
(Merged from https://github.com/openssl/openssl/pull/31454)
TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256 "PSK-AES128-GCM-SHA256"
TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384 "PSK-AES256-GCM-SHA384"
Were defined twice identically in tls1.h
Remove the duplicate definition
Fixes#31484
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jun 15 16:10:01 2026
(Merged from https://github.com/openssl/openssl/pull/31493)
This makes it have the same behaviour as it does on all other
BIOs.
Due to a longstanding workaround that should no longer be needed
a partial write of the data (before a write error or end of file)
was reported as no data being written out.
Fixes: https://github.com/openssl/openssl/issues/31355
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 14:42:25 2026
(Merged from https://github.com/openssl/openssl/pull/31434)
The multistream tests use so-called t-server to test QUIC connection
and stream functionality. With introduction of QUIC SSL listener
object and QUIC TLS server method, using t-server is no longer
necessary (and welcomed). All multisttream tests should be
ported to QUIC radix test infratructure.
Co-authored-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Mon Jun 15 14:38:19 2026
(Merged from https://github.com/openssl/openssl/pull/30935)
Return plain status codes from helper paths instead of EXIT_* and apply formatting updates to keep style consistent.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jun 15 14:32:31 2026
(Merged from https://github.com/openssl/openssl/pull/30563)
Complements: e5a1892 "TLS1.3: Disable tickets when SSL_OP_NO_TICKET and SSL_SESS_CACHE_OFF are set."
Co-authored-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 14:13:25 2026
(Merged from https://github.com/openssl/openssl/pull/31335)
ML-KEM decapsulation applies implicit rejection by copying the failure
key into the shared secret when the FO re-encryption check fails. This
is correct for a syntactically valid but incorrect ciphertext, and must
stay constant-time and ciphertext-dependent.
However, the same path was also taken when hash_kr() or encrypt_cpa()
failed outright, for example on a memory allocation failure inside
EVP_DigestInit_ex(). In that case decap() copied the failure key and
still returned success, so the caller derived a wrong shared secret with
no error reported. For QUIC this produces a handshake that cannot
converge: the derived keys diverge from the peer, packets fail to
decrypt, and the connection stalls until it times out, with no
diagnostic pointing at the real cause.
These primitive failures are not dependent on the ciphertext, so
reporting them as a hard error does not create a chosen-ciphertext
oracle and does not weaken the constant-time implicit rejection that
happens later via CRYPTO_memcmp() and constant_time_select_8(). Treat
them the same way the existing kdf() failure is already treated, by
raising an error and returning 0.
Also fix the comment, which referred to hash_g() where the code actually
calls hash_kr().
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 13:58:32 2026
(Merged from https://github.com/openssl/openssl/pull/31432)
This increases test coverage of pkeyutl as the -pkeyopt_passin is not
currently covered at all.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 13:57:20 2026
(Merged from https://github.com/openssl/openssl/pull/31418)
Cover the previously untested EC point conversion form path for
uncompressed, compressed and hybrid output, as well as the non-EC key
rejection. Verified by the leading octet of the encoded point in the
SubjectPublicKeyInfo.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 13:54:50 2026
(Merged from https://github.com/openssl/openssl/pull/31370)
This fixes regression introduced in d260311c53
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 13:53:40 2026
(Merged from https://github.com/openssl/openssl/pull/31192)
Adds -testmode to s_time, mirroring the option in openssl speed.
It bypasses the -time window and runs a minimal number of iterations
(1 for new connections, 2 for session reuse).
Adds test_stime covering the new, reuse, and TLSv1.2/TLSv1.3 paths.
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 13:53:39 2026
(Merged from https://github.com/openssl/openssl/pull/31192)
False result of a TEST_xxx() call should always indicate
erroneous condition.
Fix such calls. Also fix some calls which
treated TEST_xxx() result as non-boolean.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jun 15 07:38:52 2026
(Merged from https://github.com/openssl/openssl/pull/31457)
The test for client_hello and new_pending connection should
be using its own dedicated SSL context. The thing is we should
not be arming (and testing) those callbacks for every listener
the RADIX test framework creates.
This changeset moves the test from test/radix/quic_ops.c
to test/radix/quic_tests.c. The test uses check_ctx_cbks
RADIX script now.
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 07:29:02 2026
(Merged from https://github.com/openssl/openssl/pull/31421)
GitHub no longer supports Visual Studio 2022 on windows-2025
image, switch to VS 2026.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 15 07:23:17 2026
(Merged from https://github.com/openssl/openssl/pull/31497)
Add a Windows-only RIO notifier test that exercises initialization,
signalling, unsignalling, and cleanup without test-only hooks.
The RIO WSA lifecycle fix itself landed via #31339. This keeps the
remaining PR focused on coverage and removes the stale ssl_init.c include
for the deleted WSA cleanup path.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jun 12 13:54:17 2026
(Merged from https://github.com/openssl/openssl/pull/30918)
Otherwise it is allocated on stack and initialised on each call.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jun 12 13:11:50 2026
(Merged from https://github.com/openssl/openssl/pull/31362)
ossl_c448_ed448_derive_public_key(), ossl_c448_ed448_sign(),
and ossl_c448_ed448_verify() are only called from within the compilation
unit, while ossl_c448_ed448_convert_private_key_to_x448(),
ossl_c448_ed448_sign_prehash() and ossl_c448_ed448_verify_prehash()
are not used anywhere, seemingly. Make the former static (removing
them from the header, removing the ossl_ prefix, and moving
the descriptions to the definitions) and remove the latter.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jun 12 13:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31362)
This reverts commit 35c1d7b16d.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Jun 11 17:27:42 2026
(Merged from https://github.com/openssl/openssl/pull/31459)
Move the OpenSSL-hosted jom and NASM downloads under the /ci-deps/
path and verify them against SHA256 sums recorded in
.github/ci-deps.json before installing. Forks, which can't reach the
mirror reliably, download from the upstream Qt and NASM locations
instead.
Affected workflows: windows.yml, windows_comp.yml, os-zoo.yml
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 11 16:17:03 2026
(Merged from https://github.com/openssl/openssl/pull/30957)
Chocolatey-hosted packages for jom and NASM occasionally become
unavailable, causing CI failures on Windows builds. Host these
tools on our own infrastructure to eliminate this external
dependency.
Affected workflows: windows.yml, windows_comp.yml, os-zoo.yml
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 11 16:17:01 2026
(Merged from https://github.com/openssl/openssl/pull/30957)
Add test/crypto_memcmp_test.c which provides functional coverage for
CRYPTO_memcmp under regular builds and constant-time coverage under
enable-ct-validation builds.
The added constant-time coverage checks:
- there are no data dependent branches or memory accesses,
on x86_64 and aarch64 architectures
The added constant-time coverage does NOT check:
- there are no data-dependent variable-time instructions, such as
instructions NOT on the x86 Data Operand Independent Timing list
or NOT on the ARM Data-Independent Timing list
- any architectures beyond x86_64 and aarch64
New CONSTTIME_SECRET annotations live only in the test rather than in
the generic C version of CRYPTO_memcmp so that both the C and
assembler versions of CRYPTO_memcmp are constant-time covered.
CRYPTO_memcmp directly backs CPython's secrets.compare_digest() and
hmac.compare_digest(), so a timing leak in it is high impact, yet it had
essentially no direct test coverage.
References #15076.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 11 16:11:58 2026
(Merged from https://github.com/openssl/openssl/pull/31398)
Key generation pairwise consistency tests (PCT) no longer cause the
FIPS provider to enter a non recoverable error state.
Originally I considered that the pairwise tests should never fail, so a
failure was considered as a fatal error. Unfortunately this is not true,
since the RSA pairwise test was changed to call
rsa_ossl_public_encrypt(). This function can return -1 based on the
values of n and e, resulting in a DOS for bad inputs.
Under NIST FIPS 186-5, the public exponent (e) must be an odd positive
integer greater than (e > 65536) and less than 2^256. The OpenSSL code
however returns an error if e > 2^64 when n > 3072.
(This check was added to prevent a CVE DOS).
While FIPS 140-3 mandates that a module must transition into an error
state upon self-test failures, a PCT is classified as a conditional
self-test, not a pre-operational self-test
(like an integrity test or a Known Answer Test)
The cryptographic module is only required to immediately discard the
faulty key pair and output a local error. The module is allowed to
immediately attempt generating a new key pair using fresh entropy,
without needing a full system reboot or module reset.
Detected by Oracle during Jipher testing.
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jun 11 16:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/31359)
The hard failure return code is meant for NO_CHECK variants to fail if
there is some failure that should never happen and likely signal a bug.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 16:00:15 2026
(Merged from https://github.com/openssl/openssl/pull/31356)
This skips some debug and error allocations that cannot be handled
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 16:00:14 2026
(Merged from https://github.com/openssl/openssl/pull/31356)
It adds ADD_MFAIL_ALL_TESTS and ADD_MFAIL_ALL_NO_CHECK_TESTS that work
in similar way as ADD_ALL_TESTS but with mfail testing.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 16:00:12 2026
(Merged from https://github.com/openssl/openssl/pull/31356)
This covers currently uncovered check_crl_path and check_crl_chain
in x509_vfy.c. The mfail test tests the happy path and all memory
failures in it. In addition 3 error scenarios are tested.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 15:58:37 2026
(Merged from https://github.com/openssl/openssl/pull/31244)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 15:52:36 2026
(Merged from https://github.com/openssl/openssl/pull/31190)
Check that 'parameter' != NULL before dereferencing in
OSSL_CRMF_ENCRYPTEDVALUE_decrypt().
Fixes CVE-2026-42767
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 20:38:27 2026
The test data were created with a tool developed by
Thai Duong <thai@calif.io>.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 20:22:52 2026
AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages.
AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages on context reuse.
Fixes CVE-2026-45446
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 20:12:25 2026
aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot,
processed input without flushing the buffered IV into the OCB
context. Effective nonce was 0 regardless of the caller's IV;
EVP_*Final_ex() then emitted a tag depending only on (key, iv).
This gave (key, nonce) reuse and single-query universal forgery on
the EVP_Cipher() path.
Apply update_iv() at the head of aes_ocb_cipher() to mirror the
streaming handler. The matching GCM one-shot does this already.
Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and
ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is
exercised with and without AAD; the no-AAD case is needed because
any prior EVP_CipherUpdate(NULL, aad, ...) routes through the
streaming handler and applies the IV itself, masking the bug.
Fixes CVE-2026-45445
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 20:02:00 2026
Ensure we correctly catch misformed things.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 19:59:29 2026
We incorrectly used the length of the domain part for the local part
when validating e-mail for X509_VERIFY_PARAM_set1_email().
Fixes CVE-2026-42771
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 19:59:28 2026
As FFC/DH peer public key validation uses the peer's q value instead
of checking against the local q, we must also check that these
q values match when setting the peer's public key.
Fixes CVE-2026-42770
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 19:56:27 2026
This correctly uses the existing root, and not the same certificate
as the root of the chain to validate.
While we are here, we also turn on self signed certificate signature
checking as this case is actually bringing in trust anchors as
self signed certs, and fix a possible NULL deref.
Fixes CVE-2026-42769
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 19:54:01 2026
Drop the disablement of the implicit rejection for RSA PKCS#1 v1.5
decryption.
Fixes CVE-2026-42768
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 19:49:19 2026
The script make_missing_kdf_der.py was developed by Mayank Jangid
and Kushal Khemka.
Co-Authored-by: Mayank Jangid <mayank.jangid.moon@gmail.com>
Co-Authored-by: Kushal Khemka <kushalkhemka559@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 18:57:53 2026
When performing OCSP response checking for certificates in the verification
chain, the code always tries to access the next certificate as the issuer.
There is a check for a self-signed certificate. However with the partial
chain verification enabled when the chain does not have a self-signed trusted
anchor, the issuer will be NULL for the last certificate in the chain. A NULL
pointer dereference then happens.
This issue affects only applications which enable both OCSP verification
of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial
chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate
verification. Both flags are disabled by default. For that reason, we have
assigned Low severity to the issue.
Fixes CVE-2026-42765
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 18:55:29 2026
QUIC server crashes when address validation (RFC 9000, Section 8.1)
is disabled and client sends initial packet with invalid token.
Issue reported and fix submitted by Sunwoo Lee (KENTECH),
Hyuk Lim (KENTECH) and Seunghyun Yoon (KENTECH)
Fixes CVE-2026-42764
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:50:48 2026
If OCSP stapling is enabled and the TLS client connects to a malicious server,
a crafted OCSP stapled response can trigger a double free in the TLS client
when the stapled response is checked.
The OCSP stapling is not enabled by default. Reliable code execution
through a double-free is technically complex and highly environment-dependent
but the Denial of Service impact is straightforward to achieve, warranting
Moderate severity.
Fixes CVE-2026-35188
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:44:58 2026
client injects 16 path challenge frames. Those are received
by server. Only one challenge frame of 16 received triggers
path challenge response. Remaining challenge frames are
discrded/ignored.
Test introduces two counters to channel object:
- path_challenge_rx which is bumped for every patch challenge
frame received
- path_response_tx which is bumped for every path response
frame transmitted
Succesuful test verifies server receives 16 path challenge frames,
but sends just one path response frmae as response.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:35:21 2026
Currently local QUIC stack allocates PATH_RESPONSE frame for every
PATH_CHALLENGE frame it receives in single packet from its remote peer.
The memory with PATH_RESPONSE frame is released after local QUIC stack
receives an ACK which confirms reception of PATH_RESPONSE by remote peer.
This gives remote peer too much control over memory resources local
QUIC stack may consume.
Quoting RFC 9000 section 9.2.1:
...an endpoint SHOULD NOT send multiple
PATH_CHALLENGE frames in a single packet.
Limiting the number of PATCH_CHALLENGE frames to 1 per QUIC packet received
helps to reduce heap memory overhead required to process PATH_CHALLENGE
frame.
Currently QUIC ACKM (ACK-manager) keeps all frames in retransmission
buffer until ACK is received. It can be changed such frames which
don't need to be ACKed don't need to be kept in retrans buffer,
those can be released right after transmission.
Fixes CVE-2026-34183
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:35:20 2026
Test to ensure that for a given CMS message:
1) We do not allow the creation of a CMS message containing
AuthEnvelopedData with a non-AEAD cipher.
2) We do not accept a message containing AuthEnvelopedData with a
non-AEAD cipher specified in the AlgorithmIdentifier.
3) We do not allow tag lengths less that 4 bytes.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:27:03 2026
1. Adjust ossl_cms_EncryptedContent_init_bio to not accept non-AEAD
ciphers.
If a forged CMS message with AuthEnvelopedData is received with
a non-AEAD cipher specified, we silently accept that and decrypt
the message, skipping any authentication, which violates RFC 5083.
We also add checks to ensure we fail if we try to encrypt
AuthEnvelopedData without using an AEAD cipher.
2. Ensure that tag lengths on cms AEAD data is the recommended size.
RFC 5084 recommends that mac tags be at least 12 bytes for AES-GCM
and 4 bytes for AES-CCM on AuthEnvelopedData. As this code is not
algorith-specific we add a check for a minimal size and just use the
lower limit which is sufficient to prevent this attack.
Without this check, its possible to set the tag length to 1 and within
256 guesses, forge a CMS message.
Fixes CVE-2026-34182
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:27:02 2026
Short mac keys (as short as 1 byte) can be used to probe the
system under attack to accept a PKCS#12 file created by an attacker
even if the attacker doesn't know the password used for MAC protection.
Fixes CVE-2026-34181
(also update the reference to the PBMAC1 PKCS#12 RFC)
Signed-off-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:18:59 2026
The ASN1_STRING_set() function takes an `int` length, make sure the
argument is not inadvertently truncated when it is called from
asn1_ex_c2i().
Fixes CVE-2026-34180
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:13:56 2026
added EnvelopedData blob with a PasswordRecipientInfo using
id-alg-PWRI-KEK and an AES-128-CFB key encryption cipher. CFB's 1-byte
effective block size let the inlen >= 2 * blocklen guard in
kek_unwrap_key() accept a wrapped key shorter than the seven octets
the check-byte test reads from tmp[1..6]; the encryptedKey OCTET
STRING here is only two bytes.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:06:38 2026
the check-byte test in kek_unwrap_key() reads tmp[1] through tmp[6]
unconditionally, so the decrypted buffer must hold at least seven
octets. The pre-decryption size check enforces inlen >= 2 * blocklen,
which yields the required seven octets only when blocklen >= 4. For
a KEK cipher with a smaller block size, inlen can be as small as
2 * blocklen and the check-byte read overruns the inlen-sized tmp
allocation.
Reject blocklen < 4 in the early sanity check. All block ciphers
appropriate for CMS PasswordRecipientInfo key wrapping have a block
size of at least 8 octets (DES/3DES = 8, AES = 16), so this only
forbids ciphers that would not be valid KEK choices anyway, and the
existing inlen >= 2 * blocklen check then guarantees the seven-octet
lower bound the check-byte test relies on.
Fixes CVE-2026-9076
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 14:06:36 2026
In ASN1_mbstring_ncopy() the destination size for BMPSTRING and
UNIVERSALSTRING output was computed by a signed left shift on an
int:
outlen = nchar << 1; /* MBSTRING_BMP */
outlen = nchar << 2; /* MBSTRING_UNIV */
For nchar large enough the result is not representable in int. In
the worst case (nchar == 0x40000000) nchar << 2 wraps to zero,
OPENSSL_malloc(1) is called, and traverse_string() then writes
4*nchar bytes into the one-byte allocation: a heap buffer
overflow. The MBSTRING_UTF8 path computes outlen by summing
per-character byte counts in out_utf8(), and that sum can overflow
the same int under similarly large inputs.
Neither path is reachable from code that processes X.509
certificates through the DIRSTRING_TYPE mask used by
ASN1_STRING_set_by_NID(): UNIVERSALSTRING is absent from that
mask, and the UTF-8 sum requires inputs on the order of half a
gigabyte. Reaching them needs an application that calls
ASN1_mbstring_copy()/ASN1_mbstring_ncopy() directly, or registers
a custom NID via ASN1_STRING_TABLE_add(), with an oversized
attacker-controlled input.
Add range checks before each shift and in out_utf8(), raising
ASN1_R_STRING_TOO_LONG at the point of detection. Move the
existing ASN1_R_INVALID_UTF8STRING raise into out_utf8() too so
the two failure modes report distinct codes; the MBSTRING_UTF8
caller is left with cleanup only and now frees dest on error,
matching the BMP/UNIV branches.
Fixes CVE-2026-7383
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 8 14:02:18 2026
This is done for error messages received if OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES
is set or the respective -nonmatched_error_nonces CLI option is given.
Can be helpful when the server (or other peer) cannot provide a proper error message header,
for instance if was unable to parse the ASN.1 encoding of a request message.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:49 2026
(Merged from https://github.com/openssl/openssl/pull/29043)
Complements: 21722fe554 "OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: use new TA(s) for whole transaction (also pkiconf); update doc"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:47 2026
(Merged from https://github.com/openssl/openssl/pull/29043)
Complements 8d9c8b3ff "CMP doc: add missing text on OSSL_CMP_OPT_NO_CACHE_EXTRACERTS to OSSL_CMP_CTX_new.pod and ossl_cmp_msg_check_update.pod"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:46 2026
(Merged from https://github.com/openssl/openssl/pull/29043)
SSL_set_connect_state() and SSL_set_accept_state() have no return value to
report argument errors, but their documentation did not state the precondition
for the SSL argument. Passing NULL, or a pointer that is not a valid
SSL object, is a programmer error rather than a recoverable API error.
Document that the ssl argument must point to a valid SSL object and
must not be NULL.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Jun 11 09:04:23 2026
(Merged from https://github.com/openssl/openssl/pull/31435)
Document that no-engine, no-static-engine, and no-dynamic-engine
configure options are deprecated and do nothing. These options are
retained for backwards compatibility only.
Fixes#27473
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 11 09:02:08 2026
(Merged from https://github.com/openssl/openssl/pull/29839)
RFC 5280 section 5.1.1.2 requires the signatureAlgorithm in the outer
CertificateList wrapper to be identical to the signature field inside
the signed TBSCertList. def_crl_verify() did not enforce this, unlike
X509_verify() and X509_ACERT_verify() which both carry an X509_ALGOR_cmp
guard.
Add the same guard to def_crl_verify(). A mismatch raises
X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH. No known attack results from
the missing check; this is a conformance and hardening fix only.
Add a regression test: a CRL with a valid RSA-SHA256 signature over a
TBSCertList whose inner signatureAlgorithm claims ecdsaWithSHA256 is
now rejected.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 11 08:45:41 2026
(Merged from https://github.com/openssl/openssl/pull/31213)
Issue #22059 reported a race condition in CRYPTO_THREAD_run_once on
windows platforms. The most correct fix for this is to convert the
windows run_once implementation to use the Win32 InitOnceRunOnce
interface. Doing so requires at least Windows Vista/Windows Server 2008
to be available, and because WinXP hasn't built since 3.0 released, it
seems sensible to bump our minimal NT version to be 0x600 (Vista/2008)
Also, while we're at it, this change caught a bad programming practice
in the rio_notifier code, which attempts to reset the once variable
during shutdown. The windows static initalizer macro for this api is
constructed such that attempting to do so causes a build break. Since
once variables are not meant to be reset (since they are only triggered
once), remove that reset code to avoid the breakage.
Note that this problem was independently found and fixed in #30198.
We're taking the fix from this pr (as they are effectively identical),
and using that PR to add some much needed tests to the rio code.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Wed Jun 10 19:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/31339)
When the macro contains a comma (',') as a trailer character, then
clang-format doesn't get the correct formatting
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 13:24:44 2026
(Merged from https://github.com/openssl/openssl/pull/31386)
Configure assumed GCC/Clang sanitizer spellings, so enable-asan was a
no-op on MSVC. Emit /fsanitize=address instead of -fsanitize=address
on VC targets.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 12:53:11 2026
(Merged from https://github.com/openssl/openssl/pull/31366)
Commit fa338aa7cd "fips: zeroization of public security parameters (PSPs)"[1]
introduced zeroization of public security params, which then[2] switched
its usage to OPENSSL_PEDANTIC_ZEROIZATION; however, zeroization has
implemented inconsistently, leaving out public security parameter
updates. Consistently use newly introduced wrappers,
ossl_public_bn_free and ossl_public_param_free, for freeing such
parameters, and use them for FFC and RSA.
[1] https://github.com/openssl/openssl/pull/24355
[2] https://github.com/openssl/openssl/pull/26068
Complements: fa338aa7cd "fips: zeroization of public security parameters (PSPs)"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jun 10 12:52:14 2026
(Merged from https://github.com/openssl/openssl/pull/31157)
I am doing this because I have need to add information that really does
belong here, and the current stuff is less documentation than more or
less some hand waving about how it works without any details
So to summarize the changes:
1) This documents the current way that X509_verify_cert goes about
building and verifying a chain, identifying the relevant flags that
can affect how this happens today, and cross references the correct page
to find the rest of the exhaustive list of verification flags and what they do.
2) This documents the verification callback and how it can be used
to affect the verification outcome, This includes warning potential
users of the callback of what returning values from it means,
the common ways to end up unintentionaly doing things you did not expect
with the callback, and that it depends upon internals and should not be
relied upon.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:33:13 2026
(Merged from https://github.com/openssl/openssl/pull/31314)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:23:38 2026
(Merged from https://github.com/openssl/openssl/pull/31333)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:23:37 2026
(Merged from https://github.com/openssl/openssl/pull/31333)
Commit a21f77d added explicit null assignments after EVP_KEYMGMT_free()
calls at the err:, legacy:, and success exit paths in kem.c,
asymcipher.c and signature.c.
The identical exit paths in evp_keyexch_init() (crypto/evp/exchange.c)
were not updated at the same time, leaving exchange.c as the only
outlier in the family without these null assignments.
This patch brings exchange.c into consistency with its sibling files
by adding exchange = NULL and tmp_keymgmt = NULL after each free at
the exit paths, matching the established pattern from a21f77d.
No functional change intended.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 10 11:20:19 2026
(Merged from https://github.com/openssl/openssl/pull/31394)
The EVP_PKEY_get_bits() documentation states that "the definition
of cryptographic length is specific to the key cryptosystem" but
doesn't explain what this means for each key type.
Add a detailed list explaining what "bits" represents for RSA, DSA,
DH, EC, X25519, X448, Ed25519, Ed448, ML-DSA, SLH-DSA, and ML-KEM
key types to help users understand the return value.
Fixes#28337
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jun 10 11:15:17 2026
(Merged from https://github.com/openssl/openssl/pull/29790)
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:12:39 2026
(Merged from https://github.com/openssl/openssl/pull/31352)
The vectorization is implemented using vector extensions (of gcc/clang)
and will work on any architecture with 128 bit vector registers that has
the builtin `vec_mulh` for the high part of a multiplication.
Enable this for s390x.
The speed-up factor on z17 is around 2--3.4.
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 09:25:58 2026
(Merged from https://github.com/openssl/openssl/pull/30812)
Add recommendation to use it for TLS clients, together with X509_VERIFY_PARAM_{set1,add1}_host()
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:26:57 2026
(Merged from https://github.com/openssl/openssl/pull/27357)
The head of the tree is broken due to a combined inability for openssl
and the provider to allow for duplication of MD contexts on an in flight
session
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:32 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
Remove some vestigual code from the property cache and name things
appropriately
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:28 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
if a provider is unloaded and reloaded to a context, all its algorithms
get archived, making them un-look-up-able. While this is good, having
all those effectively dead entries in the list slows down the linear
traversal in the lookup path, so periodically, while we have the write
lock held, migrate those entries to a separate archive list so that they
don't imact the normal hot path.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:26 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
noticed during the debugging of this that, even though we may have
no-cached-fetch configured, we still put things in the method store,
which is wrong.
Don't cache things when we say we're not caching things
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:24 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
The duplicate property test has to change because we now archive QUERYs
instead of removing them immediately (i.e. we don't drop the ref count
until the store is freed).
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:21 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
TSAN seems to be having a problem with atomic_load_ptr and
atomic_store_ptr. Both are, by default, __ATOMIC_RELAXED operations.
According to the tsan docs, it flags these operations as a race because,
while they are indivisible, they create no happens-before constraint,
meaning they can be reordered.
An exemplar race that is reported is:
WARNING: ThreadSanitizer: data race (pid=2139404)
Read of size 4 at 0x723400002308 by thread T39:
#0 EVP_MD_up_ref crypto/evp/digest.c:995 (threadstest+0x45032d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#1 evp_md_up_ref crypto/evp/digest.c:974 (threadstest+0x450242) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#2 ossl_method_up_ref crypto/property/property.c:201 (threadstest+0x4b7a55) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#3 ossl_method_store_cache_get_locked crypto/property/property.c:941 (threadstest+0x4b9922) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#4 ossl_method_store_cache_get crypto/property/property.c:974 (threadstest+0x4b9a47) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#5 inner_evp_generic_fetch crypto/evp/evp_fetch.c:314 (threadstest+0x458186) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#6 evp_generic_fetch crypto/evp/evp_fetch.c:404 (threadstest+0x4586dc) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#7 EVP_MD_fetch crypto/evp/digest.c:985 (threadstest+0x4502d7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#8 derive_kdk crypto/rsa/rsa_ossl.c:472 (threadstest+0x4cf738) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#9 rsa_ossl_private_decrypt crypto/rsa/rsa_ossl.c:646 (threadstest+0x4d0174) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#10 RSA_private_decrypt crypto/rsa/rsa_crpt.c:48 (threadstest+0x4c6971) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#11 rsa_decrypt providers/implementations/asymciphers/rsa_enc.c:321 (threadstest+0x51cab7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#12 EVP_PKEY_decrypt crypto/evp/asymcipher.c:280 (threadstest+0x44a9ca) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#13 thread_shared_evp_pkey test/threadstest.c:966 (threadstest+0x404be7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#14 thread_run test/threadstest.h:67 (threadstest+0x40132d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
Previous write of size 8 at 0x723400002308 by main thread (mutexes: write M0):
#0 memset <null> (libtsan.so.2+0x4c1eb) (BuildId: 40906101a3a1e1f1ececafafda314aee009d688a)
#1 CRYPTO_zalloc crypto/mem.c:228 (threadstest+0x48679d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#2 evp_md_new crypto/evp/digest.c:758 (threadstest+0x44f35e) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#3 evp_md_from_algorithm crypto/evp/digest.c:839 (threadstest+0x44f885) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#4 construct_evp_method crypto/evp/evp_fetch.c:230 (threadstest+0x457ec9) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#5 ossl_method_construct_this crypto/core_fetch.c:110 (threadstest+0x4801bf) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#6 algorithm_do_map crypto/core_algorithm.c:77 (threadstest+0x47f7a3) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#7 algorithm_do_this crypto/core_algorithm.c:122 (threadstest+0x47f987) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#8 ossl_provider_doall_activated crypto/provider_core.c:1609 (threadstest+0x49a42a) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#9 ossl_algorithm_do_all crypto/core_algorithm.c:164 (threadstest+0x47fb14) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#10 ossl_method_construct crypto/core_fetch.c:157 (threadstest+0x4803d0) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#11 inner_evp_generic_fetch crypto/evp/evp_fetch.c:333 (threadstest+0x4583a2) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#12 evp_generic_fetch crypto/evp/evp_fetch.c:404 (threadstest+0x4586dc) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#13 EVP_MD_fetch crypto/evp/digest.c:985 (threadstest+0x4502d7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#14 derive_kdk crypto/rsa/rsa_ossl.c:472 (threadstest+0x4cf738) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#15 rsa_ossl_private_decrypt crypto/rsa/rsa_ossl.c:646 (threadstest+0x4d0174) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#16 RSA_private_decrypt crypto/rsa/rsa_crpt.c:48 (threadstest+0x4c6971) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#17 rsa_decrypt providers/implementations/asymciphers/rsa_enc.c:321 (threadstest+0x51cab7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
#18 EVP_PKEY_decrypt crypto/evp/asymcipher.c:280 (threadstest+0x44a9ca) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
What tsan is saying here is that the memset in evp_md_new may get
re-ordered such that the contents of the EVP_MD may still be getting
zeroed at the time we have (a) found the EVP_MD in the method store
cache, and (b) attempted to do an up_ref on it.
This is plainly impossible, especially given that, in order to reach the
method store cache, it must be places in the method store algorithm
sparse array, which still requires the taking of the method store write
lock. But for some reason tsan fails to see the memory fence that
creates.
It seems the simplest solution to correct this is, if we are running
under tsan, use __ATOMIC_ACQUIRE and __ATOMIC_RELEASE on
CRYPTO_atomic_[load|store]_ptr to make sure tsan sees the proper memory
ordering.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:19 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
We don't need either anymore
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:14 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
Theres no point in thrashing the cache like this, it just gives us more
opportunities to dirty the cpu cache by taking the write lock
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 18:17:03 2026
(Merged from https://github.com/openssl/openssl/pull/31018)
ml_kem_keymgmt.c includes der_wrap.h, which is a generated file, but
doesn't include a depdency in its build.info file, meaning that if the
dependencies aren't run in the right order, ml_kem_keymgmt.c gets
compiled before der_wrap.h is generated, leading to a build break.
Fix it by including the needed dependency.
Fixes#31379
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jun 9 17:49:28 2026
(Merged from https://github.com/openssl/openssl/pull/31385)
Our CRYPTO atomic api has a somewhat consistent problem in that its
possible in the case where locking fails to return an error while the
actual operation (store_int, store_ptr, etc), actually succeded.
cmp_exch is somewhat special here in that we may really need to know
independently if the function failed due to lock failure and if the
exchange occured (so we can know the output value of *expect). Add a
separate parameter to allow callers to be informed of these statuses
independently.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 9 17:46:07 2026
(Merged from https://github.com/openssl/openssl/pull/31319)
Commit e0e276b50a "Fix a one byte buffer overflow in s_client" added
a check for the buffer size before adding a terminating \0, which led
to full reads of BUFSIZZ resulting in session termination. Avoid that
by requesting one byte less.
Co-Autherd-by: Tomas Mraz <tomas@openssl.foundation>
Resolves: https://github.com/openssl/openssl/issues/30925
Fixes: e0e276b50a "Fix a one byte buffer overflow in s_client"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 09:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31413)
el_build_keyslot() derives the QUIC IV before the success path stores
*out_iv_len. If a later step fails, the error cleanup currently uses
*out_iv_len and ends up cleansing zero bytes.
Cleanse the caller buffer using the local iv_len instead so the
derived IV is cleared on all post-derivation failure paths.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 08:53:50 2026
(Merged from https://github.com/openssl/openssl/pull/31346)
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 08:27:39 2026
(Merged from https://github.com/openssl/openssl/pull/31353)
We have some code to handle the case where we have custom 3rd party
extension and 3rd party QUIC. Test that this doesn't cause any problems.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 07:51:56 2026
(Merged from https://github.com/openssl/openssl/pull/31238)
In custom_exts_copy_conn we realloc'd the dst->meths buffer, and then
called `custom_ext_copy_old_cb` to transfer ownership of the all style
API wrapper allocations to the newly realloc'd buffer. But this makes
no sense. The buffer is realloc'd, and the old buffer is no longer freed,
so ownership of the old style API wrapper allocations transfer as well.
This is actually a use-after-free (we can no longer access the old buffer
once its been realloc'd), and also causes a leak. We just delete this
code.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun 8 07:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31238)
EVP_CipherInit_ex2 with a NULL key followed by EVP_CipherUpdate
on AES-WRAP/WRAP-PAD/WRAP-INV ciphers dereferenced an uninitialised
function pointer because aes_wrap_init installs ctx->block only
when a key is supplied. aes_wrap_cipher_internal had no guard
before dispatching.
Track key state in ctx->key_set, matching OCB/CCM/GCM/Poly1305,
and refuse update if no key has been installed.
Added a regression test covering AES-256-WRAP, AES-256-WRAP-PAD
and AES-256-WRAP-INV.
CLA: trivial
Fixes: ca392b2943 "Add aes_wrap cipher to providers"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 3 11:52:05 2026
(Merged from https://github.com/openssl/openssl/pull/31292)
The documentation for SSL_CERT_DIR stated that directories are
colon-separated, but on Windows the separator is semicolon.
Updated:
- openssl-rehash.pod.in: Added note about semicolon separator on Windows
- openssl-env.pod: Added note about multiple directories and Windows separator
Fixes: #27698
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun 3 11:44:35 2026
(Merged from https://github.com/openssl/openssl/pull/29894)
This function provides the ability to construct an ASN1_STRING
containing data that is not owned by the constructed ASN1_STRING. The
resulting ASN1_STRING, when freed, will not free the data, and it is
the caller's resposibility to ensure that the data lives past the
lifetime of any returned ASN1_STRING.
Why? you may ask? Many places where ->data and ->length were used
directly in the past before the opaquification of ASN1_STRING were
for this purpose, whether used for actual static data, or to turn
bytes created by and in control of the caller into an ASN1_STRING
for temporary use as an input. This function makes this easier
to do without making copies.
The function deliberately does not allow the creation of a BIT_STRING
as this would require also always providing unused bits, which is
annoying and unnecessary for almost all potential use cases.
For: https://github.com/openssl/openssl/issues/29861
For: https://github.com/openssl/openssl/issues/30162
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 3 11:42:49 2026
(Merged from https://github.com/openssl/openssl/pull/30964)
For a remote CONNECTION_CLOSE, src->reason points straight into the
received packet and holds exactly reason_len bytes with no guaranteed
trailing byte. copy_tcause() did OPENSSL_memdup(src->reason, l + 1),
reading one byte past the source. The +1 is only needed to make room
for the NUL written at r[l], so allocate l + 1 but copy only the l
valid bytes.
Fixes: 40c8c756c8 "QUIC APL/CHANNEL: Wire up connection closure reason"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Jun 3 11:39:47 2026
(Merged from https://github.com/openssl/openssl/pull/31349)
The crl_dir setting in CA_default section is not used anywhere. Remove
it from the example config and test configs, update the VMSify-conf.pl
path conversion script to no longer reference it, and regenerate
openssl-vms.cnf.
Fixes#31103
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jun 3 11:37:02 2026
(Merged from https://github.com/openssl/openssl/pull/31215)
It is a contract of tls process functions to trigger fatal error if they
fail. This is not being done in checking result of s->s3.tmp.valid_flags
allocation. If this happens, it triggers alert in read_state_machine()
for READ_STATE_BODY state that calls this process function. It calls
check_fatal() if MSG_PROCESS_ERROR is returned and the assert in it
fails because no error is triggered.
The fix just adds the fatal and also uses MSG_PROCESS_ERROR macro as
return value instead of hard coded 0.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jun 3 11:33:33 2026
(Merged from https://github.com/openssl/openssl/pull/31338)
Removed the redundant `mdname` is not NULL check.
Fixes#31299
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Jun 3 11:30:09 2026
(Merged from https://github.com/openssl/openssl/pull/31321)
The clang format broke some data in hexadecimal format. To make the tool
obedient, the trailing comma needs to be removed, then it interpretes
the data differently and therefore does not reformat it. The format can
then be changed to the correct form.
Fixes: https://github.com/openssl/project/issues/1959
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 3 07:46:14 2026
(Merged from https://github.com/openssl/openssl/pull/31350)
The md==NULL path of rsa_verify_recover passed the caller buffer to
RSA_public_decrypt without checking routsize, while the X9.31 and PKCS#1
paths already reject undersized output buffers. RSA_public_decrypt writes
up to RSA_size() bytes, so a short rout overflows. Validate routsize
against RSA_size() before the call.
Fixes: 6f4b766315 "PROV: add RSA signature implementation"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Tue Jun 2 11:55:00 2026
(Merged from https://github.com/openssl/openssl/pull/31340)
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Tue Jun 2 11:48:05 2026
(Merged from https://github.com/openssl/openssl/pull/31342)
The condition `if (sizeof(len) > 32)` was intended to set `len` to
SIZE_MAX on platforms where size_t can hold values larger than 32 bits.
However, sizeof() returns the size in bytes, not bits. Since sizeof(size_t)
is typically 4 or 8 bytes on all current platforms, the condition was
always false, leaving len at 0 and skipping the large-output test.
This commit fixes the check by comparing SIZE_MAX directly against
0xFFFFFFFFU, which correctly detects whether size_t can represent
values exceeding 32-bit range. This ensures the test properly validates
PBKDF2 behavior when requested output length is excessively large.
Fixes: 1cae59d14b "Make KDFs fail if requesting a zero-length key."
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 2 11:10:23 2026
(Merged from https://github.com/openssl/openssl/pull/31344)
The clang formatter made some code places unreadable. Selectively revert
the formatting to how it was before the re-formatting, and mark those places
with '/* clang-format off */' so that it does not get reformatted again.
While at it, change it to use designated initializers allowed with C-99.
No functional change intended.
Resolves: https://github.com/openssl/openssl/issues/31247
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 07:49:58 2026
(Merged from https://github.com/openssl/openssl/pull/31263)
EVP_MAC_init with a NULL key followed by EVP_MAC_final on a
Poly1305 context crashed with a NULL function-pointer dispatch
because poly1305_init accepted the no-key case as success, and
poly1305_final had no guard before dispatching through the
uninitialised Poly1305 state.
Add a key_set field to struct poly1305_data_st (matching
OCB/CCM/GCM), set it in poly1305_setkey, and refuse init and
final if no key has been installed.
Added a regression test asserting EVP_MAC_init with a NULL key
returns 0.
##### Checklist
- [ ] documentation is added or updated
- [x] tests are added or updated
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 07:35:02 2026
(Merged from https://github.com/openssl/openssl/pull/31298)
el_teardown_keyslot() decided whether to free a keyslot by calling
ossl_qrl_enc_level_set_has_keyslot() against the EL's current state.
On error paths the state does not yet match the slots that were
provisioned, so the check returned 0 and the cctx and iv were leaked.
The fix drops the state check and rely on the existing cctx != NULL
check which is sufficient for all callers of el_teardown_keyslot().
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Jun 1 07:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31323)
kTLS write is using application buffer always without a memory copy.
And it completely ignores SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER as a
result. If the user frees or re-uses the original buffer and retries
the send on SSL_ERROR_WANT_WRITE, the code will read and send the data
from the original already freed buffer sending whatever happens to be
in that memory now and corrupting the message, potentially crashing
the application as well.
Fix by making a copy if we can't send the whole thing right away and
the moving write buffer is configured.
This preserves the zero-copy semantics for the happy path and avoids
the invalid memory access and data corruption when retry is necessary.
The copy is done in the common code as it is hard to preserve the
zero-copy behavior otherwise.
Test is added that reproduces the issue. It may be possible to modify
the existing kTLS test to conditionally enable the modes and do the
BIO swap, but it feels like the issue deserves a separate one.
The test doesn't rely on any specific cypher or TLS version, so only
one combination is checked, but it should be enough.
There is no TLS_BUFFER_set_len() and the original kTLS code never
sets it, so not setting it on the copy either for now.
Fixes: 50ec750567 "ssl: Linux TLS Tx Offload"
Fixes#21202
Assisted-by: claude-opus-4.6
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 07:29:13 2026
(Merged from https://github.com/openssl/openssl/pull/31146)
Avoid possible integer overflow: instead of casting the sum to size_t,
each operand of the sum is cast to size_t before addition to avoid int
overflow.
Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 07:24:21 2026
(Merged from https://github.com/openssl/openssl/pull/30972)
inttypes.h is also used for more accurate compatibility with all
platforms, as it is the more correct choice according to C standard.
Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 06:58:24 2026
(Merged from https://github.com/openssl/openssl/pull/30969)
inttypes.h is also used for more accurate compatibility with all
platforms, as it is the more correct choice according to C standard.
Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 1 06:58:23 2026
(Merged from https://github.com/openssl/openssl/pull/30969)
Commit ecb4757b37 "crypto/evp/m_sigver.c: fix potential double free
on error path in do_sigver_init" has fixed double-free of tmp_keymgmt
in do_sigver_init() by setting it to NULL after EVP_KEYMGMT_free() call;
the same issue present in evp_kem_init(), evp_pkey_asym_cipher_init(),
and evp_pkey_signature_init(). Address it similarly, by setting
the pointers to NULL after *_free() calls.
Complements: ecb4757b37 "crypto/evp/m_sigver.c: fix potential double free on error path in do_sigver_init"
Fixes: 839ffdd11c "EVP: Allow a fallback for operations that work with an EVP_PKEY"
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun May 31 11:03:15 2026
(Merged from https://github.com/openssl/openssl/pull/31312)
When qrx_ensure_free_rxe() fails at the start of qrx_process_pkt() the
function returned 0 without advancing the PACKET cursor and, for the
first packet in the datagram, without setting first_dcid. The
qrx_process_datagram() loop then re-entered qrx_process_pkt() for the
same bytes with pkt_idx >= 1 and the sentinel first_dcid (id_len = 255),
tripping the assertion in qrx_validate_hdr_early() that asserts
first_dcid->id_len to be lower than QUIC_MAX_CONN_ID_LEN.
The fix goes to malformed label instead. The header has not been decoded
at this point so eop is NULL, which makes the malformed path discard the
rest of the datagram. This is because without an RXE we can process
neither this packet nor any that follow it. This also advances the
cursor and, when the failure is on the first packet, avoids leaving
first_dcid unset for the next iteration. It is consistent with the
other allocation-failure site in the function, which already routes
through malformed.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri May 29 14:08:56 2026
(Merged from https://github.com/openssl/openssl/pull/31316)
The original name of the structure SS collides with a define set in
a Solaris system header.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri May 29 07:56:28 2026
(Merged from https://github.com/openssl/openssl/pull/31224)
Since SLH_DSA_KEY is allocated with OPENSSL_zalloc, its members are
NULL-initialized. Removing the redundant slh_dsa_key_hash_cleanup()
inside the err path of slh_dsa_key_hash_init() prevents the
double free while allowing the outer ossl_slh_dsa_key_free() to
safely handle the cleanup.
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri May 29 07:45:46 2026
(Merged from https://github.com/openssl/openssl/pull/31274)
The documentation has this signature for that function:
int BN_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
int BN_nnmod(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
The implementation, however, had this signature:
#define BN_mod(rem, m, d, ctx) BN_div(NULL, (rem), (m), (d), (ctx))
int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx);
That pattern alone trips up anyone who associates 'm' with modulus, and
and finds themselves using BN_nnmod() incorrectly.
This change modifies the argument names to match documentation.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri May 29 07:25:31 2026
(Merged from https://github.com/openssl/openssl/pull/31304)
There is an issue for key update in TX path if any of the operation
fails during keyslot setup (e.g. due to memory failure), the cctx stays
set to NULL which results in failed assertion in qtx_encrypt_into_txe.
The fix splits the build and installation steps in
ossl_qrl_enc_level_set_key_update so the cctx teardown is done only
after the build is successful. The install is then non fallible so it
cannot end up with empty cctx.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri May 29 07:18:36 2026
(Merged from https://github.com/openssl/openssl/pull/31268)
clang-22 reported missing alignment on MacOS:
ld: warning: arm64 function not 4-byte aligned: _asm_sha1_hmac_aescbc_dec from libcrypto.a(libcrypto-lib-aes-sha1-armv8.o)
ld: warning: arm64 function not 4-byte aligned: _asm_sha256_hmac_aescbc_dec from libcrypto.a(libcrypto-lib-aes-sha256-armv8.o)
Add ".align 4" directives to the affected functions.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Thu May 28 08:31:59 2026
(Merged from https://github.com/openssl/openssl/pull/31284)
Update the wording in the DESCRIPTION section, so it is no longer implied
that OpenSSL 3.0 is something new.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
MergeDate: Thu May 28 07:36:05 2026
(Merged from https://github.com/openssl/openssl/pull/31265)
Counting now always runs and is always checked, including when
hooks are not installed or skip-all is set. Only injection is
skipped in those cases.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu May 28 07:33:05 2026
(Merged from https://github.com/openssl/openssl/pull/31219)
ch_init() calls ch_cleanup() on its own failure, after which
port_make_channel() may still call ossl_quic_channel_free() (which calls
ch_cleanup() again). The second call double-freed fields such as
ch->qlog_title.
To handle this, ch_cleanup() now NULLs every owned pointer after its
free and clears the have_statm / have_qsm flags after their destructors,
making it safe to invoke twice on the same channel.
With ch_cleanup() idempotent, port_make_channel() no longer needs the
ch_cleaned flag and the bare OPENSSL_free(ch) branch: the error path
unconditionally calls ossl_quic_channel_free() regardless of whether
ch_init() succeeded, partially initialized the channel, or already ran
ch_cleanup() on itself.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu May 28 07:26:22 2026
(Merged from https://github.com/openssl/openssl/pull/31177)
When a TLS 1.2 session is resumed via an external server-side cache
SSL_CTX_sess_set_get_cb(), the session ID stored in an SSL_SESSION is assigned
by the server at the end of the original full handshake and never modified
afterwards. The client-supplied session ID in ClientHello is copied verbatim
from the session the client cached after that same handshake. If both sides
behaved correctly, the two values are guaranteed to be identical.
This commit adds an explicit comparison inside ssl_get_prev_session() between
the session ID the client offered in ClientHello and the session ID embedded in
the SSL_SESSION returned by the external cache. If they do not match, the cached
session is released and ssl_get_prev_session() returns as a cache miss, forcing
a full handshake. Catching the mismatch here ensures the server never sends a
ServerHello that claims resumption of a session ID it cannot legitimately echo.
A mismatch unambiguously indicates one of the following:
- a corrupt cache entry
- an external cache implementation that returned the wrong session
- an active tampering attempt
In all three cases refusing resumption and falling back to a full handshake is
the correct response.
Signed-off-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 27 12:36:49 2026
(Merged from https://github.com/openssl/openssl/pull/30517)
The RSA PKCS#1 verify-recover provider path did not validate routsize
before passing the caller buffer to ossl_rsa_verify().
The X9.31 verify-recover path already rejects undersized output buffers,
but the PKCS#1 path could proceed with too little output space and rely
on the lower layer to write the recovered digest.
Check the expected digest size before calling ossl_rsa_verify() and
return PROV_R_OUTPUT_BUFFER_TOO_SMALL when the caller-provided buffer is
too small.
Add a regression test that covers both successful recovery with a
properly sized buffer and failure with a 1-byte output buffer, while
also checking that the short buffer is left unchanged.
Co-authored-by: Kushal <72255307+Kushalkhemka@users.noreply.github.com>
Co-authored-by: Mayank <175295782+mayank-jangid-moon@users.noreply.github.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 27 11:46:40 2026
(Merged from https://github.com/openssl/openssl/pull/30917)
to use the stdint.h ones.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 27 09:09:41 2026
(Merged from https://github.com/openssl/openssl/pull/31254)
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 27 09:09:41 2026
(Merged from https://github.com/openssl/openssl/pull/31254)
EVP_PKEY_CTX_dup() may use the provider signature dupctx callback
via EVP_DigestSignFinal() and EVP_DigestVerifyFinal().
Complements: 864b89ce49 "Move EVP_PKEY algorithm implementations into a union"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed May 27 07:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31290)
In do_sigver_init(), if the for loop proceeds to its second iteration
(iter = 2), the results from the first iteration (signature and
tmp_keymgmt) are explicitly freed at the beginning of the loop.
However, the pointers are not set to NULL after being freed.
If an error occurs subsequently during this second iteration (for
example, if evp_signature_fetch_from_prov() returns NULL, triggering a
goto notsupported), the control flow jumps to the generic cleanup block
at the end of the function. This cleanup block calls
EVP_KEYMGMT_free(tmp_keymgmt) again on the dangling pointer, resulting
in a double free.
This commit resolves the issue by explicitly nullifying these pointers
immediately after they are freed at the start of the loop iteration.
(Note: This issue was discussed with the OpenSSL Security Team, who
classified it as a regular bug due to lack of attacker control and
requested a public PR.)
Fixes: 839ffdd11c "EVP: Allow a fallback for operations that work with an EVP_PKEY"
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 15:28:15 2026
(Merged from https://github.com/openssl/openssl/pull/31276)
Add a test that rotates ticket keys so that the previously issued ticket
can no longer be decrypted: if session resumption fails
due to a NO_DECRYPT, it is expected to fall back to a full handshake,
and a new session ticket is issued.
Complements: 6115286fae "TLSv1.3: reissue session ticket after full handshake on ciphersuite mismatch"
References: https://github.com/openssl/openssl/pull/30626
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 15:20:59 2026
(Merged from https://github.com/openssl/openssl/pull/31223)
There is no need to use strcat() there, as it concatenates into a string
that is used in a format string anyway. Put the literal prefix
into the format string and avoid literal string copying.
Fixes: d477484d33 "CMP: add support for genm/genp messages with id-it-caCerts"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Tue May 26 14:54:19 2026
(Merged from https://github.com/openssl/openssl/pull/31230)
Complements: e5a18924e2 "TLS1.3: Disable tickets when SSL_OP_NO_TICKET and SSL_SESS_CACHE_OFF are set."
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue May 26 14:40:46 2026
(Merged from https://github.com/openssl/openssl/pull/31288)
In ossl_quic_new_from_listener(), the call to ossl_ssl_connection_new_int()
was passing NULL for the user_ssl parameter. NULL causes s->user_ssl
to be set to the inner TLS ssl object, so the inner SSL object points
to itself rather than to the outer QUIC connection object.
The fix passes &qc->obj.ssl instead of NULL. Afterwards,
ossl_quic_obj_init() will initialize &qc->obj.ssl in place.
Resolves: https://github.com/openssl/project/issues/989
Fixes: 0b15147a37 "Implement SSL_new_from_listener()"
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 14:12:45 2026
(Merged from https://github.com/openssl/openssl/pull/31257)
Add explicit documentation about thread safety of SSL and SSL_CTX
objects, clarifying that:
- SSL_CTX can be shared among threads but should be treated as
read-only after creating SSL objects or sharing across threads
- SSL connection objects should only be used by one thread at a time
- Each thread handling TLS connections should create its own SSL object
Fixes#23446
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
(cherry picked from commit 13bce9ed63)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue May 26 13:19:35 2026
(Merged from https://github.com/openssl/openssl/pull/29847)
The encapsulation boundaries as given in the example should comply
to the referenced RFC 7468, as well as match other places in openssl.
Fixes: 777182a0c7 "Document the -inform, etc., in openssl.pod"
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Tue May 26 11:54:49 2026
(Merged from https://github.com/openssl/openssl/pull/31282)
In providers/implementations/storemgmt/file_store_any2obj.c, if the
control flow reaches the err label after BIO_free(in) is called, a
double free will occur in the generic cleanup block.
Currently, the only path to this specific err jump is if
BUF_MEM_grow(mem, len) fails. As noted by the OpenSSL Security Team,
this failure is currently impossible because the buffer is being
shrunk (max_len >= len).
However, as requested by the security team via email, this commit
explicitly nullifies the in pointer after the first free to
future-proof the function and prevent a double free in case the
semantics of BUF_MEM_grow() or the surrounding logic change in
the future.
Fixes: 1b0f21f055 "Implementing store support for EVP_SKEY"
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 10:14:50 2026
(Merged from https://github.com/openssl/openssl/pull/31275)
This can cause error when freeing txpim as it can be still in use so the
assert in it fails.
Fixes: fa4e92a70a "QUIC ACK Manager, Statistics Manager and Congestion Control API"
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 09:59:05 2026
(Merged from https://github.com/openssl/openssl/pull/31258)
win32_joiner() always emits a trailing '\' when file_split->dir
is present, even if file_split->file is NULL. The previous length
calculation only reserved that byte when file_split->file was also
non-NULL, which could cause a one-byte overflow.
Resolves: https://github.com/openssl/openssl/issues/31260
Fixes: cbecb3ac37 "There's an ongoing project to bring some kind of path selection mechanism to the ENGINE framework. This means there there are going to be new functionality for the DSO part, and ultimately some way of merging two file specifications together.
CLA: trivial
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 09:36:02 2026
(Merged from https://github.com/openssl/openssl/pull/31266)
As these are public by necessity, we may as well allow folks
to use them to selectively disable deprecation warnings if they
wish to temporarily use deprecated functions in limited locations
in their code.
Complements: 4036f4b0e3 "Add new public API for checking certificate times."
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 09:22:58 2026
(Merged from https://github.com/openssl/openssl/pull/31270)
strlcpy() (and OPENSSL_strlcpy() after it) returns the length
of the input string as a result, don't throw it away just to calculate
it once again on return.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Tue May 26 08:58:27 2026
(Merged from https://github.com/openssl/openssl/pull/31226)
Cover the three cases where CONF_parse_list() produces a NULL/empty
element: leading separator, trailing separator, and consecutive
separators (double colon). Before the fix these would crash via a
NULL memcpy inside ciphersuite_cb().
Each case also verifies via SSL_CTX_get_ciphers() that the valid
ciphersuite(s) in the same string were actually applied, not just
that the call returned without crashing.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 08:56:53 2026
(Merged from https://github.com/openssl/openssl/pull/31023)
CONF_parse_list() invokes its callback with elem=NULL and len=0 for
empty list elements (e.g. consecutive separators like "A::B").
ciphersuite_cb() passed elem directly to memcpy() without checking for
NULL, triggering undefined behaviour on any input containing an empty
ciphersuite token.
Skip empty elements early by returning 1 before any pointer dereference.
Fixes#30919
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue May 26 08:56:52 2026
(Merged from https://github.com/openssl/openssl/pull/31023)
Found while adjusting the fuzzer to test for the requirement to
add NUL bytes on the end of ASN1 Strings. If we end up with a 0
length object here we can end up in a crash with memcmp.
This makes this cmp function test comparison like our others
that are 0 length object safe.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue May 26 08:51:35 2026
(Merged from https://github.com/openssl/openssl/pull/31201)
Also removed BUGS section
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Thu May 21 09:14:32 2026
(Merged from https://github.com/openssl/openssl/pull/28456)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 21 09:09:37 2026
(Merged from https://github.com/openssl/openssl/pull/31237)
It is not necessary to flush table for hash tables without rcu.
This is follow up to https://github.com/openssl/openssl/pull/31163
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 21 09:09:36 2026
(Merged from https://github.com/openssl/openssl/pull/31237)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 21 09:03:28 2026
(Merged from https://github.com/openssl/openssl/pull/31216)
Walk the source tree once instead of thrice when removing generated
dependency files, object files, and symlinks; avoid descending into
submodules.
Co-Authored-by: Eugene Syromiatnikov <esyr@openssl.org>
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 21 09:02:44 2026
(Merged from https://github.com/openssl/openssl/pull/31212)
This is caused incorrect err cleanup of mutex even if ql does not exist
(allocation failed).
It also fixes missing freeing of ports that result in assertion failure
because engine port list is not empty.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 21 08:52:14 2026
(Merged from https://github.com/openssl/openssl/pull/31112)
ASN1_STRING is documented that the behavior of NUL byte addition
should not be depended upon.
The mock server calls strcmp on the bare data from an ASN1_STRING.
This only works if the data is NUL terminated.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed May 20 16:01:47 2026
(Merged from https://github.com/openssl/openssl/pull/31202)
typed safestack wrappers pass type-specific copy callbacks such as
TYPE *(*)(const TYPE *) to OPENSSL_sk_deep_copy(). The generic stack code
then called those callbacks through OPENSSL_sk_copyfunc,
void *(*)(const void *), which is an incompatible function pointer type and
triggers UBSan.
Add an OPENSSL_sk_copyfunc_thunk and store it on typed stacks, mirroring the
existing compare/free thunk pattern. Generated safestack helpers now install
a per-type copy thunk when constructing a stack, and internal_copy() uses that
thunk when deep-copying typed stacks. This preserves the generic stack API
while ensuring typed copy callbacks are invoked through their real signature.
Fixes: https://github.com/openssl/project/issues/1951
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed May 20 15:53:45 2026
(Merged from https://github.com/openssl/openssl/pull/31151)
internal_copy() used the generic OPENSSL_sk_freefunc directly when a deep
copy failed after copying some elements. For typed stacks, callers pass
type-specific free callbacks that have been cast to OPENSSL_sk_freefunc, so
calling them through the generic function pointer type is undefined behavior.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed May 20 15:53:43 2026
(Merged from https://github.com/openssl/openssl/pull/31151)
crypto/bsearch.c:33:17: runtime error: call to function int_compare through pointer to incorrect function type 'int (*)(const void *, const void *)'
/home/npajkovsky/openssl/openssl/test/stack_test.c:46: note: int_compare defined here
Fixes: https://github.com/openssl/project/issues/1950
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed May 20 15:53:41 2026
(Merged from https://github.com/openssl/openssl/pull/31151)
evp_generic_do_all() invokes its callback through a fixed pointer type
of the form "void (*)(void *method, void *arg)". The public
EVP_*_do_all_provided() wrappers were handing it user callbacks of type
for example:
void (*)(EVP_MD *, void *)
cast to that generic shape:
evp_generic_do_all(..., (void (*)(void *, void *))fn, arg, ...);
Calling a function through a pointer whose type does not match the
function's actual definition is undefined behavior in C and is flagged
by UBSan's -fsanitize=function.
Introduce a per-type thunk generated by EVP_DO_ALL_PROVIDED_THUNK that
has the exact signature evp_generic_do_all() expects. The thunk
receives the user's typed callback and arg in a small on-stack struct
and forwards them with the correct types, so every indirect call now
matches the pointee's real prototype.
No functional change intended.
Fixes: https://github.com/openssl/project/issues/1949
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed May 20 15:53:38 2026
(Merged from https://github.com/openssl/openssl/pull/31151)
Do not issue TLS 1.3 session tickets if the server has explicitly disabled
them via SSL_OP_NO_TICKET and also disabled the session cache with
SSL_SESS_CACHE_OFF. Together, these settings clearly indicate an intent to
suppress session resumption; sending NewSessionTicket messages in this case
would be wasteful and misleading.
From the server’s perspective, a client that does not advertise
psk_key_exchange_modes in TLS 1.3, or that sends it with RFC 9149 parameters
such as new_session_count = 0 or resumption_count = 0, is effectively
signaling no interest in session tickets or resumption.
RFC 8446 section 4.2.9: Servers MUST NOT select a key exchange mode that is
not listed by the client. This extension also restricts the modes for use
with PSK resumption. Servers SHOULD NOT send NewSessionTicket with tickets
that are not compatible with the advertised modes; however, if a server does
so, the impact will just be that the client's attempts at resumption fail.
Fixes#8077
Signed-off-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 20 15:42:00 2026
(Merged from https://github.com/openssl/openssl/pull/30639)
Add test_ticket_abort_session_leak() to verify that returning
SSL_TICKET_RETURN_ABORT from the decrypt ticket callback during TLS 1.3
resumption does not leak the SSL_SESSION allocated by tls_decrypt_ticket().
This exercises the error path fixed in commit 96f424c439.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 20 14:38:04 2026
(Merged from https://github.com/openssl/openssl/pull/30464)
Two early 'return 0' statements bypass the err: label cleanup that
calls SSL_SESSION_free(sess). When tls_decrypt_ticket() allocates an
SSL_SESSION but the decrypt_ticket_cb returns ABORT, the session is
leaked. Replace 'return 0' with 'goto err' so the existing cleanup
handles it.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 20 14:38:01 2026
(Merged from https://github.com/openssl/openssl/pull/30464)
clang-22 reports UB during test make test V=0 TESTS=test_priority_queue
ssl/priority_queue.c:159:13: runtime error: call to function size_t_compare through pointer to incorrect function type 'int (*)(const void *, const void *)'
/home/npajkovsky/openssl/openssl/test/priority_queue_test.c:28: note: size_t_compare defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ssl/priority_queue.c:159:13
Fixes: https://github.com/openssl/project/issues/1953
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue May 19 10:43:59 2026
(Merged from https://github.com/openssl/openssl/pull/31209)
Fill $apitable with all the major.minor.0 versions up to the current one
in development. Note that while 3.5 hasn't had any APIs deprecated,
it still makes sense to support passing it as an "API level".
Resolves: https://github.com/openssl/openssl/issues/31196
Reported-by: Oliver Roberts <oliver@futaura.co.uk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue May 19 09:33:49 2026
(Merged from https://github.com/openssl/openssl/pull/31198)
Its last actual user was removed in 1620a2e49c "Fix dtls_query_mtu
so that it will always either complete with an mtu that is at least
the minimum or it will fail.", and the only remaining user,
dtls1_link_min_mtu(), just returns its last element unconditionally.
Remove g_probable_mtu and convert dtls1_link_min_mtu into a static const
containing the value.
Complements: 1620a2e49c "Fix dtls_query_mtu so that it will always either complete with an mtu that is at least the minimum or it will fail."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon May 18 11:09:52 2026
(Merged from https://github.com/openssl/openssl/pull/31175)
Fixes#31161
When building with CHARSET_EBCDIC defined,the compiler warns about
discarding the 'const' qualifier when assigning from base_[i * size]
to the non-const pointer p1:
`warning: assignment discards 'const' qualifier from pointer target type`
Change p1 from 'char *' to 'const char *' to maintain const-correctness
since the data being pointed to should not be modified through this
pointer.
Additionally, remove the unused variables l and h that were left over
from a previous implementation of the fallback linear search. These
variables served no purpose and only generated unused variable warnings.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 18 11:07:53 2026
(Merged from https://github.com/openssl/openssl/pull/31173)
Unicode codepoints fit in 32 bits so we can use uint32_t
instead of unsigned long.
Also use OPENSSL_load_XX_be instead of manual shifting.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon May 18 11:02:37 2026
(Merged from https://github.com/openssl/openssl/pull/30967)
This happens because port does not get reset on the first freeing in
channel block so when it is being freed again in ossl_quic_new, it
tries to access item in port.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 18 10:50:23 2026
(Merged from https://github.com/openssl/openssl/pull/31109)
Co-authored-by: Viktor Dukhovni <viktor@openssl.org>
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 18 07:34:16 2026
(Merged from https://github.com/openssl/openssl/pull/31171)
That puts them more in line with CRYPTO_malloc() and CRYPTO_realloc()
behaviour, whose behaviour for the requested size of 0 is well-documented
and not "implementation-defined", as POSIX allows.
Fixes: d090695101 "test: add a sanity test for memory allocation functions"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:30:49 2026
(Merged from https://github.com/openssl/openssl/pull/31158)
While half of the address space is enough to make malloc() fail on
kernels of the same bitness, 32-bit compat can have enough to accommodate
such a request, and even three fourth of the address space. Bump
the requested size closer to the type's upper limit.
Fixes: d090695101 "test: add a sanity test for memory allocation functions"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:30:48 2026
(Merged from https://github.com/openssl/openssl/pull/31158)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 18 07:27:55 2026
(Merged from https://github.com/openssl/openssl/pull/31022)
Separate the mfail framework so it can be used beyond testutil.
Specifically, this is a step toward using it in fuzzing.
This change also improves the way mfail tests are executed. It first
counts the number of allocations and then iterates through them.
This has a couple of advantages:
- It allows removal of MFAIL_SLOW_TEST by identifying slow tests based
on the number of allocations.
- It allows non-failing tests to be ignored.
In addition, it adds a new environment variable to print a backtrace on
memory failure.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:23:52 2026
(Merged from https://github.com/openssl/openssl/pull/31144)
They are included only to one header.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:03:50 2026
(Merged from https://github.com/openssl/openssl/pull/31153)
IWYU pragma: export, tells IWYU tools that the timeval struct is
imported from this header file instead of including <sys/time.h>
everywhere.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:03:49 2026
(Merged from https://github.com/openssl/openssl/pull/31153)
Make these headers self contained even as they are .inc files. This
approach makes it a lot easier to achieve self contained files and
protects from include reorders. (where the .inc can get above the
dependent headers)
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:03:48 2026
(Merged from https://github.com/openssl/openssl/pull/31153)
clang-tidy calculates where to place the headers to be added. The
maximum is the latest include present in the file. Therefore the
algorithm sometimes addes the includes wrongly in the middle of the
file.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon May 18 07:03:47 2026
(Merged from https://github.com/openssl/openssl/pull/31153)
ossl_ecx_key_free is declared as void(ECX_KEY *) but registered
directly in the X25519/X448/Ed25519/Ed448 keymgmt OSSL_DISPATCH
tables for OSSL_FUNC_KEYMGMT_FREE, which is invoked through a
void(*)(void *) pointer in evp_keymgmt_freedata. Calling a function
through a pointer to an incompatible function type is undefined
behavior and is reported by UndefinedBehaviorSanitizer on every
ECX key free:
crypto/evp/keymgmt_meth.c:392:5: runtime error: call to function
ossl_ecx_key_free through pointer to incorrect function type
'void (*)(void *)'
crypto/ec/ecx_key.c:65: note: ossl_ecx_key_free defined here
All four algorithms share the same MAKE_KEYMGMT_FUNCTIONS dispatch
macro, so they hit the same UB; UBSan just deduplicates the report
on the first call.
Mirror the wrapper pattern used by ml_kem_free_key, ml_dsa_free_key,
slh_dsa_free_key, dsa_freedata, ec_freedata, and lms_free_key: add
a small static ecx_free_key with the correct OSSL_FUNC_keymgmt_free_fn
signature that forwards to ossl_ecx_key_free, and register the
wrapper in the dispatch macro. The existing direct callers of
ossl_ecx_key_free in ecx_kmgmt.c are unchanged since they pass a
typed ECX_KEY *.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 14 09:31:58 2026
(Merged from https://github.com/openssl/openssl/pull/31078)
ossl_ml_kem_key_free is declared as void(ML_KEM_KEY *) but registered
directly in the ML-KEM keymgmt OSSL_DISPATCH table for
OSSL_FUNC_KEYMGMT_FREE, which is invoked through a void(*)(void *)
pointer in evp_keymgmt_freedata. Calling a function through a pointer
to an incompatible function type is undefined behavior and is
reported by UndefinedBehaviorSanitizer on every ML-KEM key free:
crypto/evp/keymgmt_meth.c:392:5: runtime error: call to function
ossl_ml_kem_key_free through pointer to incorrect function type
'void (*)(void *)'
crypto/ml_kem/ml_kem.c:1751: note: ossl_ml_kem_key_free defined here
Mirror the wrapper pattern used by ml_dsa_free_key, slh_dsa_free_key,
dsa_freedata, ec_freedata, and lms_free_key: add a small static
ml_kem_free_key with the correct OSSL_FUNC_keymgmt_free_fn signature
that forwards to ossl_ml_kem_key_free, and register the wrapper in
the dispatch table. The existing direct callers of
ossl_ml_kem_key_free in ml_kem_kmgmt.c are unchanged since they pass
a typed ML_KEM_KEY *.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu May 14 09:31:57 2026
(Merged from https://github.com/openssl/openssl/pull/31078)
ML-DSA and SLH-DSA used regular memcmp, use CRYPTO_memcmp()
just in case.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Thu May 14 09:29:14 2026
(Merged from https://github.com/openssl/openssl/pull/31155)
This happens because free_oldmd is not run when flush fails
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 14 09:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31163)
Remove trailing whitespace to address the following find-doc-nits
warnings:
WARNING: line containing nothing but whitespace in paragraph at line 65 in file doc/man7/EVP_CIPHER-DES.pod
WARNING: line containing nothing but whitespace in paragraph at line 69 in file doc/man7/EVP_CIPHER-DES.pod
Fixes: 5ff19a7297 "docs: Document required output buffer length in EVP_CIPHER-DES"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Thu May 14 09:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31141)
This reverts commit 403ba31a02.
PR #27706 (that this PR reverts) was intended to fixnginx/nginx#711
The problem was that when calling SSL_set_SSL_CTX() from an SNI callback
when using a QUIC object, the QUIC custom extensions were not being
handled correctly. The fix attempted to resolve this to make sure that
they were correctly being copied.
However, in reality there was a bug in the SNI callback code that meant when
we called it from a QUIC connection we were passing the *inner* TLS
object instead of the real QUIC one. The *inner* TLS object should be
entirely internal and not exposed to user callbacks. This bug was fixed in
dc84829cc5.
Once the above fix was in place `SSL_set_SSL_CTX()` immediately fails when
called with a QUIC object via the SNI callback. This was always the
intended behaviour - its use with a QUIC object was blocked since the very
beginning - but the fact that we passed the inner TLS object by mistake
circumvented the check when it was invoked from the SNI callback.
The fix in dc84829cc5 actually landed *before* the commit that this PR
reverts. So, in reality the nginx bug was already "fixed" by the time
that PR #27706 was merged (fixed in the sense that the invocation of
`SSL_set_SSL_CTX()` fails gracefully). The code that it introduced can not
be reached (and never could be) because calling `SSL_set_SSL_CTX()` is
explicitly blocked when using a QUIC object. Therefore we should remove
this dead code.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 13 16:23:24 2026
(Merged from https://github.com/openssl/openssl/pull/31159)
Instead of having disabled with no-dh, we need to disable it
with no-dsa.
Fixes: df53ee4fa0 "Add mfail test for ossl_ffc_params_copy"
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 13 09:46:34 2026
(Merged from https://github.com/openssl/openssl/pull/31168)
We now fail with the same alert as if the binder failed to verify.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 13 07:38:34 2026
(Merged from https://github.com/openssl/openssl/pull/31026)
Check that we fail with a decrypt_alert in the same way as a binder
validation failure
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 13 07:38:33 2026
(Merged from https://github.com/openssl/openssl/pull/31026)
Doing things this way removes the possibility of an attacker probing for
valid PSK identities as described in Appendix E.6 of RFC8446. This only
make a difference in a PSK only server configuration. The signal will still
exist if the server can fallback to a full handshake.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 13 07:38:32 2026
(Merged from https://github.com/openssl/openssl/pull/31026)
Refactoring and added tests for extensions, entries, and serial number
duplicates. The tests intentionally reflect the current behavior and existing
error states, which are not always clearly distinguished (e.g., duplicate
extensions vs. parsing errors). This serves as a baseline; follow-up work may
improve error handling or explicitly mark some cases as wontfix.
Signed-off-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Wed May 13 07:36:49 2026
(Merged from https://github.com/openssl/openssl/pull/30349)
Added `BN_CTX_end` call before `BN_CTX_free` to keep the pattern
consistent with functions like `sm2_sig_verify`, `sm2_sig_gen`,
for instance.
Added missing `BN_CTX_start()` and `BN_CTX_end()` calls in
`ossl_sm2_compute_z_digest`. Fixed formatting.
Fixes: 3d328a445c "Add SM2 signature and ECIES schemes"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Wed May 13 07:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31069)
set_up_srp_verifier_file() allocates srp_callback_parm->vb via SRP_VBASE_new().
If SRP_VBASE_init() fails, vb must be freed before returning.
Additionally, add SRP_VBASE_free() to the end: cleanup path in s_server.c so
that vb is also freed on normal program exit.
Solves https://github.com/openssl/openssl/issues/30362Fixes#30362
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Wed May 13 07:20:48 2026
(Merged from https://github.com/openssl/openssl/pull/30434)
port_make_channel() builds an incoming QUIC channel in stages: allocate
the channel, create the user SSL and inner TLS objects, optionally copy
qlog state, then initialise the channel. Under the mfail allocator,
failures in the middle of that sequence could leave ownership split
between the partially-created channel and the user SSL, leaking
allocations from ossl_quic_channel_alloc().
Make port_new_handshake_layer() return the created user SSL to
port_make_channel() and detach the borrowed channel before cleaning up
its own failures. port_make_channel() now owns the error path: it
detaches any created user SSL from the channel, frees the channel exactly
once according to whether channel initialisation already ran cleanup, and
then frees the user SSL.
Also make QUIC stream map cleanup tolerate a NULL map during partial
channel cleanup, and add a focused mfail regression test for
ossl_quic_port_create_incoming().
Fixes: https://github.com/openssl/openssl/issues/31014
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue May 12 12:01:04 2026
(Merged from https://github.com/openssl/openssl/pull/31038)
ossl_quic_stream_map_init() did not check whether lh_QUIC_STREAM_new()
succeeded. On allocation failure qsm->map would be NULL and subsequent
operations on the stream map would dereference it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue May 12 12:01:02 2026
(Merged from https://github.com/openssl/openssl/pull/31038)
After EVP_EncryptFinal, AEAD providers (GCM, OCB, Chacha20-Poly1305)
transition to IV_STATE_FINISHED to prevent IV reuse.
No encryption should be possible in such state.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue May 12 05:14:10 2026
(Merged from https://github.com/openssl/openssl/pull/31104)
If IV was set for Chacha20-Poly1305, code should not
allow reusing IV after calling CipherFinal.
Use iv_state (as used in GCM or OCB mode) to prevent that.
Thanks to Alex Gaynor for reporting the issue.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue May 12 05:14:09 2026
(Merged from https://github.com/openssl/openssl/pull/31104)
These seem to have been from something long long ago
that nothing uses anymore. It seems like this is just something
we should not be doing in this way.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon May 11 09:23:13 2026
(Merged from https://github.com/openssl/openssl/pull/30853)
When OSSL_PKEY_PARAM_EC_GENERATOR is provided as an octet string of
length 0, buf[0] is read before validating data_size, causing a
heap-buffer-overflow detectable under ASan.
Reject zero-length generator octet strings before the dereference.
CLA: trivial
Resolves: https://github.com/openssl/openssl/issues/31125
Fixes: c0f39ded68 "Add Explicit EC parameter support to providers."
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon May 11 08:34:15 2026
(Merged from https://github.com/openssl/openssl/pull/31128)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 11 08:21:56 2026
(Merged from https://github.com/openssl/openssl/pull/31092)
Currently when allocation of cb item fails, the actual cb function is
not called. The is used just in hashtable when the cb function frees
the old item which result in memory leak.
To fix this, the allocation needs to be separated and happen before the
assign operation is done.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 11 08:21:55 2026
(Merged from https://github.com/openssl/openssl/pull/31092)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon May 11 08:09:16 2026
(Merged from https://github.com/openssl/openssl/pull/31121)
The created pair was not freed if ring buf init failed.
Fixes: 3a857b9532 "Implement BIO_s_dgram_mem() reusing the BIO_s_dgram_pair() code"
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon May 11 08:09:14 2026
(Merged from https://github.com/openssl/openssl/pull/31121)
Reject CR and LF characters before serializing request lines and HTTP
headers. This prevents malformed URL or caller supplied components
from altering the generated HTTP request.
Resolves: https://github.com/openssl/openssl/issues/31099
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Mon May 11 07:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/31100)
If allocation fails in ossl_ffc_params_copy, then the params that were
previously allocated are not freed. This results in a memory leak.
Fixes: dc8de3e6f1 "Modify DSA and DH keys to use a shared FFC_PARAMS struct"
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon May 11 07:21:45 2026
(Merged from https://github.com/openssl/openssl/pull/31098)
The functionality was removed in e78253f2d0 "Ignore empty ALPN
elements in CLI args".
CLA: trivial
Complements: e78253f2d0 "Ignore empty ALPN elements in CLI args"
Resolves: https://github.com/openssl/openssl/issues/31088
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon May 11 07:01:42 2026
(Merged from https://github.com/openssl/openssl/pull/31119)
ASN1_STRING_set() has never promised to call strlen() for other
negative values. Other values here likely indicate an error,
such as an integer overflow. Call strlen() only if the length
provided is -1.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon May 11 00:34:25 2026
(Merged from https://github.com/openssl/openssl/pull/31113)
Instead of returning NULL immediately, jump to the cleanup at the end
of the function. Reported by Coverity.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1593754
Fixes: 18472994f0 "The EVP_PKEY_Q_keygen function now explicitly handles NULL curve name"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 11 00:28:25 2026
(Merged from https://github.com/openssl/openssl/pull/31107)
Add missing OPENSSL_free() in error path.
Fixes: 35dc6c353b "QUIC: Make more transport parameters configurable"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon May 11 00:23:13 2026
(Merged from https://github.com/openssl/openssl/pull/30754)
Our own documentation for quite some time has indicated
that you should call X509_verify_cert() instead of using these.
Actually deprecate them and make apps not use the now deprecated
functions.
Resolves: https://github.com/openssl/project/issues/1899
References: https://github.com/openssl/project/issues/1897
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon May 11 00:08:33 2026
(Merged from https://github.com/openssl/openssl/pull/30403)
Add a reference to 'openssl list -public-key-algorithms' in the
-algorithm description to improve discoverability and long term
consistency. Documentation only change.
Add clarification for how to select the naming output in the correct spot.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Sun May 10 23:59:03 2026
(Merged from https://github.com/openssl/openssl/pull/30556)
The rfc_822 date output format uses an asctime-style month-first form.
It does not match RFC 822, RFC 2822, or RFC 5322.
Document the day/month ordering, RFC 822 year length, GMT timezone, and affected commands.
Resolves: https://github.com/openssl/openssl/issues/22223
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Sun May 10 23:52:21 2026
(Merged from https://github.com/openssl/openssl/pull/29851)
Move all the architecture specific header files under a single directory
in include/
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun May 10 09:53:34 2026
(Merged from https://github.com/openssl/openssl/pull/30751)
but it can return 0. Remove dead code and handle this
correctly - memcpy of 0 bytes from NULL is UB.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri May 8 12:15:17 2026
(Merged from https://github.com/openssl/openssl/pull/30609)
noecho_fgets() is enclosed by
#if defined(OPENSSL_SYS_MSDOS) && !defined(_WIN32)
The inner #if defined(_WIN32) is unreachable
#if defined(_WIN32)
i = _getch();
#else
i = getch();
#endif
Remove it.
Verified by cross compilation under DJGPP which is AFAIK the only
MSDOS/non-WIN32 environment we can use.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 20:11:18 2026
(Merged from https://github.com/openssl/openssl/pull/31076)
The block in BN_nist_mod_224() is gated by
#if defined(NIST_INT64) && BN_BITS2 != 64
so the #if
#if BN_BITS2 == 64
rp[7] = carry;
#endif
is unreachable. Remove it.
The code is actualy relic of an earlier design where the NIST_INT64
accumulator path was meant 64-bit too.
Disabling 64-bit path above with BN_BITS2 != 64 resulted in
#if BN_BITS2 == 64 was left unreachable
The outer condition is correct, it is meant to be 32bit only,
otherwise it would need to introduce load_u32/store_lo32 as in other
functions to avoid clang strict-aliasing optimizer issues.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 20:11:12 2026
(Merged from https://github.com/openssl/openssl/pull/31076)
The top-level #if requires !defined(OPENSSL_SYS_TANDEM):
#if defined(OPENSSL_SYS_UNIX) \
&& defined(OPENSSL_THREADS) && !defined(OPENSSL_NO_ASYNC) \
&& !defined(__ANDROID__) && !defined(__OpenBSD__) \
&& !defined(OPENSSL_SYS_TANDEM)
so the nested
#if defined(OPENSSL_SYS_TANDEM)
#include <tdmsig.h>
#else
#include <ucontext.h>
#endif
can never select the OPENSSL_SYS_TANDEM condition.
According to discussion on the issue 31074, removal of the second
(unreachable) condition is the way to go.
Fixes#31074
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 20:11:08 2026
(Merged from https://github.com/openssl/openssl/pull/31076)
When the .inc is only used once, include the file at place.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu May 7 19:30:01 2026
(Merged from https://github.com/openssl/openssl/pull/31075)
By calling the real OBJ_cmp
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 18:14:54 2026
(Merged from https://github.com/openssl/openssl/pull/31048)
We will reject these.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 16:09:48 2026
(Merged from https://github.com/openssl/openssl/pull/30329)
RFC 9598 States:
Certificate Authorities that wish to issue CA certificates with email
address name constraints MUST use rfc822Name subject alternative names
only. These MUST be IDNA2008-conformant names with no mappings and with
non-ASCII domains encoded in A-labels only.
This appears to be to get around the confusion created if someone
attempts to encode a name constraint for an email address into the
UTF-8 version of the name
Were someone to attempt to support this, not only would you now have
to check two separate sets of name constraints for the same thing, but
would now have to decide what to do if they said different things.
So we just flag any such certficiate as invalid
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 16:09:44 2026
(Merged from https://github.com/openssl/openssl/pull/30329)
Since we use this for a sort, in theory this could become
inconsistent if we were to do a make update, re-generate
the output, and check it in from a different development
platform that returns different inconsistencies in how
cmp behaves on uninitialized values.
Rather than ponder this, just make this consistent
by ensuring undefined values have 0 length, and remove
the disabling of the warnings in obj_cmp
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 7 15:41:12 2026
(Merged from https://github.com/openssl/openssl/pull/31046)
We cannot allow an unbounded tag value as this is an O(n^2) algorithm
and the tag cannot be larger than INT_MAX anyway.
Fixes 35852da1d9
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Thu May 7 12:12:25 2026
(Merged from https://github.com/openssl/openssl/pull/31091)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu May 7 07:09:02 2026
(Merged from https://github.com/openssl/openssl/pull/31071)
The function previously returned `NID_des_cfb64` even when nid of the
passed cipher was NID_des_ede3_cfb64, NID_des_ede3_cfb8,
NID_des_ede3_cfb1.
Corrected now to return `NID_des_ede3_cfb64`.
Added an extra test to verify the change.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed May 6 18:58:09 2026
(Merged from https://github.com/openssl/openssl/pull/30977)
The SM2 encryption may write past the caller-provided output buffer
when the required ciphertext size exceeds the supplied buffer length.
Reject outputs that do not fit in the caller-provided buffer.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 6 16:51:00 2026
(Merged from https://github.com/openssl/openssl/pull/30614)
Also fixed the potential NULL pointer dereference in this macro.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 6 16:47:58 2026
(Merged from https://github.com/openssl/openssl/pull/30597)
This function converts affine coordinates of an EC point
to an octet string conforming to Sec. 2.3.4
of the SECG SEC 1 ("Elliptic Curve Cryptography") standard.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 6 16:47:57 2026
(Merged from https://github.com/openssl/openssl/pull/30597)
It errors out with ERR_R_PASSED_NULL_PARAMETER in such case.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed May 6 16:47:55 2026
(Merged from https://github.com/openssl/openssl/pull/30597)
X509_verify is documented to return -1 if the algorithm is invalid
or can't be compared for any reason.
Sadly this implies that it is legitimate to pass it an incorrect X509
object and it should see this. If we hand it a new X509 object with
nothing filled in, it will memcmp(NULL...) at the end of a stack of
FOO_cmp abstractions, which is UB.
Fix this by permitting the 0 length case to return equal without
a memcmp, as suggested by slontis@ and botovq@
Fixes: https://github.com/openssl/openssl/issues/30922
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed May 6 14:55:20 2026
(Merged from https://github.com/openssl/openssl/pull/30943)
Document the non-copying interface functions for BIO pairs that allow
direct access to the internal buffer:
- BIO_nread0/BIO_nread for zero-copy reading
- BIO_nwrite0/BIO_nwrite for zero-copy writing
Also add return value documentation for these functions and remove
the placeholder "[XXXXX: More return values need to be added here]".
Fixes#16366
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 6 14:51:27 2026
(Merged from https://github.com/openssl/openssl/pull/29849)
SSL_CTX_set_session_cache_mode and SSL_CTX_get_session_cache_mode
were documented with SSL_CTX ctx instead of SSL_CTX *ctx in their
synopsis.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 6 11:53:35 2026
(Merged from https://github.com/openssl/openssl/pull/30965)
The windows goo before the guard tricked my tooling
(doing stuff like this on every include is a bit icky, we should
probably fix this somehow)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed May 6 11:36:08 2026
(Merged from https://github.com/openssl/openssl/pull/31001)
Modifies the perl to generate them as such
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed May 6 11:35:59 2026
(Merged from https://github.com/openssl/openssl/pull/31001)
Except for obj_dat.h and obj_xref.h which need perl mungery
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed May 6 11:35:57 2026
(Merged from https://github.com/openssl/openssl/pull/31001)
They are inline implementations. rename to .inc
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed May 6 11:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/31001)
These are guarded with "OSSL_LIBCRYPTO" to ensure the namespace
is distinct from the "OSSL_CRYPTO" guards used in include/crypto
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed May 6 11:35:55 2026
(Merged from https://github.com/openssl/openssl/pull/31001)
The security repo keeps failing our compiler zoo jobs, consistently. It
appears to be happening because our compiler zoo jobs use make -j
without any limit on the number of jobs, leading to github aborting them
all when the workload gets too high. I suspect that we're using a
smaller runner in the security repo than we are in our public repo,
which is why we don't see it there.
Our other CI jobs all limit the job count to 4 during make, do the same
here.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Mon May 4 09:33:34 2026
(Merged from https://github.com/openssl/openssl/pull/31059)
Document the X509_STORE_CTX_set_time() function which sets the
verification time for certificate chain validation. This is a
convenience wrapper around X509_VERIFY_PARAM_set_time().
Remove X509_STORE_CTX_set_time from missingcrypto.txt and
missingcrypto111.txt.
Fixes#21362
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sun May 3 15:38:26 2026
(Merged from https://github.com/openssl/openssl/pull/29899)
The Host Header comes with HTTP/1.1, not 1.0, and some
Web Server now doesn't want to answer to such requests.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Sun May 3 15:21:35 2026
(Merged from https://github.com/openssl/openssl/pull/30981)
We were silently accepting a list with zero identities. Technically this
is a syntax error so we should fail with a decode_error in this case.
Fixes#31006
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun May 3 15:19:27 2026
(Merged from https://github.com/openssl/openssl/pull/31010)
clang-22 with enable-asan and enable-ubsan enabled fails with error
crypto/sparse_array.c:93:21: runtime error: call to function alg_copy
through pointer to incorrect function type 'void (*)(unsigned long, void *, void *)'
ossl_sa_##type##_doall(const SPARSE_ARRAY_OF(type) * sa,
void (*leaf)(ossl_uintmax_t, type *))
{
ossl_sa_doall((OPENSSL_SA *)sa,
(void (*)(ossl_uintmax_t, void *))leaf);
}
typed doall(_arg) expect leaf to have type, but generic code is using
void *, and the type-casting cases the error.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun May 3 15:17:58 2026
(Merged from https://github.com/openssl/openssl/pull/31035)
Fix the inverted cleanse guard in the SLH DSA provider signing path.
When randomized signing populates the local add_rand buffer, the cleanup step currently skips that stack buffer. Other signing modes do not create this transient buffer, so they should not drive this cleanup. Swap the guard so only the transient per signature buffer is cleansed, and cleanse the full fixed size buffer directly.
Fixes#30950
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sun May 3 14:49:20 2026
(Merged from https://github.com/openssl/openssl/pull/31029)
TPM 1.2 Endorsement Key certificates use id-RSAES-OAEP
(NID_rsaesOaep) as their SubjectPublicKeyInfo algorithm
identifier per TCG Credential Profiles V1.2 section 3.2.7.
The underlying key is a standard RSAPublicKey. Without
this mapping, X509_get_pubkey() fails with a decode error
and X509_verify_cert() cannot validate these certificates.
Add NID_rsaesOaep handling to the three SPKI decode paths,
each of which points at the other two so future changes stay
in sync:
- x509_pubkey_decode(): remap the NID to NID_rsaEncryption
for the legacy ameth lookup. This path is reached via
d2i_RSA_PUBKEY()/ossl_d2i_PUBKEY_legacy(), which is in
turn invoked by the provider RSA decoder's rsa_d2i_PUBKEY,
so it is load-bearing even when the provider path is in
use.
- x509_pubkey_ex_d2i_ex(): use "RSA" as the decoder keytype
name so OSSL_DECODER_CTX_new_for_pkey() selects the RSA
provider decoder. The NID check precedes OBJ_obj2txt()
so the text conversion is skipped when unused.
- ossl_spki2typespki_der_decode(): same remap in the
SPKI-to-type-SPKI provider decoder chain. Flatten the
existing SM2 special case while here: the original code
relied on a dangling else across the #endif, which made
the rsaesOaep branch awkward to add. The new structure
initializes dataname to empty, applies each special case
in turn, and falls back to OBJ_obj2txt() only when no
override applied. strcpy() is replaced with
OPENSSL_strlcpy() for consistency with surrounding code.
The OAEP AlgorithmIdentifier parameters (which carry a
TCG-specific pSourceAlgorithm "TCPA" for TPM EKs) are
deliberately not interpreted; only the RSAPublicKey body is
consumed.
Add a test using a real TPM 1.2 EK certificate. The test
exercises both the provider decoder path (via X509_from_strings
+ X509_get0_pubkey) and, when deprecated APIs are available,
the legacy path (via d2i_RSA_PUBKEY), confirming the key
decodes to an RSA EVP_PKEY of the expected size.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Sun May 3 14:44:24 2026
(Merged from https://github.com/openssl/openssl/pull/30961)
RFC8446 requires that a PSK identity is at least one byte in length. We
should validate this.
Fixes#31007
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun May 3 13:46:21 2026
(Merged from https://github.com/openssl/openssl/pull/31058)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
MergeDate: Sun May 3 13:41:54 2026
(Merged from https://github.com/openssl/openssl/pull/30651)
Since it is free'd using this call in tls_set1_bio().
Complements: 435feadaf4 "Fix record layer leak when swapping chained transport BIO"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat May 2 18:10:42 2026
(Merged from https://github.com/openssl/openssl/pull/31011)
Instead of needlessly casting const away, simply update the prototype
of ossl_ipaddr_to_asc(), that doesn't modify the passed data in any way
anyway.
Fixes: f584ae959c "Let's support multiple names for certificate verification"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sat May 2 18:07:19 2026
(Merged from https://github.com/openssl/openssl/pull/31051)
Techincally unnecessary, since this thing won't let you add NULL
data to it, but this is harmless and then obviously following
the correct paradigm.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat May 2 18:05:04 2026
(Merged from https://github.com/openssl/openssl/pull/31049)
The bpart is not freed if BIO_write or BIO_puts fails. It also makes the
error handling of that case consistent with other parts freeing the
bpart.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri May 1 13:06:32 2026
(Merged from https://github.com/openssl/openssl/pull/31033)
If there is a memory failure during record wrlmethod allocation, then
the alert is attemted but it crashes because wrlmethod is NULL.
Found using memfail integration to fuzz tests: GH-30944
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri May 1 12:09:11 2026
(Merged from https://github.com/openssl/openssl/pull/31017)
The symbol presence test fails for NO_DEPRECATED
builds if you use modern CPP practices for definitions.
This is the result of my accepting that doing so will be as PTSD
inducing as walking into my parents bedroom at an inopportune
time, and fixing it. Better me who has less time left to live
with the mental trauma than a younger developer.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri May 1 11:01:46 2026
(Merged from https://github.com/openssl/openssl/pull/31016)
And to avoid future confusion just namespace all of these
to OSSL_
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 11:52:48 2026
(Merged from https://github.com/openssl/openssl/pull/30738)
So that we can decide to decide to do fast path things with conditional
compilaiton, and avoid adding a lock to save a lock
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 11:52:47 2026
(Merged from https://github.com/openssl/openssl/pull/30738)
Old and exotic compilers do not support AVX2 instrinsic.
Add guard for Clang, GCC >= 8 and MSVC >= 2019.
Fixes: #30958
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 11:44:32 2026
(Merged from https://github.com/openssl/openssl/pull/31020)
For code that uses NO_INTERLOCKEDOR64 (Win32 32bit),
there is a warning in RCU code
error: ignoring return value of 'CRYPTO_THREAD_write_lock'
declared with attribute 'warn_unused_result' [-Werror=unused-result]
As the function cannot fail on that platform (and error
path would need some reverts leading to impossible dereference later),
just use trick to silence the warning.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:34 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
GetProcAddress() cannot be simple cast to void* (SD_SYM)
under strict warnigs, as it produces this
error: ISO C forbids conversion of function pointer to
object pointer type [-Werror=pedantic]
Use common trick with cast to (uintptr_t).
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:33 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
On Windows, SOCKET type is unsigned.
All comparison with negative value produces signed/unsigned
warnings, moreover the code is incorrect in error path.
Use INVALID_SOCKET define that should work on all
platforms to detect error.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:31 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
The global progname is already defined above.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:28 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
This function is unused and only causes missing prototype
warning.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:26 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
Add test for OPENSSL_NO_DEPRECATED_1_1_0 (that covers symbols
for these ancient functions).
With strict warnings it break build with
'OPENSSL_API_COMPAT' is not defined, evaluates to '0' [-Werror=undef]
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:25 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
Some older Windows and MING64 environments does not have
WINAPI_PARTITION_SYSTEM defined.
This breaks build with strict warnings.
Add empty definition if this happens.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:23 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
With pedantic option (strict warnings) and MINGW64,
the GetProcAddress() cannot be simply casted, as it leads to
error: cast between incompatible function types from 'FARPROC' ...
Introduce local macro that will wrap all such calls
and silence benign warnings.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:21 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
SOCKET is unsigned on Windows, these is no need to cast
parameter. INVALID_SOCKET test should work on all platforms.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Apr 30 11:42:20 2026
(Merged from https://github.com/openssl/openssl/pull/30941)
To make data structures opaque, replaced direct member access (->data,
->length) with the equivalent ASN1_STRING accessor functions in the
PKCS7 module.
Fixes#29861
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Thu Apr 30 07:19:58 2026
(Merged from https://github.com/openssl/openssl/pull/30896)
It seems that find-doc-nits -o option, that "count[s] symbols added
since 1.1.1 as new", has little use by now (it is not used in any
find-doc-nits invocations, so can only be used manually), and presence
of missing*111.txt files (and especially entries there) only creates
confusion these days. Remove the option and the associated files.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 30 07:02:41 2026
(Merged from https://github.com/openssl/openssl/pull/30978)
So it's easier to reproduce the failure.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 06:59:08 2026
(Merged from https://github.com/openssl/openssl/pull/30991)
Memory allocation failure testing (and counting) is done both for malloc
and realloc calls, so the sum of those ought to be reported.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 06:59:07 2026
(Merged from https://github.com/openssl/openssl/pull/30991)
Otherwise the counting done by shouldfail() does not account for calls
that are diverted to non-standard implementation and zero-sized
allocations, making it diverge from the sum of malloc_count
and realloc_count.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 06:59:07 2026
(Merged from https://github.com/openssl/openssl/pull/30991)
mfail allocator hooks installation affect memory allocation counts,
so it should be disabled for both "count" and "run" test calls.
Fixes: 3cff7c2181 "Add memory allocation failure testing framework"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 06:59:06 2026
(Merged from https://github.com/openssl/openssl/pull/30991)
Older compilers like MSVC 2013 do not support it.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 30 06:49:22 2026
(Merged from https://github.com/openssl/openssl/pull/31019)
Clarify the behavior of OSSL_HTTP_adapt_proxy() regarding proxy determination and exclusion lists.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed Apr 29 15:25:34 2026
(Merged from https://github.com/openssl/openssl/pull/30848)
As currently implemented, the only txe passed to qtx_reserve_txe()
(and, subsequently, to qtx_resize_txe()) is qtx->cons one, so the check
"if (qtx->cons == txe)" is superfluous, and, more so, would lead
to a memory leak if it weren't the case, as was spotted by Coverity.
Moreover, the set of qtx_alloc_txe(), qtx_ensure_free_txe(),
qtx_ensure_cons(), qtx_resize_txe(), and qtx_reserve_txe() functions,
while being written in a relatively generic way, is actually called
from a single call site in ossl_qtx_write_pkt(), and contains several
duplicating checks and unnecessary logic (like, adding a newly allocated
TXE to the free list, only to remove it from there right away
in qtx_ensure_cons(), the only its user), so just merge the whole
aforementioned set of functions (except qtx_alloc_txe()) in a single
function, qtx_get_cons_txe().
Resolves: https://scan5.scan.coverity.com/#/project-view/63999/10222?selectedIssue=1691460
Complements: 16892155e1 "quic: fix NULL txl dereference in qtx_resize_txe"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 29 15:12:14 2026
(Merged from https://github.com/openssl/openssl/pull/30783)
The uplink code breaks compilation with strict warnings
for MINGW (only for 32-bit).
error: ISO C forbids conversion of object pointer
to function pointer type [-Werror=pedantic]
or
error: ISO C forbids assignment between function pointer
and 'void *' [-Werror=pedantic]
and some other missing declarations and prototypes.
As uplink.h is included in cryptlib.h and used in BIO
code, using a pragma to disable warnings would touch
to much code.
With (uintptr_t) cast, it silences cast warnings with gcc.
For the rest of the code, just disable warnings, as this
code would need to be rewritten and heavily retested
on older systems.
NOTE: applink.c is INCLUDED from uplink.h.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Apr 28 16:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/30963)
On 32bit platforms, some compilers like clang
produce this warning
error: result of comparison 'unsigned long' > 4294967295
is always false [-Werror,-Wtautological-type-limit-compare]
70 | if (c > 0xffffffffL)
Just compare it to UNICODE_MAX here.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Apr 28 16:01:04 2026
(Merged from https://github.com/openssl/openssl/pull/30962)
QUIC stack may panic when application calls SSL_get_stream_write_state()
on cocluded QUIC stream onject. The sequence of action which leads
to NULL pointer dereference is as follows:
- application uses SSL_stream_conclude(ssl_stream, 0) to conclude
the stream (let remote peer know no to expect more data)
- application uses SSL_get_stream_write_state(ssl_stream)
to query stream state.
If underlying sstream object is gone by the time when
SSL_get_stream_wtite_state() is called, then application
may see NULL pointer dereference. The underlying sstream
object is freed when FIN sent on beahalf of SSL_stream_conclude()
is ACKed by remote peer.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Apr 28 12:35:41 2026
(Merged from https://github.com/openssl/openssl/pull/30913)
The hmac fips provider implementation used by the EVP_MAC API handles key
size checks, but it only does the test for the internal case.
Previously HMAC was implemented using EVP_DigestSign related functions,
and these are implemented using a mac_legacy_sig bridge, because of this
the MAC is external. For external cases the caller is responsible for
doing any key checks, so a FIPS indicator has been added.
Reported-by: https://github.com/taha2samyFixes: #30012
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Apr 28 07:13:24 2026
(Merged from https://github.com/openssl/openssl/pull/30150)
tls_set1_bio() freed only the top BIO (BIO_free). Use BIO_free_all so
a pushed transport chain is released when the record layer replaces
its BIO.
Add test_ssl_set_wbio_chain_no_leak in sslapitest (stacked BIO chain
via SSL_set0_wbio) per reviewer feedback on GH openssl#30483. Drop the
Perl s_client reconnect recipe and CHANGES entry (internal leak only).
Fixes#30458
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Apr 28 06:39:25 2026
(Merged from https://github.com/openssl/openssl/pull/30483)
Add coverage for duplicate property cache insertion and
allocation-failure handling in the property method cache.
The memfail exerciser covers cache set, providerless cache deletion,
providerless cache rebuild, and cleanup of method references when
cache insertion fails.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Apr 28 06:33:15 2026
(Merged from https://github.com/openssl/openssl/pull/30891)
Treat method-cache hash table inserts as successful only when they
return 1. This handles allocation/grow failures distinctly from
successful replacement and avoids using temporary QUERY entries after
failed insertion.
Separate cleanup for unlinked temporary QUERY objects from linked
cache entries, and release both the pending cache reference and
caller-visible method reference when deferred providerless cache
insertion fails.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Apr 28 06:33:15 2026
(Merged from https://github.com/openssl/openssl/pull/30891)
Free pre-existing ch->qlog_title before OPENSSL_strdup to avoid
leaking the value allocated in ossl_quic_channel_alloc(). Use
ossl_quic_channel_free() on strdup failure to ensure proper cleanup.
Solves https://github.com/openssl/openssl/issues/30440Fixes#30440
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Apr 27 07:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/30441)
reference list of files and removed -Werror from instructions on adding
functions rename HACKING.md to HOWTO.md.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 27 06:14:57 2026
(Merged from https://github.com/openssl/openssl/pull/18003)
On s390x, the distribution of the query cache hash values is different
compared to other architectures, probably because of endianess and pointer
alignment being different (the hash key contains pointer values and integers).
This leads to the fact that ossl_ht_cache_QUERY_insert() is not always able to
add a query during the FIPS selftests, and thus ossl_ht_cache_QUERY_insert()
returns -1 is such cases.
Increase the number of retries inside ossl_ht_insert() to at least the
number elements per neighborhood plus 1. With this it is able to grow the
hash table enough so that the queries used during the FIPS selftest can
all be added to the hash table, even on s390x.
There is still no guarantee that the number of retries is enough for all
possible queries. It can still happen that certain queries can't be added to
the cache, even on other architectures. This does not really hurt, such
queries will just not be cached and are freshly fetched again the next time.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Apr 27 05:56:53 2026
(Merged from https://github.com/openssl/openssl/pull/30903)
Update grow_hashtable cleanup to free the neighborhood allocation
through newmd->neighborhood_ptr_to_free instead of newmd->neighborhoods.
Fixes: cc4ea5e000 "Introduce new internal hashtable implementation"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 14:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/30859)
ossl_param_build_set_bn_pad() is reached by two distinct caller
populations. When an OSSL_PARAM_BLD template is supplied
(bld != NULL), the template allocates backing storage internally and
no caller-side sizing is required. When an explicit OSSL_PARAM[]
array is supplied (bld == NULL), the caller follows the standard
OSSL_PARAM size-probe contract: invoke the primitive once with
p->data == NULL to learn the required size via p->return_size, then
allocate a buffer of that size and invoke again with the real
storage.
The bld == NULL branch did not honour the size-probe contract: with
p->data == NULL and a non-zero sz it fell through to
OSSL_PARAM_set_BN() and raised CRYPTO_R_TOO_SMALL_BUFFER, so callers
could never discover the required size.
The defect has been latent across several releases. This primitive
is the *padded* BN setter: it emits a fixed-width encoding regardless
of the BN's actual magnitude, which is needed for the private key --
a minimal encoding would leak its bit-length through timing or
allocation side channels. In practice the private key is the only
provider parameter that reaches this primitive. Callers that want
private-key material have historically done so through
EVP_PKEY_todata() and its OSSL_PARAM_BLD template path, where the
bug is invisible. EVP_PKEY_get_params() callers exist but have not
previously needed the private-key BN. Any caller that does request
it on the explicit-params path -- whether by name or as part of
iterating a provider's full gettable list -- now sees the probe
behave as it does elsewhere.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun Apr 26 13:35:32 2026
(Merged from https://github.com/openssl/openssl/pull/30942)
Those function used to be backends for SSL_attach_stream() and
SSL_detach_stream(). Both those functions were removed from
API back 2023. And it does not look like there is a plan
to revive them. This PR removes implementation of stream detach/attach
functions with their tests.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 13:26:58 2026
(Merged from https://github.com/openssl/openssl/pull/30956)
EVP_get_digestbynid() only searches the legacy built-in digest table and
cannot resolve provider-only digests, which breaks X509 signature info
computation, GOST TLS handshakes, and OCSP cert ID matching when the
digest is loaded exclusively through a provider. Switch the three affected
sites to use EVP_MD_fetch() (with the appropriate libctx/propq).
x509_sig_info_init() gains libctx/propq parameters propagated
from the X509 struct by its caller.
Resolves: https://github.com/openssl/openssl/issues/30604
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 13:13:14 2026
(Merged from https://github.com/openssl/openssl/pull/30888)
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.
This issue was discovered when building Node.js with clang.
CLA: trivial
Fixes: 52cd2a49c5 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: https://github.com/nodejs/node/pull/62656
Resolves: https://github.com/openssl/openssl/issues/30806
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from https://github.com/openssl/openssl/pull/30832)
This patch adds an AArch64-specific extension cross-compile workflow.
This is inspired by the existing RISC-V extension cross-compile
workflow and applies the same matrix-driven approach to AArch64.
References: https://github.com/openssl/openssl/issues/29269
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
MergeDate: Sun Apr 26 11:53:08 2026
(Merged from https://github.com/openssl/openssl/pull/30764)
A user has reported that win32_pathbyaddr can be unreliable in
multithreaded environments. See:
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot
Specifically they have observed the following behavior, as noted in the
above article:
When taking snapshots that include heaps and modules for a process other than
the current process, the CreateToolhelp32Snapshot function can fail or return
incorrect information for a variety of reasons. For example, if the loader data
table in the target process is corrupted or not initialized, or if the module
list changes during the function call as a result of DLLs being loaded or
unloaded, the function might fail with ERROR_BAD_LENGTH or other error code.
Ensure that the target process was not started in a suspended state, and try
calling the function again. If the function fails with ERROR_BAD_LENGTH when
called with TH32CS_SNAPMODULE or TH32CS_SNAPMODULE32, call the function again
until it succeeds.
This behavior necessitates calling DSO_pathbyaddr mutiple times to get a
succesful return code.
win32_pathbyaddr can be made more reliable, avoiding the need for multiple calls
by using alternate windows apis that are not/less succeptible to these transient
errors in multithreaded environments.
refactor win32_pathbyaddr here to implement that increased reliability.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 11:48:58 2026
(Merged from https://github.com/openssl/openssl/pull/30705)
The PATH_MAX define is needed on HURD which is now skipped since it is
winthin the _WIN32 block.
Move the PATH_MAX check+define outside of the _WIN32 block.
Fixes: a2e5848d9d "s_client and s_server options for ECH"
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Apr 26 11:35:52 2026
(Merged from https://github.com/openssl/openssl/pull/30520)
Null mkey/xkey immediately after OPENSSL_memdup() so that any failure
path (including propq strdup) can safely call mlx_kem_key_free() without
risking a double-free on the source key's material. Use key->* rather
than ret->* for source-state checks to make ownership explicit.
Test that mlx_kem_dup() with partial key selection (e.g.
EVP_PKEY_PUBLIC_KEY) does not corrupt the original key's mkey/xkey
sub-objects. Covers X25519MLKEM768, SecP256r1MLKEM768,
and SecP384r1MLKEM1024.
Fixes: 4b1c73d2dd "ML-KEM hybrids for TLS"
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sun Apr 26 11:14:12 2026
(Merged from https://github.com/openssl/openssl/pull/30511)
"< 0" is definitely wrong as it can return 0 on error.
Change the checks that are not of the form "== 1" or "!= 1" to "<= 0".
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 24 11:29:50 2026
(Merged from https://github.com/openssl/openssl/pull/30923)
Introduce ADD_MFAIL_TEST for exhaustive testing of allocation failure
handling in individual functions. The framework repeatedly calls the
test function, each time failing one allocation later within the
section bracketed by mfail_start() and mfail_end(), verifying that
every failure path returns 0 without crashing or leaking.
Custom allocators are installed once at startup via
CRYPTO_set_mem_functions(). When not armed, they pass through to
malloc/realloc/free. Installation can be disabled by setting
OPENSSL_TEST_MFAIL_DISABLE for tests that need the default allocator
(e.g. those using OPENSSL_MALLOC_FAILURES).
Additional environment variables control test execution:
OPENSSL_TEST_MFAIL_SKIP_ALL, OPENSSL_TEST_MFAIL_SKIP_SLOW,
OPENSSL_TEST_MFAIL_POINT, and OPENSSL_TEST_MFAIL_START.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 23 20:23:34 2026
(Merged from https://github.com/openssl/openssl/pull/30871)
- The pointer cannot be NULL, and test only confuses static analysers.
- Incidentally, undo clang auto-format of displayed tables in the same file.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 23 14:03:40 2026
(Merged from https://github.com/openssl/openssl/pull/30829)
This mirrors the corresponding code in ML-KEM and works under
the same conditions/assumptions. Also adjusted related
functions with unnecessary 2-layers of constant_time selects
where one suffices (now also matching BoringSSL).
Intentionally uses the constant time instrumentation PR as its
merge-base, so to be merged after than has baked in for a few
days and shows working CT tests in daily CI runs.
Sample before/after performance pairs and percent throughput
increases for one X86_64 CPU:
keygens/s sign/s verify/s
ML-DSA-44 18728.3 6061.2 23251.6
ML-DSA-44 21077.2 7392.4 27244.3
ML-DSA-44 12.5% 22.0% 17.2%
ML-DSA-65 10084.3 3603.0 13988.6
ML-DSA-65 11197.9 4549.7 16208.4
ML-DSA-65 11.0% 26.3% 15.9%
ML-DSA-87 7184.8 2917.3 8141.0
ML-DSA-87 8132.4 3693.7 9430.7
ML-DSA-87 13.2% 26.6% 15.8%
and here's the same for an Apple silicon M2:
keygens/s sign/s verify/s
ML-DSA-44 17235.7 3099.3 15744.5
ML-DSA-44 21855.2 4907.6 22849.0
ML-DSA-44 26.8% 58.3% 45.1%
ML-DSA-65 9165.8 1908.5 10058.3
ML-DSA-65 11262.7 3069.6 14348.1
ML-DSA-65 22.9% 60.8% 42.6%
ML-DSA-87 6596.1 1563.6 6330.8
ML-DSA-87 8404.9 2584.6 8767.6
ML-DSA-87 27.4% 65.3% 38.5%
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 23 13:55:05 2026
(Merged from https://github.com/openssl/openssl/pull/30864)
MINGW64 with MSYS2 environment is a supported platfrom
but not covered in CI.
This patch adds trivial rebuild test (but avoid 3rd party
scripts), with the same restrictions as MINGW64.
Tests and strict warnings need to be fixed later.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Apr 23 12:12:36 2026
(Merged from https://github.com/openssl/openssl/pull/30906)
The man page previously stated that X509_CRL_delete_ext() and
X509_REVOKED_add_ext() are 'otherwise identical to the X509v3 functions,'
which is inaccurate. These routines use X509v3_delete_extension(), not
X509v3_delete_ext(), following the changes in #30350 and #30518.
Update the documentation to accurately describe this difference.
CLA: trivial
Signed-off-by: legin hpesoj <ncj2394@rit.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Apr 22 08:10:46 2026
(Merged from https://github.com/openssl/openssl/pull/30677)
Also slightly refactor the ML-KEM version to share the necesasry
defines, and add a daily CI run to check both (presently, for just some
platforms with known working valgrind support).
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 22 07:55:14 2026
(Merged from https://github.com/openssl/openssl/pull/30863)
RFC 8446 defines the Cookie extension as containing a non-empty cookie
vector. The client-side HRR parser accepted a zero-length cookie
because PACKET_memdup() treats an empty packet as success, which
deferred failure until later in the handshake.
Reject an empty cookie during HRR parsing with decode_error and add a
regression test.
Fixes#30868
Fixes: cfef5027bf "Add basic TLSv1.3 cookie support"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Apr 22 07:50:25 2026
(Merged from https://github.com/openssl/openssl/pull/30892)
The changes in #29324 neglected some setup needed for interactive
password prompting, leading to a segfaul when pkey(1) is asked to
encrypt, but not given an explicit `-pass` argument.
The required plumbing is added.
Fixes: #30889
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 22 07:04:47 2026
(Merged from https://github.com/openssl/openssl/pull/30904)
When X509_add_cert() or sk_X509_CRL_push() failed, the cert or CRL from
OSSL_STORE was not freed. Free on failure to avoid a leak.
Fix 90-test_memfail.t parsing of count output so the memfail suite runs
correctly: parse 'skip: N count M' with a regex (handles '# ' prefix),
return (0,0) if the count file cannot be opened, and skip with a clear
message when total malloc count is 0 instead of planning 0 tests.
Apply clang-format to test/load_key_certs_crls_memfail.c.
- apps/lib/apps.c: free cert/CRL on add/push failure
- test/build.info: add load_key_certs_crls_memfail (allocfail-tests)
- test/load_key_certs_crls_memfail.c: regression test for issue #30364
- test/recipes/90-test_memfail.t: fix get_count_info parsing and plan
Issue #30364
Fixes: 6d382c74b3 "Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c"
Fixes: d7fcee3b3b "OSSL_HTTP_parse_url(): add optional port number return parameter and strengthen documentation"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 21 08:50:18 2026
(Merged from https://github.com/openssl/openssl/pull/30428)
MINGW64 is supported platfrom but not covered in CI.
This patch adds trivial rebuild test, for now without strict
warnings (need to be fixed later).
Fixes: https://github.com/openssl/project/issues/1911
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 20 10:04:58 2026
(Merged from https://github.com/openssl/openssl/pull/30860)
POSIX states errno is only valid when the return value indicates an
error. recv() sets errno only on -1; when it returns 0 (peer closed)
errno is unspecified.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Apr 20 09:59:27 2026
(Merged from https://github.com/openssl/openssl/pull/30877)
These branches are EOL, so there is no need to keep running CI jobs
for them.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 20 09:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/30881)
this is yet another small fallout from clang-format
style change. This time for radix tests.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 17 10:50:07 2026
(Merged from https://github.com/openssl/openssl/pull/30844)
Instead of growing the init_buf buffer immediately to the full size of the
expected message, we grow it incrementally as we receive the data. This
prevents abuse where the remote peer claims a very large message size, but
then doesn't send it.
This change is as a result of a security issue reported to the
openssl-security team by Okta Red Team. The openssl-security
team have decided to handle this as a "bug or hardening" only fix.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 17 10:08:34 2026
(Merged from https://github.com/openssl/openssl/pull/30792)
header when destination connection id is not present. To save CPU cycles.
Issue has been noticed and kindly reported by Dan Carpenter via
openssl-users@ mailing list.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 16 22:59:33 2026
(Merged from https://github.com/openssl/openssl/pull/30795)
In calls like ERR_set_mark(), ERR_clear_last_mark() and
others, there is no point in saving the last sys error.
It can be potentially expensive (on Windows).
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Apr 16 18:12:49 2026
(Merged from https://github.com/openssl/openssl/pull/30179)
When parsing the configured TLS supported groups list reallocating of the list
of "tuples" happened one element too late. The current tuple count is the
number of "closed" (completed) tuples, the currently active tuple occupies
one more slot, so we need space for `tuple count + 1` elements.
This is only an issue while parsing configurations (not attacker controlled),
and only if the group list somehow manages to contain 32 or distinct elements
(each in its own tuple, and even though OpenSSL does not implement that many
groups in typical builds).
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:17:38 2026
(Merged from https://github.com/openssl/openssl/pull/30838)
We test that even if we add too many PSKs we still handle the
ClientHello correctly.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:07:38 2026
(Merged from https://github.com/openssl/openssl/pull/30761)
To prevent attacks where an unauthenticated client sends us a large
number of PSKs, we place a limit on the number we are prepared to
accept.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:07:37 2026
(Merged from https://github.com/openssl/openssl/pull/30761)
QEMU 8.2.2 (ubuntu-latest) does not report ZVKNED via hwprobe
despite zvkned=true being set in QEMU_CPU, so the _V_ZVKNED
assertion would fail in CI for a reason unrelated to OpenSSL.
Weaken the check to _V, which QEMU 8.2.2 does report correctly.
The ZVKNED assertion can be restored once the CI moves to a QEMU
version with full Zvk* hwprobe coverage.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:43 2026
(Merged from https://github.com/openssl/openssl/pull/30713)
The two hwprobe-based matrix entries exercise hwprobe_to_cap() but
previously contained no assertion to verify that expected extensions
were actually detected; tests pass regardless of which code path is
taken because both the optimised and fallback paths produce correct
output.
Add an optional capscheck field to the matrix schema. When set, a
new "check detected capabilities" step runs
"openssl info -cpusettings" and asserts the output matches the
given extended regular expression.
Set capscheck for the two hwprobe entries:
- rv64gc_novector_hwprobe: assert "_ZBB" is present.
With the IS_IN_DEPEND_VECTOR bug, scalar extensions are gated on
VECTOR_CAPABLE (false when V is absent), so ZBB is not detected
and the assertion fails.
- rv64gc_v_zvkned_hwprobe: assert "_V_ZVKNED" is present.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/30713)
All existing RISC-V cross-compile matrix entries set OPENSSL_riscvcap,
which causes OPENSSL_cpuid_setup() to call parse_env() and skip the
hwprobe_to_cap() code path entirely. That path has never been exercised
by CI, leaving bugs in it undetectable.
Add two matrix entries that omit opensslcapsname so OPENSSL_riscvcap is
not set and hwprobe_to_cap() is called:
- rv64gc_novector_hwprobe: rv64 with ZBB/ZBC/ZBS/ZBKB, V disabled.
AT_HWCAP V bit is clear (VECTOR_CAPABLE=false). Exercises the
scalar-extension detection branch of hwprobe_to_cap().
- rv64gc_v_zvkned_hwprobe: rv64 with V (vlen=128) and ZVKNED.
AT_HWCAP V bit is set (VECTOR_CAPABLE=true). Exercises the
vector-extension detection branch and the IS_IN_DEPEND_VECTOR
guard that gates Zvk* extensions on V availability.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:41 2026
(Merged from https://github.com/openssl/openssl/pull/30713)
The macro checked (ZVX_MIN >= offset) which is equivalent to
(offset <= ZVX_MIN), making it true for offsets 0-15 instead of
the intended range [ZVX_MIN, ZVX_MAX] = [15, 23].
The practical effect in hwprobe_to_cap() was inverted:
- Scalar extensions (ZBA..ZKT, offsets 0-14) were incorrectly
treated as vector-dependent and suppressed when VECTOR_CAPABLE
was false, preventing their detection via hwprobe.
- Vector extensions ZVBC..ZVKSH (offsets 16-23) were not treated
as vector-dependent, allowing them to be enabled via hwprobe
even when the V extension was absent.
Fix by changing >= to <= so the macro correctly tests whether
offset falls in [ZVX_MIN, ZVX_MAX].
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:40 2026
(Merged from https://github.com/openssl/openssl/pull/30713)
Ensure that when a ClientHello includes both a Session ID and a PAC-Opaque
in the SessionTicket extension, the server echoes the same Session ID in
the ServerHello if the session is resumed based on the PAC-Opaque.
Fixes#29095
Signed-off-by: Daniel Kubec <kubec@openssl.foundation>
Co-authored-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:01:03 2026
(Merged from https://github.com/openssl/openssl/pull/30695)
It is also simplified and generalized.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 16 16:52:56 2026
(Merged from https://github.com/openssl/openssl/pull/27554)
Clarify when they can be used, and introduce some warnings about using
them too late in the handshake. In particular using them in the server
name callback is too late.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:46:26 2026
(Merged from https://github.com/openssl/openssl/pull/30797)
Add a value barrier to the mask variable in ossl_curve448_scalar_halve()
to prevent LLVM SimpleLoopUnswitchPass from introducing a
secret-dependent branch.
When compiled with Clang >= 17 at -O3, the mask which is static during
the loop (derived from the secret scalar LSB) is used by SimpleLoopUnswitchPass
to clone the loop body into two versions guarded by a branch on the secret bit.
This produces a side-channel that leaks nonce parity.
The value barrier forces the compiler to treat the mask as opaque,
preventing loop unswitching while maintaining identical performance.
A portable value_barrier_c448 macro is added to word.h to select the
appropriate barrier width (32 or 64 bit) based on C448_WORD_BITS.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:43:22 2026
(Merged from https://github.com/openssl/openssl/pull/30845)
Bring NEWS.md/CHANGES.md into line with updates on the 4.0 branch
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:27:47 2026
(Merged from https://github.com/openssl/openssl/pull/30830)
When session resumption falls back to a full handshake due to a ciphersuite
mismatch, ensure a new session ticket is issued with the newly negotiated
ciphersuite.
Fixes#18549
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 16 11:27:51 2026
(Merged from https://github.com/openssl/openssl/pull/30626)
ssl_do_config() could leave stale errors on the error stack even on
success, so that later error checking operations could mistakenly
surface these errors. Use ERR_set_mark()/ERR_pop_to_mark() to cleanly
discard errors when the function succeeds or when system config errors
are non-fatal.
Fixes#30760
Co-authored-by: Brandon Allard <brandon@redpanda.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Apr 16 11:24:56 2026
(Merged from https://github.com/openssl/openssl/pull/30765)
Change duplicating names of the suggested function names from TLS_* to DTLS_*
ones and fix the case of "API".
Co-Authored-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Thu Apr 16 11:19:19 2026
(Merged from https://github.com/openssl/openssl/pull/30819)
discover all provided ciphers with non-zero IV length and verify
correct multi-step initialization semantics.
The EVP API permits key and IV to be supplied in separate
`EVP_CipherInit_ex()` calls (e.g. key-only followed by IV-only).
A recent bug (PR #29934, ASCON-AEAD128) demonstrated that a
provider may silently ignore a key-only init, resulting in reuse
of a previously loaded key during a subsequent IV-only init.
To prevent similar regressions, this change introduces three
generic tests that automatically cover all IV-taking ciphers:
Verifies that:
- `init(key) → init(iv)`
- `init(iv) → init(key)`
produce identical ciphertext (and authentication tag for AEAD
ciphers) compared to single-call `init(key, iv)`.
Primes a context with `key1/iv1`, then re-initializes via
`init(key2) → init(iv2)` and verifies the output matches a fresh
`encrypt(key2, iv2)` operation, ensuring that no previously stored
key is reused.
Encrypts using single-call initialization and then decrypts using
multi-step initialization, verifying plaintext recovery. For AEAD
ciphers, this also exercises tag verification through the
multi-step path.
Ciphers are discovered using `EVP_CIPHER_do_all_provided()`,
requiring no maintenance when new IV-taking ciphers are added.
SIV mode is skipped due to its synthetic IV semantics. CCM mode
handling includes required length declarations.
This provides broad regression coverage for the provider
implementations that support multi-step EVP initialization.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 16 07:08:17 2026
(Merged from https://github.com/openssl/openssl/pull/30141)
Shut off clang-format, as it is incapable of formatting arrays properly,
and just mangles everything instead. Also, while at it, drop the trailing
commas from TPARAM_CHECK_* definitions, as they are pretty confusing.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:37 2026
(Merged from https://github.com/openssl/openssl/pull/30580)
Add a parameter to TLSProxy::Proxy->new()
and TLSProxy::Proxy->new_dtls() that indicates IPv6 usage preference
and pass have_IPv6() to it, so IPv6 usage is avoided when it is disabled.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:33 2026
(Merged from https://github.com/openssl/openssl/pull/30580)
Define and add the test only if OPENSSL_USE_IPV6 is set to 1.
Resolves: https://github.com/openssl/openssl/issues/30574
Fixes: beec4e146a "Add SSL_get_peer_addr() function to query peer address for QUIC"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:31 2026
(Merged from https://github.com/openssl/openssl/pull/30580)
The -hex option description was ambiguous about its exact behavior.
Clarify that:
- With -generate: outputs the prime in hex instead of decimal
- When checking: interprets input as hex instead of decimal
- Output when checking is always hex regardless of this option
Fixes#19208
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 12:33:18 2026
(Merged from https://github.com/openssl/openssl/pull/29913)
So its config options can be copied into a newly created branch more naturally.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:38 2026
(Merged from https://github.com/openssl/openssl/pull/30785)
This really should have been done when the branch was added, but better
late than never.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:37 2026
(Merged from https://github.com/openssl/openssl/pull/30785)
The documentation for BN_add and related functions did not explicitly
state that the ctx parameter cannot be NULL. Users may assume NULL is
acceptable since some other OpenSSL functions allow it, but passing
NULL to functions like BN_mod_add() or BN_mod() causes a crash.
Update the documentation to explicitly state that ctx must not be NULL.
Fixes#12092
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 11:47:59 2026
(Merged from https://github.com/openssl/openssl/pull/29773)
There is a missing call to OPENSSL_free() in the branch
where existing sets are merged to new range. There is
no evidence/POC OpenSSL poject is aware of the leak can
be triggered by QUIC protocol operation.
The issue has been kindly reported by Abhinav Agarwal (@abhinavagarwal07)
Fixes: c5ca718003 "uint_set: convert uint_set to use the list data type"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 11:28:41 2026
(Merged from https://github.com/openssl/openssl/pull/30718)
ossl_prov_aes_hw_gcm() returned &rv64i_zvkned_gcm when
RISCV_HAS_ZVKNED() was true but RISCV_HAS_ZVKB()/RISCV_HAS_ZVKG()
were false, without checking riscv_vlen() >= 128. All Zvkned
instructions require VLEN >= 128; on VLEN=64 hardware this would
cause illegal-instruction traps.
All other Zvk* dispatch sites already guard on riscv_vlen() >= 128.
Hoist the check to the outer if (RISCV_HAS_ZVKNED()) condition to
cover both return paths uniformly.
Fixes: d056e90ee5 "riscv: Provide vector crypto implementation of AES-GCM mode."
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Apr 15 11:24:50 2026
(Merged from https://github.com/openssl/openssl/pull/30714)
keep bold and move to an unordered list
Co-authored-by: Tomáš Mráz <tm@t8m.info>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 15 10:54:01 2026
(Merged from https://github.com/openssl/openssl/pull/30629)
In port_bind_channel(), when ossl_quic_provide_initial_secret()
fails, the function returns without freeing the QUIC_CHANNEL
that was just created by port_make_channel(). The caller sees
new_ch == NULL and cannot free it, leaking the channel and all
its sub-allocations (QRX, QTX, TXP, ACKM).
Add ossl_quic_channel_free(ch) before the early return, matching
the cleanup pattern already used by the other error paths in the
same function (lines 864, 873).
CWE-401
Reported-by: Sunwoo Lee <sunwoolee@kentech.ac.kr>
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 10:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/30612)
Avoid "Use of uninitialized value in concatenation (.) or string
at util/mkinstallvars.pl line 139." message by supplying COMMENT
in the mkinstallvars.pl call exporters/build.info.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:54:11 2026
(Merged from https://github.com/openssl/openssl/pull/30768)
Using our previously created atomic ops, we can (almost) eliminate the
use of the rand_meth_lock. This lock guards reads/write on the
RAND_default_meth global variable, which is generally written only once
during a process lifetime. By replacing the lock with an atomic read
for reads, and an atomic compare and exchange or atomic store for
writes, we can significantly improve the execution time of
RAND_get_rand_method, which is called every time a process calls
RAND_bytes_ex()
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:29:31 2026
(Merged from https://github.com/openssl/openssl/pull/30670)
CRYPTO_atomic_load_ptr - load a pointer value with relaxed semantics
CRYPTO_atomic_store_ptr - store a pointer value with relaxed semantics
CRYPTO_atomic_cmp_exch_ptr - cmp/exch a pointer with relaxed or acq/rel
semantics
The addition of these functions enables us to better use atomics to
replace read/write locks where we are almost always doing reads
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:29:30 2026
(Merged from https://github.com/openssl/openssl/pull/30670)
Optimized MKEM NTT implementation for ppc64le for ISA 2.07 and above architectures.
Supporting files include,
asm/mlkem_ntt_ppc64le.S: supports NTT.
asm/mlkem_intt_ppc64le.S: supports inverse NTT.
asm/mlkem_ppc_macros_asm.S: PPC64LE macros.
Modified build.info to support ppc64le assembly implementation.
Added new definitions of MLKEM_NTT_ASM for NTT and inverse NTT for
optimized assembly implementation.
This is the initial archtecture specific implementation so can be mdified
to adapt to a new build structures.
Baseline speed test:
keygen encaps decaps keygens/s encaps/s decaps/s
ML-KEM-512 0.000037s 0.000030s 0.000046s 26744.7 33529.5 21875.6
ML-KEM-768 0.000059s 0.000043s 0.000066s 16836.6 23118.8 15198.3
ML-KEM-1024 0.000088s 0.000060s 0.000089s 11406.2 16749.7 11265.8
Optimized:
keygen encaps decaps keygens/s encaps/s decaps/s
ML-KEM-512 0.000023s 0.000015s 0.000022s 42789.9 65006.8 46064.6
ML-KEM-768 0.000038s 0.000023s 0.000032s 25983.3 43731.1 31254.7
ML-KEM-1024 0.000060s 0.000033s 0.000045s 16662.7 30708.2 22034.6
The optimized code runs around 1.9 times faster than the original C implementation.
Tested-by: Eugene Syromiatnikov <esyr@openssl.org>
Signed-off-by: Danny Tsen <dtsen@us.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Apr 14 08:23:42 2026
(Merged from https://github.com/openssl/openssl/pull/30709)
When no ext.status_cb is set, the server will not produce a stapled
OCSP response. This patch returns early from tls_parse_ctos_status_request
before parsing the extension body to save memory.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Apr 13 09:40:08 2026
(Merged from https://github.com/openssl/openssl/pull/30630)
We also add other PQC algorithm directories that might
appear in future so they are picked-up by the script
once they appear. This requires checking whether the
directory exists.
Also update the fips sources and checksums.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Apr 13 09:35:17 2026
(Merged from https://github.com/openssl/openssl/pull/30502)
Improve 'verify' option help messages.
integer value parsing formats are:
- 'n' is any integer
- 'N' is a non-negative integer (i.e. value >= 0)
- 'p' is a positive integer (i.e. value > 0)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 13 09:30:22 2026
(Merged from https://github.com/openssl/openssl/pull/30476)
Related to #8216
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 13 09:30:21 2026
(Merged from https://github.com/openssl/openssl/pull/30476)
Instead of repeated fetching, precompute the below per the library
context and properties of the SSL_CTX and use them for the lifetime of
the SSL_CTX.
- HMAC algorithm handle (session ticket HMAC)
- SHA2-256 algorithm handle (session ticket HMAC)
- AES_256-CBC algorithm handle (session ticket en/decryption)
- TLS1 PRF (when TLS <= 1.2 is supported)
The "sha1" and "md5" handles are no longer used, and those fields are
removed.
The `SSL_HMAC` objects used internally are now stack allocated, and the
associated "new" and "free" functions are now called "construct" and
"destruct" respectively.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Apr 13 09:03:45 2026
(Merged from https://github.com/openssl/openssl/pull/30696)
Fix a failure with no-dtls1_2 introduced by the test in #30503
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 13 08:59:03 2026
(Merged from https://github.com/openssl/openssl/pull/30704)
The jom version in choco install is obsolete,
but it works fine for CI.
Users should use jom 1.1.7 or more recent.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 13 08:46:21 2026
(Merged from https://github.com/openssl/openssl/pull/30703)
MSVC compilation on Windows cannot be reliably parallelized
with tools like jom (an nmake replacement) due to contention
on shared .pdb files used for debug info. Writes to a shared
.pdb must be serialized.
The /FS compiler flag serializes concurrent compiler writes,
but does not resolve contention when the compiler and linker
access the same .pdb file. With shared .pdb files (e.g. app.pdb),
the makefile does not prevent races between the linker and
compilation of multiple targets.
This can be resolved either by restructuring the makefile
to introduce sentinel dependencies that serialize the conflicting
steps, or by eliminating the shared .pdb entirely.
This patch takes the latter approach: it replaces /Zi with /Z7,
which embeds debug info directly into each .obj file and avoids
any shared-file contention. /Z7 is supported by all MSVC versions.
The linker-generated .pdb is unaffected.
Side effects: object files are slightly larger, and all .pdb files
are now named after their target — the shared app.pdb, ossl_static.pdb,
and dso.pdb no longer exist.
With this change, jom can be used to parallelize the build.
Fixes: #9931
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 13 08:46:20 2026
(Merged from https://github.com/openssl/openssl/pull/30703)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sat Apr 11 20:06:07 2026
(Merged from https://github.com/openssl/openssl/pull/30587)
On POWER10, ChaCha20_ctr32_vsx_8x is activated for buffers over 255
bytes and uses vxxlor to alias FPR14-FPR25 as temporary storage. Add a
test to chacha_internal_test that pins known values in f14-f25 via
inline asm, calls through ChaCha20_ctr32 with a 512-byte buffer to
trigger the 8x path, and verifies the registers still hold their
original values. The test is gated on PPC_BRD31 (POWER10 capability
flag) so it is skipped silently on older hardware.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sat Apr 11 20:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/30587)
f17 is not directly clobbered by any vxxlor in this function, but
saving the full contiguous range f14-f25 is cleaner and avoids any
future ambiguity if the code is modified. Adjust all subsequent FPR
slot offsets and the VMX base offset accordingly, and update the frame
size comment.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sat Apr 11 20:06:04 2026
(Merged from https://github.com/openssl/openssl/pull/30587)
The 8-block POWER10 ChaCha20 path uses vxxlor to spill VMX values into
VSR0-VSR26, which aliases FPR0-FPR26. FPR14-FPR31 are callee-saved per
the ELFv2 ABI, but the function was never saving or restoring them,
silently corrupting 11 FPRs (12 on big-endian) across any call with a
buffer larger than 255 bytes. VMX registers v20-v23, also
callee-saved, had the same problem.
Fix by increasing the frame size to accommodate save slots for
FPR14-FPR25 (and FPR26 on BE) and VMX v20-v23, and adding the
corresponding stfd/lfd and stvx/lvx pairs in the prologue and
epilogue. The VRSAVE save offset is updated to a fixed expression so
it stays clear of the new save area.
Fix for the bug #30584
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sat Apr 11 20:06:02 2026
(Merged from https://github.com/openssl/openssl/pull/30587)
The current documentation heavily references the now removed
`atexit()` handlers. This updates the description to better reflect
it's current utility (removal of `-Wl,-znodelete` linker flags on
Linux and Hurd).
Fixes#30586
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Apr 11 19:44:00 2026
(Merged from https://github.com/openssl/openssl/pull/30606)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Apr 11 19:31:39 2026
(Merged from https://github.com/openssl/openssl/pull/30647)
SSL_use_cert_and_key(3) dereferenced a NULL SSL_CTX pointer
via ssl_cert_lookup_by_pkey() when the private key type was
not one of the builtin ones, but was provider-based.
Bug introduced in Postfix 3.2 (commit ee58915cfd).
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat Apr 11 19:04:12 2026
(Merged from https://github.com/openssl/openssl/pull/30683)
3.6.2 CHANGES.md includes the following:
* CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388,
CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790
* https://github.com/openssl/openssl/pull/30384
"Fix #19891 CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect"
* https://github.com/openssl/openssl/pull/30411
"Fix detection of plaintext HTTP over TLS (3.6/3.5 backport)"
* https://github.com/openssl/openssl/pull/30557
"re-constructorize the cpuid stuff, but fix riscv to not depend
on BIO_snprintf."
3.6.2 NEWS.md includes the following:
* CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388,
CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sat Apr 11 18:51:42 2026
(Merged from https://github.com/openssl/openssl/pull/30720)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Sat Apr 11 18:29:37 2026
(Merged from https://github.com/openssl/openssl/pull/30727)
There are one byte buffer overflows possible in s_client's handling
of STARTTLS in various protocols. If a server's response fills the entire
buffer (16k) then we attempt to add a NUL terminator one byte off the end
of the buffer.
This was reported by Igor Morgenstern from AISLE to openssl-security and
assessed by the security team as "bug or hardening only".
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Apr 11 16:16:24 2026
(Merged from https://github.com/openssl/openssl/pull/30731)
Issue was kindly reported and fixes suggested by @rainerjung
Fixes#30402
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 10 12:22:44 2026
(Merged from https://github.com/openssl/openssl/pull/30596)
Add mentions to NAME, SYNOPSIS, and RETURN VALUES, and provide a short
description (that it is identical to its OPENSSL_* counterpart)
to DESCRIPTION.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:57 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Add its mentions to NAME, SYNOPSIS, and RETURN VALUES sections.
Also, while at it, put OPENSSL_{str,strn,mem}dup() with the other
OPENSSL_* interfaces, and add mentions of OPENSSL_str{,n}dup()
to RETURN VALUES.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:55 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Addition of those has been originally overlooked.
Complements: cc4ea5e000 "Introduce new internal hashtable implementation"
Complements: fa9b7b930e "Add array memory allocation routines"
Complements: 14a24fd14f "doc/man3/OPENSSL_malloc.pod: explicitly document freeptr value on failures"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:55 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Remove the scid variable entirely from port_default_packet_handler()
and all functions that accept it as a parameter. The scid was never
used meaningfully — cur_remote_dcid is set later during the handshake.
Remove scid parameter from:
- port_bind_channel()
- port_validate_token()
- ossl_quic_channel_on_new_conn()
- ossl_quic_bind_channel()
- ch_on_new_conn_common()
Remove the cur_remote_dcid = *peer_scid assignment in
ch_on_new_conn_common() as it wrote dead data.
CWE-457
Reported-by: Sunwoo Lee <sunwoolee@kentech.ac.kr>
CLA: trivial
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:21:55 2026
(Merged from https://github.com/openssl/openssl/pull/30611)
The commit <2ea6e785f5> removed the
ERR_set_mark and ERR_pop_to_mark calls before and after the EVP_CIPHER_fetch
call in several files.
However, in PKCS12_pack_p7encdata_ex, crypto/pkcs12/p12_add.c, there is a valid
case that EVP_CIPHER_fetch returns NULL, raising an error, and calls
PKCS5_pbe_set_ex. The case is such as PBE-SHA1-3DES.
PKCS12_pack_p7encdata_ex, crypto/pkcs12/p12_add.c:
```
...
pbe_ciph = EVP_CIPHER_fetch(ctx, OBJ_nid2sn(pbe_nid), propq);
if (pbe_ciph != NULL) {
pbe = PKCS5_pbe2_set_iv_ex(pbe_ciph, iter, salt, saltlen, NULL, -1, ctx);
} else {
pbe = PKCS5_pbe_set_ex(pbe_nid, iter, salt, saltlen, ctx);
}
...
```
So, we need to restore ERR_set_mark and ERR_pop_to_mark calls before and after
the EVP_CIPHER_fetch call for this case.
A reproducer is below.
```
$ openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -nodes \
-subj "/CN=Test" 2> /dev/null
$ openssl pkcs12 \
-export -in cert.pem -inkey key.pem -out test.p12 -passout pass: \
-keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES
40276EC7677F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:376:Global default library context, Algorithm (PBE-SHA1-3DES : 0), Properties (<null>)
$ echo $?
0
```
80-test_pkcs12.t: Add test_pkcs12_passcerts_legacy_outerr2_empty test to test
this change.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 8 10:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/30607)
Avoid clipping of the provided values in setters due to type casting
by checking the values agains the type-specific maximum beforehand.
Fixes: 35dc6c353b "QUIC: Make more transport parameters configurable"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:27 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
Check that DEFAULT_CONN_RXFC_MAX_WND_MUL * max_data multiplication
will not overflow uint64_t data type before performing it.
Fixes: 35dc6c353b "QUIC: Make more transport parameters configurable"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:26 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
...and call them before updating QUIC_CHANNEL parameters.
Unchecked return value has been initially reported by Coverity
for ossl_quic_rxfc_init() call in ossl_quic_channel_set_max_data_request(),
but also seems to be relevant for ossl_quic_channel_set_max_streams_request()
and ossl_quic_channel_set_ack_delay_exponent_request().
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1689768
Fixes: 35dc6c353b "QUIC: Make more transport parameters configurable"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:25 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
Suggested to be added in OpenSSL 4.1.
Since engines have been removed, these are redundant functions.
End users should not generally be accessing this internal field.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:02:58 2026
(Merged from https://github.com/openssl/openssl/pull/30335)
Original-Commit: 7b371d80d9 "Prepare for release of 3.6.0"
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:00:08 2026
(Merged from https://github.com/openssl/openssl/pull/30686)
Also reword it to match the style of other entries.
Complements: cb1645e83b "Add a changes entry"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:00:06 2026
(Merged from https://github.com/openssl/openssl/pull/30686)
Also reword it to match the style of other entries.
Complements: ca20e54e86 "SSL_CTX_is_server() was added."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:00:05 2026
(Merged from https://github.com/openssl/openssl/pull/30686)
Commit e75bd84ffc made the ext argument of 509V3_EXT_print const
but did not give 509V3_EXT_print_fp which is essentially is a wrapper
around X509V3_EXT_print the same treatment.
This commit aligns the two functions again.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 09:15:11 2026
(Merged from https://github.com/openssl/openssl/pull/30572)
Also do minor formatting cleanups on the man page.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 8 09:13:38 2026
(Merged from https://github.com/openssl/openssl/pull/30673)
The decryption of the malformed encrypted message might succeed
with some probability. We accept that as the testcase tries to
trigger a crash which does not happen.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 7 07:16:44 2026
RSA_public_encrypt() returns the number of bytes written on success and
-1 on failure.
Add regression coverage in evp_extra_test using custom low-level RSA
methods to exercise the provider/legacy boundary. The new tests verify
that encapsulation fails when RSA_public_encrypt() returns:
* -1, which is the documented failure result, and
* a short positive length, which is also invalid for RSASVE with
RSA_NO_PADDING because the ciphertext must be exactly nlen bytes.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:45:39 2026
RSA_public_encrypt() returns the number of bytes written on success and
-1 on failure. With the existing `if (ret)` check, a provider-side RSA KEM
encapsulation can incorrectly succeed when the underlying RSA public
encrypt operation fails. In that case the code reports success, returns
lengths as if encapsulation completed normally, and leaves the freshly
generated secret available instead of discarding it.
Tighten the success condition so RSASVE only succeeds when
RSA_public_encrypt() returns a positive value equal to the modulus-sized
output expected for RSA_NO_PADDING. Any other return value is treated as
failure, and the generated secret is cleansed before returning.
Fixes CVE-2026-31790
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:45:38 2026
The partial-block pre-processing code in ossl_aes_cfb128_vaes_enc and
ossl_aes_cfb128_vaes_dec unconditionally loads 16 bytes from the input buffer
using unmasked vmovdqu8 instructions, even when fewer bytes are valid.
This can read 1–15 bytes beyond the provided buffer. The post-processing code
in the same file correctly uses masked loads to avoid this issue.
Fixes CVE-2026-28386
Co-Authored-by: Stanislav Fort <stanislav.fort@aisle.com>
Co-Authored-by: Pavel Kohout <pavel.kohout@aisle.com>
Co-Authored-by: Alex Gaynor <gaynor@anthropic.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:16:26 2026
Ensure we don't encounter a segfault when decrypting CMS messages with
malformed EnvelopedData when using RSA-OAEP.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Apr 6 18:58:32 2026
Very simmilar to CVE-2026-28389, ensure that if we are missing
parameters in RSA-OAEP SourceFunc in CMS KeyTransportRecipientInfo,
we don't segfault when decrypting.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Fixes CVE-2026-28390
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Apr 6 18:58:30 2026
Test to ensure that, if we attempt to decrypt a CMS message with a
missing parameter field of KeyEncryptionAlgorithmIdentifier
we fail, rather than segfault.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Apr 6 18:58:29 2026
Multiple independent reports indicated a SIGSEGV was possible in CMS
processing when a crafted CMS EnvelopedData message using A Key
Agreement Recipient Info field. If the
KeyEncryptionAlgorithmIdentifier omits the optional parameter field, the
referenced functions above will attempt to dereference the
alg->parameter data prior to checking if the parameter field is NULL.
Confirmed to resolve the issues using the reproducers provided in the
security reports.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Fixes CVE-2026-28389
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Apr 6 18:58:28 2026
Document that commands reading certificates from PKCS#12 files may
prompt for a password. The existing documentation only mentioned
password prompting for private keys.
Fixes#21292
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:52:28 2026
(Merged from https://github.com/openssl/openssl/pull/29918)
The error stack might have stale entries but
we are interested only in those coming from the
EVP call being tested.
Fixes#30454
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Apr 3 15:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/30669)
This fixes the CHANGES.md entry added via #30225 which erroneously added
the entry in the "Changes between 3.6 and 4.0" section instead of the
"Changes between 4.0 and 4.1" section
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:48:20 2026
(Merged from https://github.com/openssl/openssl/pull/30668)
ossl_quic_port_create_outgoing() can return NULL under memory pressure.
The result was used immediately by ossl_quic_channel_set_msg_callback()
without a NULL check, causing a crash on the SSL_new_from_listener()
API path.
The correct pattern already exists in create_channel() (same file): check
the return value and raise a non-normal error before jumping to cleanup.
Apply the same pattern here.
Fixes: 0b15147a37 ("Implement SSL_new_from_listener()")
Signed-off-by: Abhinav Agarwal <abhinavagarwal1996@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:46:54 2026
(Merged from https://github.com/openssl/openssl/pull/30667)
The build should run with -j4 option, but this option
was never propagated to run command (lost in Powershell).
Just set bash as shell here. This speedups CYGWIN CI build
significantly.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:45:11 2026
(Merged from https://github.com/openssl/openssl/pull/30661)
Apparently, it has not been caught after a29d157fdb "Replace homebrewed
implementation of *printf*() functions with libc" due to non-working symbol
checks.
Fixes: a29d157fdb "Replace homebrewed implementation of *printf*() functions with libc"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:24 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
The check was broken in several ways, which was concealed by the fact
that checkplatformsyms.pl returned success in many cases before:
* Hard-coded file name suffixes (-3-x64) meant that the check
was not performed on OpenSSL 4.0+ and never for 32-bit builds.
* dumpbin also wasn't in PATH in some configurations, which also led
to skipped checks.
Fix that by supplying proper file names based on OpenSSL major version
and ABI, add missing VCVars calls and working dir setups.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:23 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
It has never worked, as an attempt to make it work leads to this error:
Symbol ZSTD_compressStream2 not in the allowed platform symbols list
Symbol ZSTD_CStreamInSize not in the allowed platform symbols list
Symbol ZSTD_initCStream not in the allowed platform symbols list
Symbol ZSTD_freeCStream not in the allowed platform symbols list
Symbol ZSTD_endStream not in the allowed platform symbols list
Symbol ZSTD_freeDStream not in the allowed platform symbols list
Symbol ZSTD_initDStream not in the allowed platform symbols list
Symbol ZSTD_decompressStream not in the allowed platform symbols list
Symbol ZSTD_getErrorName not in the allowed platform symbols list
Symbol ZSTD_DStreamInSize not in the allowed platform symbols list
Symbol ZSTD_decompress not in the allowed platform symbols list
Symbol ZSTD_flushStream not in the allowed platform symbols list
Symbol ZSTD_isError not in the allowed platform symbols list
Symbol ZSTD_createCStream_advanced not in the allowed platform symbols list
Symbol ZSTD_createDStream_advanced not in the allowed platform symbols list
Symbol ZSTD_compress not in the allowed platform symbols list
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:22 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Ideally, it should probably passed to the script as a parameter,
but, in the meantime, follow the relaxed attitude of the Unix
counterpart and match against any version and all expected arch
suffixes.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:21 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Replace the grep|grep|awk|sed|sort|uniq abomination with a simple
and elegant awk script.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:20 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
If there are several offending symbols, using the checker becomes quite
tedious.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:18 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Error out if the executed command (dumpbin/objdump) hasn't been
successful.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Address the following complaint:
\2 better written as $2 at ../util/checkplatformsyms.pl line 39.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:16 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Otherwise their absense is seemingly ignored, which leads to overlooked
symbol additions.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:15 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Clarify which digest algorithms correspond to the 3
security categories for ML-DSA key types.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:40:25 2026
(Merged from https://github.com/openssl/openssl/pull/30632)
The function ossl_err_load_SM2_strings() exists, but wasn't called
in ossl_err_load_crypto_strings(). Rescind this omission.
Fixes: 3d328a445c "Add SM2 signature and ECIES schemes"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:32:47 2026
(Merged from https://github.com/openssl/openssl/pull/30625)
The padding check didn't take into account that by this point the f pointer
had already shifted by 4 positions. Luckily, the original f[2] and f[3]
were saved in c and d .
This code is not reachable in normal operation, but that is not a reason
not to fix it.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:31:13 2026
(Merged from https://github.com/openssl/openssl/pull/30618)
Found by Linux Verification Center (linuxtesting.org) with SVACE.
CLA:trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:24:39 2026
(Merged from https://github.com/openssl/openssl/pull/30589)
d2i_ASN1_UINTEGER uses (int)len for OPENSSL_malloc, memcpy, and
ASN1_STRING_set0 where len is a long. On LP64 platforms (long is
64-bit, int is 32-bit), values exceeding INT_MAX are silently
truncated, causing undersized allocation and heap buffer overflow.
The sibling function ossl_c2i_ASN1_BIT_STRING in a_bitstr.c already
has this guard (line 92: if (len > INT_MAX)). This adds the same
check to d2i_ASN1_UINTEGER for consistency.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Fri Apr 3 15:22:30 2026
(Merged from https://github.com/openssl/openssl/pull/30532)
We move the DTLS CCS early, and then add extra trailing data on the
last record before the epoch change. We expect to see an unexpected
message error.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:06:52 2026
(Merged from https://github.com/openssl/openssl/pull/30503)
The newly added #30225 introduced a UAF bug in the master branch found
by the dtlsserver fuzzer. If a CCS arrives early and there is trailing
data left in the current record at the point that we change epoch then
the buffer holding the trailing data is freed as part of setting up the
new record layer, but we still have dangling references into that buffer
causing the UAF.
Fixes#30487
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:06:50 2026
(Merged from https://github.com/openssl/openssl/pull/30503)
When init_ret indicates both X509_PCY_TREE_EXPLICIT and X509_PCY_TREE_EMPTY,
the function returns without freeing the initialized policy tree.
Free the tree before returning, consistent with the earlier TREE_EMPTY branch.
Also defer *ptree = tree assignment and free the tree when user policies
are empty to avoid returning invalid memory.
Fixes#30435
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/30436)
Improve the description of X509_STORE_lock() in X509_STORE_new.pod to
emphasize it acquires an exclusive write lock.
Add a NOTES section to X509_STORE_new.pod covering which operations are
internally thread-safe and which are not, as well as documentation on
lifetime management and reference counting.
Add a NOTES section to X509_STORE_CTX_get_by_subject.pod explaining
that the store's internal lock is released before the found object's
reference count is incremented, so the caller must ensure the store
outlives the lookup.
Clarify the reference counting and the caller's responsibilities.
Remove internal details for conciseness.
Related to #30310
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/30382)
The EVP_ENCODE_LENGTH macro performs all arithmetic in the type of
its argument. When the argument is int and exceeds approximately
1.6 billion, intermediate results overflow signed int, potentially
wrapping to a smaller positive value rather than a negative one.
In b64_write() (crypto/evp/bio_b64.c), this causes OPENSSL_malloc
to allocate a buffer smaller than the actual encoded output size.
EVP_EncodeUpdate then writes past the end of the undersized buffer.
Changes:
- Cast macro argument to size_t in EVP_ENCODE_LENGTH to prevent
signed integer overflow
- Change encoded_length in b64_write() from int to size_t and add
an explicit overflow sanity check before allocation
- Change return type of evp_encodeblock_int() and
encode_base64_avx2() from int to size_t so that large encoded
output lengths are not truncated
- Update EVP_EncodeUpdate() to use size_t for the encoder return
value accumulator (j), consistent with the existing size_t total
- Add explicit (int) casts in EVP_EncodeBlock() and EVP_EncodeFinal()
where the public API requires int return values
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 14:55:29 2026
(Merged from https://github.com/openssl/openssl/pull/30321)
Verify that passing NULL as the uri parameter to OSSL_STORE_delete()
returns 0 rather than crashing with a NULL pointer dereference.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 2 07:14:09 2026
(Merged from https://github.com/openssl/openssl/pull/30512)
Add a NULL check for the uri parameter before passing it to
OPENSSL_strlcpy(), matching the guard already present in
OSSL_STORE_open_ex().
Fixes: 0a8807b4a8 "Store: API for deletion"
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 2 07:14:08 2026
(Merged from https://github.com/openssl/openssl/pull/30512)
The names of the X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD and
X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD in the man page have
the first _ERR_ spelt out as _ERROR_ instead.
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Apr 1 17:06:53 2026
(Merged from https://github.com/openssl/openssl/pull/30643)
(cherry picked from commit e39a6de5c8)
Coverity has rightfully complained that using stat() before opening file
leads to TOCTOU issues, refactor the code to open the file first and
then perform stat checks on the opened file descriptor. It is still far
from foolproof, as the file is not locked, and stat() is used elsewhere,
but at least it seems to be a step in the right direction.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1690686
Fixes: 80b7e49c27 "Use mmap for pkeyutl -rawin and dgst one-shot input"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Apr 1 12:46:08 2026
(Merged from https://github.com/openssl/openssl/pull/30624)
Fixes#30418
Add ../crypto to INCLUDE[p_ossltest].
Remove useless .. from various INCLUDE[] - this was necessary when e_os.h was
placed in the SRCDIR root.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 31 15:51:53 2026
(Merged from https://github.com/openssl/openssl/pull/30536)
Its usage is introduced in commit b238d36c50 "Fix certificate read
from stdin on Windows".
Fixes: b238d36c50 "Fix certificate read from stdin on Windows"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Mar 31 11:55:26 2026
(Merged from https://github.com/openssl/openssl/pull/30634)
Pedantically cleanse the typically unused decap failure_key's stack
copy.
When actually used, it is copied into the caller's shared secret result,
perhaps to be cleansed there after use, or not, that's the callers
business.
While at it, slightly refactor the internal decap() implementation to
consolidate all the data to be cleansed into a single buffer, but now
avoid copying the public key hash, instead, when computing "K || r" as
"G(m || h)" include "h" via a separate EVP_DigestUpdate() call.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 31 05:19:40 2026
(Merged from https://github.com/openssl/openssl/pull/30598)
When building with glibc-2.43 there is the following warning:
crypto/x509/x509_vpm.c: In function 'validate_email_name':
crypto/x509/x509_vpm.c:317:13: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
317 | if ((at = memchr(name, '@', len)) == NULL)
| ^
This is due to a change described in the NEWS file of glibc-2.43:
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
pointers into their input arrays now have definitions as macros that
return a pointer to a const-qualified type when the input argument is
a pointer to a const-qualified type.
Systems using this recent glibc version will likely also be using GCC 15
or later which default to `-std=gnu23`, meaning that this warning will
show up without modifying `CFLAGS`.
We can make these pointers const since we never write to them.
Complements: f584ae959c "Let's support multiple names for certificate verification"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 31 02:38:14 2026
(Merged from https://github.com/openssl/openssl/pull/30613)
Added input length validation checks to prevent potential security issues
when negative values are passed to EVP_EncryptUpdate and EVP_DecryptUpdate.
These functions cast inl (int) to size_t without validation, which could lead
to unexpectedly large buffer allocation attempts or unintended behavior with
negative inputs.
Validation is performed early in both functions to ensure only valid,
non-negative lengths are processed. Error is reported via EVP_R_INVALID_LENGTH.
Fixes: https://github.com/openssl/openssl/issues/30486
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 02:10:52 2026
(Merged from https://github.com/openssl/openssl/pull/30560)
On Windows, reading certificate from stdin could fail like
> type cert.der| openssl.exe x509 -inform DER -outform PEM
Could not find or decode certificate from <stdin>
The decoder already tries to insert BIO_f_readbuffer
in this case, unfortunately it depends on undefined behavior
of ftell() on Windows.
Fix it by adding check for non-seekable input case
to BIO file control.
Note, the added testcase tests binary input certificate,
but does not trigger this issue explicitly.
Fixes: https://github.com/openssl/openssl/issues/19508
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:38:21 2026
(Merged from https://github.com/openssl/openssl/pull/30559)
When compiling on the MINGW platform, there are many warnings like this:
warning: passing argument 1 of 'CRYPTO_atomic_add64' discards 'volatile'
qualifier from pointer target type [-Wdiscarded-qualifiers]
CRYPTO_atomic_add64(&lock->qp_group[qp_idx].users, (uint64_t)1, &tmp64,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The warning actually shows several issues with volatile in struct rcu_qp:
- all handling functions using it do not use the volatile modifier,
so that the compiler can treat this pointer as non-volatile already
(Posix pthread variant does not use volatile here at all.)
- thread safety is already guaranteed by using locks
(NO_INTERLOCKEDOR64) or Interlocked*64 Win32 API functions.
- the volatile removal modifier should always be explicit
In short, I think the volatile in struct rcu_qp on Windows
has no additional value and can be removed.
This also fixes the warnings mentioned above :-)
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:25:56 2026
(Merged from https://github.com/openssl/openssl/pull/30602)
The -signcert option was incorrectly grouped with -sign and -xsign at
line 109, which implied they were equivalent. However, -signcert is
different: it expects a self-signed certificate (not a certificate
request) in newreq.pem, and converts it to a request before signing.
This is correctly documented in its own separate section at line 123,
which states "-signcert is the same as -sign except it expects a self
signed certificate".
Remove -signcert from the -sign/-xsign grouping to eliminate the
contradiction.
Resolves: https://github.com/openssl/openssl/issues/29165
Fixes: 022696cab0 "Allow CA.pl script user to pass extra arguments to openssl command"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:10:50 2026
(Merged from https://github.com/openssl/openssl/pull/29794)
Commit e75bd84ffc made the ext argument of 509V3_EXT_print const
but did not update the man page to match the implementation.
Complements: e75bd84ffc "Constify X509_get_ext() and friends.."
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:01:51 2026
(Merged from https://github.com/openssl/openssl/pull/30595)
Update the documentation to include that added const qualifiers
to the arguments of X509_EXTENSION_get_object(), X509_EXTENSION_get_data(),
and X509v3_add_ext().
References: https://github.com/openssl/openssl/pull/30595
Complements: e75bd84ffc "Constify X509_get_ext() and friends.."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Tue Mar 31 00:47:35 2026
(Merged from https://github.com/openssl/openssl/pull/30601)
The seemingly impossible (and erroneous) case of (secret == NULL &&
secret_len != 0) is not accounted for in sanity checks, which provoked
Coverity to report potential NULL dereference in ikev2_check_secret_and_pad()
afterwards. Placate it by expanding the check to cover that improbable
situation and echo the seedkey check from the previous case.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1690439
Complements: 0dd1c50fc0 "Add IKEV2KDF implementation"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 31 00:33:22 2026
(Merged from https://github.com/openssl/openssl/pull/30566)
If NO_INTERLOCKEDOR64 is define, Windows RCU code must
use thread locks.
The lock *must* be provided in that case otherwise it is
an internal code error, not a runtime error.
Use OPENSSL_assert here.
This also fixes several unititialized variable warnings
as analyzer no longer see this impossible paths in code.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:28:20 2026
(Merged from https://github.com/openssl/openssl/pull/30619)
On Windows, SOCKET is defined as unsigned (UINT_PTR).
In OpenSSL, the socket abstraction uses int, see
discussion in https://github.com/openssl/openssl/issues/7282.
MINGW for some time uses a signed definition of INVALID_SOCKET,
then switched back to unsigned, see for example
https://sourceforge.net/p/mingw-w64/discussion/723797/thread/71522d10/
Currently, it is defined as unsigned, creating many warnings like
warning: overflow in conversion from 'long long unsigned int' to 'int'
changes value from '18446744073709551615' to '-1' [-Woverflow]
*sock = INVALID_SOCKET;
As we use INVALID_SOCKET only in our code, we can safely silence
this warning just by redefining INVALID_SOCKET to signed
(version that is commented out in MINGW headers).
While this is only a workaround, it has been here for years and
allows focus on more important warnings.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:22:27 2026
(Merged from https://github.com/openssl/openssl/pull/30616)
Statically defined set_cloexec helper is used only
if RIO_NOTIFIER_METHOD_SOCKET is set (for non-Windows branch)
and if RIO_NOTIFIER_METHOD_SOCKETPAIR is set
(always).
This avoids unused code warnings.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:22:26 2026
(Merged from https://github.com/openssl/openssl/pull/30616)
These debug logs were added in 6e0fd246e7 (#24687), probably for
debugging the script, but they remained active by default.
Change them to appear only if OPENSSL_MKINSTALLVARS_DEBUG env var
is set.
References: 6e0fd246e7 "Give util/mkinstallvars.pl more fine grained control over var dependencies"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Tue Mar 31 00:03:14 2026
(Merged from https://github.com/openssl/openssl/pull/29083)
Just add %s to make subjectAltName appear before [alts].
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:53:28 2026
(Merged from https://github.com/openssl/openssl/pull/30585)
This is a partial forward-port of commit 3c4194022c "make update"
from the openssl-4.0 branch, that includes updates to util/libcrypto.num
and util/libssl.num files.
References: 3c4194022c "make update"
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:52:22 2026
(Merged from https://github.com/openssl/openssl/pull/30555)
Every other frame type handler in depack_process_frames() returns 0
after calling ossl_quic_channel_raise_protocol_error(), but the
NEW_CONN_ID case falls through to depack_do_frame_new_conn_id().
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 27 16:48:44 2026
(Merged from https://github.com/openssl/openssl/pull/30550)
Guard against potential NULL pointer dereferences when
EVP_MD_CTX_get_pkey_ctx() is called and its result is used
without validation. Store the return value in a local variable,
check for NULL before passing it to subsequent functions, and
remove redundant repeated calls.
Fixes#27735
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:39:04 2026
(Merged from https://github.com/openssl/openssl/pull/30522)
The keccak1600 perlasm file (`keccak1600-s390x.pl`) emits `cijne`, a
z10 compare-immediate-and-branch instruction, without declaring a
minimum architecture level. GCC defaults to `-march=z900` on s390x,
causing assembler errors when building with the default toolchain
flags:
keccak1600-s390x.S:399: Error: Unrecognized opcode: `cijne'
z900 has been out of service since 2014, the Linux kernel requires
z196 minimum, and clang already defaults to z10 on s390x. A
`.machine "z10"` GAS directive in the generated assembly resolves the
error by declaring the architecture level the file already requires.
Ref: #27323
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:32:22 2026
(Merged from https://github.com/openssl/openssl/pull/30507)
Improve the finite field cryptography (FFC) messages with L, N arguments.
Fixes#17108
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:29:59 2026
(Merged from https://github.com/openssl/openssl/pull/30493)
When using openssl pkeyutl -rawin or openssl dgst for one-shot sign/verify
(e.g. Ed25519, Ed448), file input is now read via mmap() on Unix where
supported, avoiding a full buffer allocation and copy. Large files are
supported without doubling memory use; on failure of the mmap path we
do not fall back to the buffer path.
- Add app_mmap_file() in apps/lib/apps.c: stat/open/mmap/close, tri-state
return (1 mapped, 0 size zero, -1 error). Parameter err_bio avoids
shadowing global bio_err (-Wshadow).
- apps/pkeyutl.c and apps/dgst.c: use app_mmap_file(); single exit for
mmap path in pkeyutl; dgst includes apps.h first for _FILE_OFFSET_BITS;
do_fp_oneshot_sign returns EXIT_SUCCESS/EXIT_FAILURE like do_fp(); no
fallback when mmap attempted but fails.
- pkeyutl mmap/buffer path: pass filesize to EVP_DigestVerify and
EVP_DigestSign (review suggestion, avoids casting buf_len).
- Error messages: per-file messages for stat/size (dgst, pkeyutl); CHANGES.md
"Unix-like" and "16 MB" (documentation style).
- Centralize _FILE_OFFSET_BITS and mmap includes in apps/include/apps.h.
- Tests: pkeyutl/dgst oneshot from file, no-fallback regression tests;
use srctop_dir for test paths; stderr patterns for mmap errors.
- Docs: man pages and CHANGES.md.
CI fixes: return failure from dgst one-shot sign when mmap fails; treat
non-regular paths as mmap errors in app_mmap_file() and pkeyutl; reject
directories before mmap.
Addresses review feedback from DDvO, npajkovsky, and vdukhovni (PR #30429).
Fixes#11677
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Co-authored-by: David von Oheimb <DDvO@users.noreply.github.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 27 16:25:33 2026
(Merged from https://github.com/openssl/openssl/pull/30429)
Resolves#12519 by adding to the DESCRIPTION section. Documentation only change.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:17:02 2026
(Merged from https://github.com/openssl/openssl/pull/29984)
Store the return value of EVP_CIPHER_get_iv_length() in a local variable
and guard with (ivlen > 0) before passing to memcpy/RAND_bytes, matching
the pattern already used in p5_pbev2.c. Without this, a negative return
value (-1) is implicitly converted to SIZE_MAX when cast to size_t,
causing a stack buffer overflow on iv[EVP_MAX_IV_LENGTH].
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 27 16:14:09 2026
(Merged from https://github.com/openssl/openssl/pull/30510)
Bioprinttest is redundant since internally it just calls c library
functions such as vsnprintf. This was a slow test.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 07:17:04 2026
(Merged from https://github.com/openssl/openssl/pull/30561)
* Fix inconsistent doc (so far using purpose names smime_sign and smime_encrypt) vs. implementation
* Add the info that "smimesign" is the default purpose here.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Fri Mar 27 06:25:20 2026
(Merged from https://github.com/openssl/openssl/pull/18914)
This is a workaround for an issue that lead to fuzz-checker CI failures;
the preliminary solution is to disable the inessential test case
test_exec_KUR_bad_pkiConf_protection.
References: https://github.com/openssl/openssl/pull/28973
Fixes: 525a4f1efb "cmp_vfy.c,doc/,test/: when trying to use cached CMP message sender cert, no more check its revocation and chain"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Thu Mar 26 15:55:34 2026
(Merged from https://github.com/openssl/openssl/pull/30567)
There's a misunderstanding regarding the use of .pc and .cmake files
found in the top of the build tree vs in its 'exporters' subdirectory.
Some added commentary, especially in the files being produced, might
help clarify their uses.
Resolves: https://github.com/openssl/openssl/issues/28803
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Mar 26 15:19:09 2026
(Merged from https://github.com/openssl/openssl/pull/28858)
Check the z_is_one flag and early exit if it's set.
This saves an expensive field inversion in some cases,
especially when just loading a key and reading it back.
In fact sometimes it saves two expensive field inversions,
because sometimes the first call is only for retrieving the size.
Fixes#29719
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Mar 26 13:58:10 2026
(Merged from https://github.com/openssl/openssl/pull/30530)
This patch fixes
undefined reference to `ossl_BIO_snprintf_msvc'
Define it only if MSVC is used.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Mar 25 14:12:58 2026
(Merged from https://github.com/openssl/openssl/pull/30541)
Should be 2^14-1 (16383) per RFC 9000 s. 18.2, not 2^14 (16384).
Fixes: 35dc6c353b ("QUIC: Make more transport parameters configurable")
Signed-off-by: Abhinav Agarwal <abhinavagarwal1996@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 24 17:55:50 2026
(Merged from https://github.com/openssl/openssl/pull/30531)
Commit 5ba9029bc7 "Mask *num on entry in deprecated low-level OFB/CFB
implementations" introduced masking of the user-supplied num value
in several functions, which rendered the exiting *num negativity check
introduced in 1634b2df9f "enc: fix coverity 1451499, 1451501, 1451506,
1451507, 1351511, 1451514, 1451517, 1451523, 1451526m 1451528, 1451539,
1451441, 1451549, 1451568 & 1451572: improper use of negative value"
ineffectual. While commit b73a574325 "crypto/idea/i_cfb64.c:
condition 'n < 0' can never be met after doing 'n = n & 0x07'"
has addressed the issue in crypto/idea/i_cfb64.c:IDEA_cfb64_encrypt(),
this commit addresses the same issue
in crypto/idea/i_ofb64.c:IDEA_ofb64_encrypt() in similar fashion,
by postponing the masking after the negativity check.
The issue has initially reported by Coverity, ID 1689815.
Resolves: https://scan5.scan.coverity.com/#/project-view/62622/10222?selectedIssue=1689815
Fixes: 5ba9029bc7 "Mask *num on entry in deprecated low-level OFB/CFB implementations"
References: b73a574325 "crypto/idea/i_cfb64.c: condition 'n < 0' can never be met after doing 'n = n & 0x07'"
Co-Authored-by: Alexandr Nedvedicky <sashan@openssl.org>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 24 17:52:35 2026
(Merged from https://github.com/openssl/openssl/pull/30528)
The two functions do the same; there is no reason to maintain duplicit
code.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 24 17:47:58 2026
(Merged from https://github.com/openssl/openssl/pull/30524)
Add a NULL check with OPENSSL_assert() before dereferencing the allocated pointer.
Fixes#30017
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 24 17:44:44 2026
(Merged from https://github.com/openssl/openssl/pull/30509)
NCONF_get_string() passes the group parameter directly to
ERR_raise_data() with a %s format specifier. The CONF API
explicitly allows group to be NULL (meaning "default section"),
and multiple internal callers use this, such as conf_diagnostics()
and CONF_modules_load().
When the lookup fails and the error path is reached, passing NULL
to %s is undefined behavior per the C standard. On Linux/glibc
it happens to print "(null)", but on platforms like Solaris 10 it
crashes in strlen() inside vsnprintf().
This was exposed after commit #28305 replaced the custom _dopr()
(which had an explicit NULL-to-"<NULL>" guard in fmtstr()) with
the platform's native vsnprintf().
Guard the NULL by using an empty string in the format argument.
Fixes#30402
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:39:02 2026
(Merged from https://github.com/openssl/openssl/pull/30484)
Load .Lsbox_magic base once via adrp+add and use plain immediate offsets for q loads,
avoiding potential low-12-bit truncation issues with #:lo12:symbol+offset.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:36:51 2026
(Merged from https://github.com/openssl/openssl/pull/30410)
setup_verification_ctx() allocates out_trusted via load_trusted() and passes
it to OSSL_CMP_CTX_set_certConf_cb_arg(). Since the argument is not consumed,
it must be freed on failure. The fix is to free out_trusted if
OSSL_CMP_CTX_set_certConf_cb_arg() fails.
Fixes#30377
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:34:49 2026
(Merged from https://github.com/openssl/openssl/pull/30392)
When server contains a bare IPv6 address, OSSL_HTTP_proxy_connect() must
wrap it in square brackets for the CONNECT request line (e.g.,
CONNECT [::1]:443 HTTP/1.0). Also handle the case where the server
string already includes brackets (as returned by OSSL_HTTP_parse_url).
Fixes: 29f178bddf ("Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c")
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:32:06 2026
(Merged from https://github.com/openssl/openssl/pull/30384)
Making better use of X509v3_delete_extension().
This includes two minor bugfixes:
The enc.modified flag was not set on deleting extensions in
X509_REQ and X509_CRL structures.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:29:09 2026
(Merged from https://github.com/openssl/openssl/pull/30350)
Added more details about the certification path building algorithm,
especially about the behavior in case of incomplete chains in the trust
store.
Fixes#29681
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:24:15 2026
(Merged from https://github.com/openssl/openssl/pull/30317)
In compliance with RFC7296 and SP800-135
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 24 17:21:21 2026
(Merged from https://github.com/openssl/openssl/pull/30121)
The oids_to_pm with Strawberry Perl often prints these errors:
Use of uninitialized value in join or string at Strawberry/perl/lib/re.pm line 47.
This is caused by use re 'debugcolor' in the perl module.
As Windows does not have proper termcap database and colors
also do not work in cmd shell, let's just use non-colored
'debug' version.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 24 17:04:23 2026
(Merged from https://github.com/openssl/openssl/pull/30521)
When running tests on Windows, the last test command in test_rand
is mixed with test output.
perl.exe ..\..\util\wrap.pl ..\..\apps\openssl.exe rand
-hex 2K => 0[14:11:00] 05-test_rand.t ......
As there is also missing actual check for output length,
fix both problems by adding simple check for expected length.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 24 17:04:22 2026
(Merged from https://github.com/openssl/openssl/pull/30521)
Now that ossl_method_store_cache_[set|get] query the provider name, we
need to make our property test account for that, by defining the
property query to be identical to what the internal definiton is.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Mar 24 16:23:11 2026
(Merged from https://github.com/openssl/openssl/pull/30254)
Lets improve our property query lookup performance.
Currently our property query lookup performance could be better. It
suffers from three major drawbacks,
1) The hashtable itself could be faster. our internal hashtable
implementation is generally quicker than our LHASH implementation
2) The lookup case a specific provider (i.e. when we do a cache lookup with
prov != NULL requires some signficant iteration over hash buckets with
LHASH, as we iterate over all entries that match the same query looking
for a matching provider pointer)
3) Stochastic flush is..not great. When we reach cache size limitations
(currently 512 entries spread over 4 shards), we randomly flush about
50% of the cache, which requires an iteration over the entire hash
table)
Lets address all of these
1) Is pretty straight forward. Replacing the LHASH hashtable with our
internal hash table is pretty easy, and lets us take advantage of the
hash computation caching introduced earlier.
2) With (1) we can do direct lookups of specific provider, by including
the provider name in the hash key. Provider agnostic (i.e. provider
== NULL) lookups are now handled by adding an extra hash entry for
each nid with the key being _only_ the property query. Prior entries
for the same key get evicted, so a lookup for prop_query = X, prov =
NULL returns the last QUERY that was added for that query string
against a particular nid.
3) I've never fully understood why we do random early discard of queries
when we reach capacity. It seems easier and more efficient to just
discard a single entry to keep us under our size limits. Especially
given that the sharding reduces the likelyhood that we need to flush
in any given shard. This also prevents us from needing to traverse
the entire hash table, as we can just discard a single QUERY and
abort the loop early.
In addition to the above we can also:
1) Migrate the QUERY hashtable from the ALGORITHM struct to the
STORED_ALGORITHMS struct. Currently we create a hash table per
ALGORITHM, and we have potentially hundreds of algorithms. While
this makes for really fast lookups, each QUERY cache only having a
few entries, its a huge waste of memory, consolidating all of the
nids to a single sharded STORED_ALGORITHMS struct saves a bunch of
memory and is still faster than what we have currently.
2) Add an lru-like linked list to QUERY entries. This serves two
purposes. Its not quite lru/lfu, but it allows us to more quickly do
an in-order traversal of a hash table on every node, and detect when
a QUERY has been looked up since the last query table update. By
detecting this, we can bias ourselves on cull operations toward
eliminating those entries which have not been referenced frequently.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Mar 24 16:23:09 2026
(Merged from https://github.com/openssl/openssl/pull/30254)
One thing @npajkovsky noted in our recent discussion about the internal
hash table was that its unfortunate that keys have to be sized for the
maximal use case in our current hashtable code.
We can avoid that.
Introduce a new init mechanism that allows for keys to initalized using
an external buffer that can be setup and marshalled independently of the
key itself. This allows us to only allocate the amount of data needed
for the key, rather than a maximally sized buffer where appropriate and
adventageous.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Mar 24 16:23:07 2026
(Merged from https://github.com/openssl/openssl/pull/30254)
One thing we can do to speed up hash table lookups is to cache/reuse
computed hash values when interrogating a hash table multiple times in
rapid succession.
We follow this pattern frequently when using hashtables:
value = lookup_hash(key)
if (value == NULL)
value = new_value()
insert_to_hash(key, value)
Note that we use the same key for the lookup and the insert. So if we
had a way to preserve the value this key hashed to, we can avoid having
to do a second hash computation during the lookup.
These new macros give us that. The HT_KEY structure now stores the
computed hash value in the key, which can be extracted and reused by the
caller with the HT_INIT_KEY_CACHED macro. When set, the cached hash
value is used, rather than needing to recompute the hash for any
subsequent operations
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Mar 24 16:23:05 2026
(Merged from https://github.com/openssl/openssl/pull/30254)
A cleanup after merge conflict resolution in a1420a699d "Implement RFC 8701
GREASE for TLS ClientHello".
Fixes: a1420a699d "Implement RFC 8701 GREASE for TLS ClientHello".
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun Mar 22 01:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/30505)
Explicitly cast dst argument of InterlockedExchange{,64} calls
in CRYPTO_atomic_store{,_int}() to LONG{64,} volatile *, respectively,
to work around incompatible pointer type errors on 64-bit MinGW builds.
Initially Reported by Splediferous.
[esyr: massaged the commit message a bit]
CLA: trivial
Resolves: https://github.com/openssl/openssl/issues/30451
Fixes: cc7195da30 "Make FIPS self test state access atomic"
Fixes: 7e45ac6891 "Add CRYPTO_atomic_store api"
add cast to LONG volatile * for InterlockedExchange
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Mar 22 00:56:36 2026
(Merged from https://github.com/openssl/openssl/pull/30504)
Reported by Zehua Qiao and me@snkth.com
An encode message buffer M = 00 || CXT_LEN || CTX || MSG was being
allocated followed by memcpy's into the buffer for CTX and MSG.
If len(MSG) was close to size_t the allocated buffer would be
overwritten.
The fix uses WPACKET to perform the message encoding M = 00 || CXT_LEN || CTX || MSG
Although ML_DSA does a similiar operation, SLH-DSA has to buffer the
encoding because the encoded message is processed multiple times for
PRF_MSG and H_MSG. FOr ML_DSA the encoded message can just be hashed.
Fixes: 2f9e152d86 "Add SLH_DSA signature verification."
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Mar 22 00:15:47 2026
(Merged from https://github.com/openssl/openssl/pull/30477)
pqueue_insert() may fail, but its return value was not checked. This could leak the allocated pitem and handshake fragment. Free them when insertion fails, using pitem_free() for proper cleanup.
Solves https://github.com/openssl/openssl/issues/30442Fixes#30442
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat Mar 21 23:11:54 2026
(Merged from https://github.com/openssl/openssl/pull/30443)
In ossl_get_ocsp_response(), the OCSP_BASICRESP allocated by
OCSP_response_get1_basic() is never freed when the OCSP response
contains zero SingleResponse entries.
The allocation and guard were combined in a single && expression,
so when OCSP_resp_get0(bs, 0) returns NULL, short-circuit evaluation
skips the block containing OCSP_BASICRESP_free(bs), leaking bs on
every handshake with such a response.
Fix by splitting the allocation out of the condition and adding an
else branch that frees bs when the SingleResponse check fails.
Fixes: b1b4b154fd "Add support for TLS 1.3 OCSP multi-stapling for server certs"
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat Mar 21 22:23:27 2026
(Merged from https://github.com/openssl/openssl/pull/30463)
extend test_tlsext_status_type() with a handshake that serves a
leaf-signed stapled OCSP response and verifies the connection fails
when X509_V_FLAG_OCSP_RESP_CHECK is enabled.
generalize ocsp_server_cb_single() to use configurable signer
cert/key instead of hardcoded paths so the same callback serves
both authorized and unauthorized signer test cases.
add a test_ocsp() subtest covering the -issuer CLI option with
an untrusted issuer hint.
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat Mar 21 20:58:29 2026
(Merged from https://github.com/openssl/openssl/pull/30323)
check_cert_ocsp_resp() verified stapled OCSP responses with
OCSP_TRUSTOTHER while passing the peer-provided chain (ctx->chain),
which allowed certificates from that chain to be treated as trusted
OCSP responder signers.
similarly, the ocsp CLI issuer fallback path unconditionally used
OCSP_TRUSTOTHER, making certificates given via -issuer implicitly
trusted regardless of verify_flags.
remove OCSP_TRUSTOTHER from both paths so that responder authorization
is validated against the trust store.
Fixes: c6724060e2 "RT2206: Add -issuer flag to ocsp command"
Fixes: b1b4b154fd "Add support for TLS 1.3 OCSP multi-stapling for server certs"
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sat Mar 21 20:58:27 2026
(Merged from https://github.com/openssl/openssl/pull/30323)
Fix i2r_OSSL_DAY_TIME() to check dt->second before decoding the
optional seconds field. Add a regression certificate and x509 recipe
coverage for the periodic timeSpecification case with no seconds.
Resolves: https://github.com/openssl/openssl/issues/30424
Fixes: 70b17e5a00 "feat: support the timeSpecification X.509v3 extension"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Mar 20 18:47:04 2026
(Merged from https://github.com/openssl/openssl/pull/30425)
- The context "sig" field ended up shared by both contexts
after a dup, leading to a later double-free.
Reported by Stanislav Fort and Pavel Kohout of Aisle Research.
- Rare error paths could lead to a memory leak or to use-after-free
and/or double-free.
Reported by Kenaz Wang.
Fixes: edd3b7a309 "Add ECDSA to providers"
Fixes: f68ba38e18 "Refactor OpenSSL 'ECDSA' EVP_SIGNATURE to also include ECDSA+hash composites"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 20 18:15:48 2026
(Merged from https://github.com/openssl/openssl/pull/30479)
The bounds check before reading the two-byte extensions length field uses
extsoffset + 1 instead of extsoffset + 2:
if ((extsoffset + 1) > clearlen) { goto paderr; }
extslen = clear[extsoffset] * 256 + clear[extsoffset + 1];
When extsoffset == clearlen - 1 the check passes, but the second read
clear[extsoffset + 1] is clear[clearlen], which is one byte beyond
the decrypted plaintext. The allocation is OPENSSL_malloc(cipherlen)
where cipherlen = clearlen + AEAD_overhead, so the address is valid,
but the byte is uninitialised after OSSL_HPKE_open returns.
Using Valgrind confirmed an uninitialised-value read at this location
via the full server handshake path:
hpke_decrypt_encch (ech_internal.c)
ossl_ech_early_decrypt
tls_process_client_hello
state_machine
SSL_do_handshake
The subsequent ch_len > clearlen check (line 1875) acts as a safety net
and prevents the stale byte from being used further, so the practical
impact is a forced decode error rather than memory disclosure.
Nevertheless, the read itself is incorrect and should be fixed.
Fix: change the guard to extsoffset + 2 so that both bytes
of the extensions length field are confirmed to be within the decrypted
buffer before either is read.
This issue was identified through AI-assisted structural analysis
(RAPTOR) using CodeQL database tooling (AST analysis, control flow
verification, dominator tree analysis) against the OpenSSL master
branch. The off-by-one was confirmed via AST inspection showing
GT(Add(extsoffset, 1), clearlen) instead of the expected
GT(Add(extsoffset, 2), clearlen).
Found by myself @danielcuthbert and validated
by Benjamin Rodes - Microsoft @bdrodes.
CLA: trivial
Fixes: 6c3edd4f3a "Add server-side handling of Encrypted Client Hello"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 20 18:07:01 2026
(Merged from https://github.com/openssl/openssl/pull/30472)
The new b64 encoder code uses __m256 which is not currently supported in ARM64EC code,
since it does not natively support x64-specific instruction sets like AVX.
Disable the fast AVX path if arm64EC is used.
Fixes: https://github.com/openssl/openssl/issues/30361
Complements: 3a69b19028 "Added AVX2 encoding + scalar improvements"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 20 17:55:30 2026
(Merged from https://github.com/openssl/openssl/pull/30406)
vpaes_ecb_decrypt in vpaes-armv8.pl was never referenced. It also
contained a bug: the single-block path called _vpaes_encrypt_core
instead of _vpaes_decrypt_core. Delete the dead function.
Resolves: https://github.com/openssl/openssl/issues/30341
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Thu Mar 19 20:36:27 2026
(Merged from https://github.com/openssl/openssl/pull/30423)
In the range-splitting path, create_set_item() can return NULL under
memory pressure. The result was passed directly to
ossl_list_uint_set_insert_after() without a NULL check, causing an
immediate crash. This path is reachable during normal QUIC ACK
processing under memory exhaustion.
Check the allocation result before insertion and return 0 on failure.
Fixes: c5ca718003 "uint_set: convert uint_set to use the list data type"
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Mar 19 19:24:09 2026
(Merged from https://github.com/openssl/openssl/pull/30490)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Mar 19 10:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/30417)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 19 09:20:07 2026
(Merged from https://github.com/openssl/openssl/pull/29996)
In some specific timings, the qtest_fault_resize_plain_packet function
returns failure as there is not enough space in allocated buffer.
There is no way to recover in this situation, let print
information and keep the test finish instead of failure
in TEST_error() call.
This patch fixes test runs on Windows where I can reproduce
this quite reliably.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Mar 19 09:17:59 2026
(Merged from https://github.com/openssl/openssl/pull/30461)
I can regularly hit timeout on Windows for QUIC multistream test.
While increasing is not the best solution, it eliminates many
failures during testing. This timeout only applies in specific
situation, so run time should not be actually used often.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Mar 19 09:17:57 2026
(Merged from https://github.com/openssl/openssl/pull/30461)
lh_TYPE_doall(lh, lh_TYPE_delete). Not doing so may dereference
dead memory when traversing to next item in hash table.
One has to call lh_TYPE_set_down_load(lh, 0) to disable hash
table contraction when table is being destroyed during the
_doall() traversal.
call lh_TYPE_set_down_load(lh, 0) before doing
lh_TYPE_daall() with lh_TYPE_delete(). This disables
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Mar 18 17:26:44 2026
(Merged from https://github.com/openssl/openssl/pull/30371)
Initially Reported by Zehua qiao
Fixes#30414
A block copy bug incorrectly set ret = 1 straight after assigning
ret.
Setting the *sig_len has been delayed to the err path in case
WPACKET_finish fails.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Mar 18 07:19:54 2026
(Merged from https://github.com/openssl/openssl/pull/30438)
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Mar 18 07:11:44 2026
(Merged from https://github.com/openssl/openssl/pull/30447)
ppc_aes_gcm_cipher_update() returns 1 on success and 0 on failure.
The decrypt pre-alignment path (line 122) incorrectly returned -1
instead of 0 when CRYPTO_gcm128_decrypt() failed.
Since the caller checks `if (!hw->cipherupdate(...))`, and !(-1)
evaluates to 0 (false) in C, the error was silently swallowed and
GCM processing continued with potentially corrupt state.
The encrypt path at line 98 correctly returns 0. This was likely a
copy-paste error when the decrypt path was added.
Fixes#30380
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Mar 18 07:03:41 2026
(Merged from https://github.com/openssl/openssl/pull/30452)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 17:01:56 2026
(Merged from https://github.com/openssl/openssl/pull/30351)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 17:01:53 2026
(Merged from https://github.com/openssl/openssl/pull/30351)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 17:01:49 2026
(Merged from https://github.com/openssl/openssl/pull/30351)
In the BUGS section mention that signing wtih an Ed448 key is not supported
when using signed-data with signed attributes due to missing support for
id-shake256-len.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 16:20:27 2026
(Merged from https://github.com/openssl/openssl/pull/30312)
RFC 8419 requires that, when using an Ed25519 key for CMS signed-data with
signed attributes, SHA512 must be used. Modify the entry in the key2data
table to reflect this giving the user not other choice for a hash.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 16:20:24 2026
(Merged from https://github.com/openssl/openssl/pull/30312)
Mention that Ed448 keys cannot currently be used for CMS with
signed attributes since RFC 8419 requires id-shake256-len be used,
which is not currently supported by OpenSSL.
Resolves: 30291
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 16:20:20 2026
(Merged from https://github.com/openssl/openssl/pull/30312)
- Also harden check_hosts() to handle NULL `vpm->hosts`,
currently checked by the caller.
- Also harden check_ips() to handle NULL `vpm->ips`,
currently checked by the caller.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Mar 17 15:35:16 2026
(Merged from https://github.com/openssl/openssl/pull/30444)
(cherry picked from commit 6f9a0f3bcd)
Add client-side GREASE (Generate Random Extensions And Sustain
Extensibility) support per RFC 8701. When SSL_OP_GREASE is set,
the TLS client injects reserved 0x?A?A-pattern values into the
ClientHello to prevent ecosystem ossification caused by servers
that reject unknown values.
GREASE values are injected into:
- Cipher suites (prepended)
- Supported versions extension (prepended)
- Supported groups extension (prepended)
- Signature algorithms extension (appended)
- Key share extension (prepended, 1 zero byte)
- Two standalone extensions (one empty, one with 1 zero byte)
The implementation uses lazy-seeded random values that remain
consistent across HelloRetryRequest retransmissions. GREASE values
from server responses are rejected as illegal parameters.
Add -grease option to s_client to enable GREASE from the command line.
Closes#9660
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 14:58:25 2026
(Merged from https://github.com/openssl/openssl/pull/30303)
In ossl_x509v3_cache_extensions(), introduce EXFLAG_DUPLICATE flag to
signal duplicate X.509 extensions. Add O(1) duplicate detection
using a bitset with minimal stack memory footprint, in compliance with
RFC 5280 Section 4.2.
Fixes#26325
Co-authored-by: Tomáš Mráz <tm@t8m.info>
Co-authored-by: David von Oheimb <DDvO@users.noreply.github.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 17 13:43:13 2026
(Merged from https://github.com/openssl/openssl/pull/30233)
The following QUIC transport parameters are now configurable via
SSL_get_value_uint() / SSL_set_value_uint():
max_udp_payload_size
initial_max_data
initial_max_stream_data_{uni, bidi_local, bidi_remote}
initial_max_streams_{uni, bidi}
ack_delay_exponent
max_ack_delay
disable_active_migration
active_connection_id_limit
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Mar 17 13:15:29 2026
(Merged from https://github.com/openssl/openssl/pull/29664)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Mar 17 11:54:06 2026
(Merged from https://github.com/openssl/openssl/pull/30416)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 17 11:16:00 2026
(Merged from https://github.com/openssl/openssl/pull/30446)
We should not pretend it can.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 17 11:15:59 2026
(Merged from https://github.com/openssl/openssl/pull/30446)
This reverts commit b60869717d.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 17 11:15:57 2026
(Merged from https://github.com/openssl/openssl/pull/30446)
The assembly functions ppc_aes_gcm_encrypt and ppc_aes_gcm_decrypt
return size_t, but their return values were stored in int variables,
causing truncation on PPC64 where size_t is 64-bit. This could lead
to incorrect results when processing inputs larger than 2GB via
EVP_Cipher() which accepts unsigned int lengths.
Change the types of s and ndone from int to size_t to match the
function return type and the return type of ppc_aes_gcm_crypt itself.
Tested on POWER8 S824 (ppc64le) — all EVP and cipher tests pass,
AES-128-GCM benchmarks at 2.94 GB/s with hardware acceleration.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Mar 17 09:44:33 2026
(Merged from https://github.com/openssl/openssl/pull/30437)
Corrected "is is" to "it is" in the BIO_pop() description to
improve documentation clarity.
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Mar 16 11:30:42 2026
(Merged from https://github.com/openssl/openssl/pull/30404)
Collapse a bunch of type calls down to a local variable
Fixes: 29974
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Mar 16 11:27:08 2026
(Merged from https://github.com/openssl/openssl/pull/30397)
Reject provider ciphers that lack get_params when unpacking the dispatch
table in evp_cipher_from_algorithm(), failing with
EVP_R_INVALID_PROVIDER_FUNCTIONS instead of later with
EVP_R_CACHE_CONSTANTS_FAILED.
Revert the optional-functions sentence in provider-cipher.pod to "All
other functions are optional." so the doc does not imply only
get_params, newctx, and freectx are required; a consistent
encrypt/decrypt set is also required as described in the prior paragraph.
Move test_cipher_no_getparams from evp_skey_test.c to evp_fetch_prov_test.c
and add fake_cipherprov.c to the evp_fetch_prov_test build.
Drop the redundant newctx/freectx/get_params line from the
evp_cipher_from_algorithm() comment.
Fixes#19110
Made-with: Cursor
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Mar 16 11:22:05 2026
(Merged from https://github.com/openssl/openssl/pull/30383)
If pushing the generated rsp ITAV object into the out stack fails,
the error path frees the stack container but permanently abandons
the newly allocated rsp object.
Explicitly free the rsp structure if it exists and was not pushed
successfully to prevent this memory leak.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Mar 16 11:16:02 2026
(Merged from https://github.com/openssl/openssl/pull/30374)
Cache early-arriving CCS in dtls1_state_st and replay it when the
handshake reaches the expected state. Clear the flag in
dtls1_clear_received_buffer().
Add dtls_ccs_reorder_test covering client/server reorder, resumption and mutual TLS.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Mar 16 11:01:55 2026
(Merged from https://github.com/openssl/openssl/pull/30225)
Recently we uncovered the fact that some platforms (nonstop) return a
non-one positive value from feof to indicate end of file. This is in
compliance with posix standards, but we had some code that assumed 1
would always be the returned value for an EOF condition, causing various
failures.
Fix it by converting BIO_eof to only return 0 or 1 to reflect the EOF
state (or in the windows case -EINVAL if an invalid stream was passed
Fixes#30348
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Sun Mar 15 19:22:41 2026
(Merged from https://github.com/openssl/openssl/pull/30395)
Add finding object and sn from EVP_MD::type_name(in the base case EVP_MD::type == 0 and seacrhing can failed)
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30206)
Exchange EVP_get_digestbynid to EVP_MD_fetch for correct getting nid from provider
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30206)
With the pthread variant, a thread truly wakes up after
the pthread_mutex_unlock call, even if pthread_cond_signal
is called before.
This is not true for the Windows variant. The thread is
woken up in WakeConditionVariable but goes back to sleep.
Reordering (signalling thread after unlocking) should save
some time during transitions and should be safe in this context.
The speedup is visible on lhash_test, running on many CPUs
(on 32 cores, a speedup from 1:40 to 1:05 minutes on test hw).
Co-Authored-By: Claude Opus 4.6 Extended <noreply@anthropic.com>
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 17:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/30388)
Unlike the pthread variant, Windows RCU uses broadcast instead
of targeted signal calls in some places, unnecessarily increasing
the number of used cycles.
The retire_qp should wake up only one thread to proceed, not
all of them. For update_qp, that signals the thread after
increasing writers_alloced, signalling all threads does not make
sense either.
The speedup is significant on lhash_test, running on many CPUs
(on 32 cores, a speedup from 6:20 to 1:40 minutes on test hw).
Co-Authored-By: Claude Opus 4.6 Extended <noreply@anthropic.com>
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 17:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/30388)
This allows ML_KEM/ML_DSA keys to set a "properties" value
that is used to refetch the digests.
This may be used when doing an import using EVP_PKEY_fromdata().
Note that this is not used by EVP_PKEY_new_raw_private_key_ex() or
EVP_PKEY_new_raw_public_key_ex() since the propq used here is
associated with the keymanager (i.e. via EVP_PKEY_CTX_new_from_name())
not the propq associated with internal fetches used by the key to
fetch digest algorithms.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 17:24:41 2026
(Merged from https://github.com/openssl/openssl/pull/30243)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 17:15:37 2026
(Merged from https://github.com/openssl/openssl/pull/30333)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 15:50:43 2026
(Merged from https://github.com/openssl/openssl/pull/30212)
Also separate algorithms and protocols in list -disabled
and display message in case of no disabled features.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 15:50:41 2026
(Merged from https://github.com/openssl/openssl/pull/30212)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 15:50:40 2026
(Merged from https://github.com/openssl/openssl/pull/30212)
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 15:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/30212)
When mgmt == NULL, EVP_PKEY_derive_SKEY() fetches an EVP_SKEYMGMT into skeymgmt. Some early returns in the fallback derive path do not free this object, causing a leak. Route these paths through shared cleanup so skeymgmt is freed.
Resolves: https://github.com/openssl/openssl/issues/30378Fixes#30378
Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/30389)
If BIO_gets encounters an empty file or read error, the function
returns NULL without freeing the dynamically allocated heap block (buf).
Safely clear and free the allocated buffer before returning NULL on
the error path. Since get_str_from_file() may handle cryptographic
keys, OPENSSL_clear_free() is used to prevent leaking sensitive data.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/30373)
If we send HTTP directly over a TLS connection then we expect to receive
the SSL_R_HTTP_REQUEST error. So we add a test to confirm that we do.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 15:12:44 2026
(Merged from https://github.com/openssl/openssl/pull/30204)
Previously we confirmed that the record we received from the peer
actually fits in our buffer before validating the record header. However,
this interferes with the checks that the "any" method does for accidental
use of HTTP because the record length will be wrong in this case. To solve
this we simply defer the check until after the record header has been
validated.
Fixes#30196
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 15:12:41 2026
(Merged from https://github.com/openssl/openssl/pull/30204)
We recently removed support for SSLv2 ClientHello messages - but some
remnants were still remaining in the record layer. We remove those too.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 15:12:39 2026
(Merged from https://github.com/openssl/openssl/pull/30204)
When the function fails to push the second CRL to the stack, it
incorrectly uses sk_X509_CRL_free() instead of sk_X509_CRL_pop_free().
This destroys the stack container but orphans previously pushed
X509_CRL objects.
Replace it with sk_X509_CRL_pop_free passing X509_CRL_free as the
cleanup routine to ensure deep deallocation of any pushed items.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/30372)
The Windows x64 calling convention requires that registers %rsi, %rdi,
and %xmm6 through %xmm15 be preserved by the callee. This patch updates
the RSAZ-2K, 3K, and 4K AVX-IFMA assembly routines to correctly push/pop
%rsi/%rdi and save/restore the non-volatile XMM registers to the stack
when building for Win64.
This ensures ABI compliance and prevents potential data corruption or
crashes in callers that rely on these registers being preserved across
function calls.
Functions updated:
- ossl_rsaz_amm52x20_x1_avxifma256
- ossl_rsaz_amm52x20_x2_avxifma256
- ossl_extract_multiplier_2x20_win5_avx
- ossl_extract_multiplier_2x30_win5_avx
- ossl_extract_multiplier_2x40_win5_avx
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Mar 13 12:15:10 2026
(Merged from https://github.com/openssl/openssl/pull/30280)
assembler.
This looks like a block copy bug, the 2k file uses both fields but the
3k & 4K variants only pass acc0_0 to functions.
Reported and proposed fix supplied by pyca (@reaperhulk and @alex).
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 13 08:48:11 2026
(Merged from https://github.com/openssl/openssl/pull/30061)
The gen ctx stores seed material in uint8_t seedbuf[ML_KEM_SEED_BYTES],
where ML_KEM_SEED_BYTES = ML_KEM_RANDOM_BYTES * 2.
When cleanup runs and gctx->seed != NULL, it wiped ML_KEM_RANDOM_BYTES
so clearing only half of the seed buffer.
This change wipes the entire buffer instead.
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 13 08:42:00 2026
(Merged from https://github.com/openssl/openssl/pull/30355)
Adding the high and low limits might cause the classic binary
search overflow bug. Probably not a concern but its one less
thing to worry about.
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 13 08:35:30 2026
(Merged from https://github.com/openssl/openssl/pull/30342)
Updates for new users related to PR's.
Although some of this info is in other places, a new user should
not need to look at 'commiter' related docs.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Mar 13 08:28:19 2026
(Merged from https://github.com/openssl/openssl/pull/30336)
The documentation claimed that X509_NAME_print() would indent each line
by obase characters and wrap lines exceeding 80 characters. However, the
implementation has never actually used obase for any purpose since the
line-wrapping code was removed in 2007 as unreachable.
Update the documentation to state that obase is ignored and the function
outputs on a single line.
Fixes#18004
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 13 08:21:51 2026
(Merged from https://github.com/openssl/openssl/pull/29900)
Ensure the NonStop fallback state does not leak across calls by clearing hpns_connect_attempt at the beginning of RAND_query_egd_bytes and after a successful connect. No impact on other platforms.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 12 18:22:00 2026
(Merged from https://github.com/openssl/openssl/pull/28909)
Windows GitHub CI / shared (map[arch:amd64 config:enable-lms enable-fips no-thread-pool no-quic os:windows-2025 vcvars:C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat]) (push) Has been cancelled
Windows GitHub CI / shared (map[arch:amd64 config:enable-lms enable-fips os:windows-2022 vcvars:C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat]) (push) Has been cancelled
Windows GitHub CI / shared (map[arch:x86 config:no-fips enable-lms os:windows-2022 vcvars:C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars32.bat]) (push) Has been cancelled
Windows GitHub CI / cygwin (windows-2022, map[arch:win64 config:-DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips]) (push) Has been cancelled
Using sizeof(unsigned long) as SipHash digest size; SipHash supports
only 8 or 16 bytes. On platforms where sizeof(unsigned long) == 4,
the call fails, and lcid_hash returns the zero-initialized value,
degrading the hash table into list.
The issue was kindly reported and fix provided by Stanislav Fort at Aisle Research.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 12 18:04:10 2026
(Merged from https://github.com/openssl/openssl/pull/29814)
Tighten RAND_query_egd_bytes and fix edge cases:
* Reject nonpositive request sizes to avoid wrap when storing the
length byte in tempbuf[1].
* Treat server length byte as untrusted; bound by the requested size
and by sizeof(tempbuf) to avoid overrunning caller or stack buffers.
* Defer fdopen until after a successful connect. On HPE NonStop
(OPENSSL_SYS_TANDEM) the connect retry path may swap the socket fd;
creating the FILE* early could leave a stale stream pointing at a
closed descriptor, causing EBADF or short I/O, and leaking the new
socket. Creating the stream after connect avoids this.
* Initialize fd to -1 and close the raw fd when fdopen fails; ensure
we close either FILE* or the raw fd on all error paths.
* Remove unused code.
Behavior is unchanged on platforms that do not swap fds during connect.
On TANDEM it prevents stale I/O and descriptor leaks. Overall this
improves robustness and bounds checking for EGD interactions.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 12 17:58:21 2026
(Merged from https://github.com/openssl/openssl/pull/28905)
The buffer used to process user commands when using advanced mode ("-adv")
can overflow the buffer by one byte if the the read buffer is exactly
BUFSIZZ bytes in length (16k). When processing the buffer we add a NUL
terminator to the buffer, so if the buffer is already full then we
overwrite by one byte when we add the NUL terminator.
This does not represent a security issue because this is entirely local
and would be "self-inflicted", i.e. not under attacker control.
This issue was reported to use by Igor Morgenstern from AISLE.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 12 17:56:37 2026
(Merged from https://github.com/openssl/openssl/pull/30376)
An out-of-memory error in lh_SSL_SESSION_insert
could trigger various use-after-free errors.
Fixes#28632
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 12 17:51:38 2026
(Merged from https://github.com/openssl/openssl/pull/28636)
It wasn't explicitly clear that it was safe to call OPENSSL_clear_free()
with a NULL because, as worded, it sounded like it may call
OPENSSL_cleanse() on NULL before calling OPENSSL_free().
CLA: trivial
Signed-off-by: dann frazier <dann.frazier@chainguard.dev>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 12 17:43:51 2026
(Merged from https://github.com/openssl/openssl/pull/28127)
The `num` parameter in DES OFB64/CFB64 functions tracks the byte offset
within an 8-byte DES block, so valid values are 0-7. However, neither
the EVP set_params path nor the low-level DES functions validated this
bound, allowing an out-of-range `num` to cause a stack buffer over-read
when used as an array index into the 8-byte keystream buffer.
Fix at two levels:
1. Provider layer: reject num >= blocksize in
ossl_cipher_common_set_ctx_params() before it reaches the cipher.
2. Low-level DES: mask `*num` with `& 0x07` on entry to
DES_ofb64_encrypt, DES_ede3_ofb64_encrypt, DES_cfb64_encrypt,
and DES_ede3_cfb64_encrypt, consistent with how `n` is already
masked at the end of these functions before being written back.
Fixes#30284
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 12 14:24:12 2026
(Merged from https://github.com/openssl/openssl/pull/30332)
pkcs12_gen_mac() now used EVP_MAC instead of direct HMAC_ calls.
PBMAC1_PBKDF2_HMAC() added additional data to raised parsing errors.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 12 10:47:31 2026
(Merged from https://github.com/openssl/openssl/pull/30279)
Do not call PKCS12_verify_mac() twice if the UTF8 password matches the mac
password.
In the case of an error in the verify path do not print
"Mac verify error: invalid password?" if there is already an error on the
error stack. An error means something failed in PKCS12_verify_mac(),
If only the password was wrong it does not raise an error.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 12 10:47:29 2026
(Merged from https://github.com/openssl/openssl/pull/30279)
The p and q parameters were being retrieved into local BIGNUM variables
but never actually used. This change removes the excess retrieval to improve maintainability, following the discussion in PR #30298.
Resolves#30340
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Mar 12 10:32:24 2026
(Merged from https://github.com/openssl/openssl/pull/30353)
Replace direct ASN1_STRING struct member access (->data, ->length) with
public accessor functions ASN1_STRING_get0_data() and ASN1_STRING_length()
in consumer code across four subsystems.
Also fix i2d_SCT_LIST() in crypto/ct/ct_oct.c to heap-allocate
ASN1_OCTET_STRING via ASN1_OCTET_STRING_new() and ASN1_STRING_set0()
rather than stack-allocating it, since the struct is now opaque.
Removes #include <crypto/asn1.h> from all modified files except
crypto/cmp/cmp_protect.c, which retains it for ossl_X509_ALGOR_from_nid().
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Mar 12 08:53:07 2026
(Merged from https://github.com/openssl/openssl/pull/30223)
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Mar 12 08:42:31 2026
(Merged from https://github.com/openssl/openssl/pull/30274)
Update the signatures for X509_STORE_CTX_get_issuer_fn
and X509_STORE_CTX_check_issued_fn.
Complements: e5b563366b "Constify X509_STORE_CTX functions invoving X509 *"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Mar 12 08:38:24 2026
(Merged from https://github.com/openssl/openssl/pull/30271)
Document the return values for EVP_CIPHER_get_params(),
EVP_CIPHER_CTX_get_params() and EVP_CIPHER_CTX_set_params().
These functions return a positive value for success and 0 or a
negative value for failure, since provider callbacks return int.
Fixes#29725
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 21:03:58 2026
(Merged from https://github.com/openssl/openssl/pull/29915)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Mar 11 20:58:54 2026
(Merged from https://github.com/openssl/openssl/pull/30331)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Mar 11 20:58:51 2026
(Merged from https://github.com/openssl/openssl/pull/30331)
Drop the `&& i < 16` and `&& i < 8` guards that were carried over from
the original fixed-size arrays. The loops now fill the entire
heap-allocated buffer, with values wrapping naturally via unsigned char.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Mar 11 20:58:49 2026
(Merged from https://github.com/openssl/openssl/pull/30331)
Initialize key, iv, and ctx to NULL at declaration and consolidate
all cleanup into a single err label, as suggested by @npajkovsky.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Mar 11 20:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/30331)
Both do_evp_cipher() and do_evp_md() call the parameter-setting
function (EVP_CIPHER_CTX_set_params / EVP_MD_CTX_set_params) before
initializing the algorithm context (EVP_EncryptInit_ex2 /
EVP_DigestInit_ex2). Since the context has no algorithm associated
at that point, set_params always returns 0 and the function
early-returns, making the cipher and digest paths dead code (~20%
of all fuzzer inputs).
Fix by swapping the call order so the context is initialized first.
Additionally, heap-allocate key/iv buffers sized to the cipher's
actual key and IV length, since some ciphers (e.g. DES-EDE3-OFB)
require buffers larger than the previous fixed 16/8-byte arrays.
Fixes#30281
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Mar 11 20:58:44 2026
(Merged from https://github.com/openssl/openssl/pull/30331)
Add ntt_se_handler and .pdata/.xdata sections for the three AVX2 NTT
functions.
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 15:47:52 2026
(Merged from https://github.com/openssl/openssl/pull/30160)
AVX2 NTT functions clobber YMM6-YMM15. This commit preserves
the lower halves of XMM6-XMM15 required by the Windows x64 ABI.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 15:47:49 2026
(Merged from https://github.com/openssl/openssl/pull/30160)
It applies to 7 out of 8 levels in NTT and NTT^-1.
It helps eliminate some zeta shuffles in NTT level 6 and NTT^-1 level 1.
Added small optimization in data shuffling between the levels.
Signed-off-by: Tomasz Kantecki <tomasz.kantecki@intel.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 15:47:46 2026
(Merged from https://github.com/openssl/openssl/pull/30160)
Replace inline AVX2 capability checks with function pointers that are
initialized once at startup using CRYPTO_THREAD_run_once.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 15:47:43 2026
(Merged from https://github.com/openssl/openssl/pull/30160)
This commit introduces AVX2-vectorized assembly implementations of the
Number Theoretic Transform (NTT) operations used in ML-DSA (FIPS 204).
These optimizations improve performance of ML-DSA key generation,
signing, and verification operations on x86_64 platforms
with AVX2 support.
The implementation adds the following functions:
- ml_dsa_poly_ntt_avx2: Forward NTT transformation
- ml_dsa_poly_ntt_inverse_avx2: Inverse NTT transformation
- ml_dsa_poly_ntt_mult_avx2: NTT-domain polynomial multiplication
Key implementation details:
- Uses YMM registers to process 8 32-bit coefficients in parallel
- Employs Montgomery reduction for modular arithmetic
- Implements NTT butterfly operations across multiple transform levels
- Includes dedicated zeta table for INTT to reduce cycles
- Runtime capability check via ml_dsa_ntt_avx2_capable() using
OPENSSL_ia32cap_P to detect AVX2 support
The C code in ml_dsa_ntt.c is updated to dispatch to AVX2
implementations
at runtime when available, with automatic fallback to the portable C
implementation on platforms without AVX2 support.
Build system changes:
- Added GENERATE rule for ml_dsa_ntt-x86_64.s from Perl assembly
- Conditional assembly inclusion based on target architecture
- Works with both libcrypto and FIPS provider builds
Co-authored-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 15:47:40 2026
(Merged from https://github.com/openssl/openssl/pull/30160)
Consolidate FIPS indicators and self-test parameters into a single
structure managed by `fipsparams.pm`. Replace individual accessor
functions with a generic `ossl_fips_config` function that retrieves
values by name. This removes repetitive boilerplate code and
simplifies parameter access within the FIPS provider.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30213)
Replace the C preprocessor macros used for FIPS indicators and self-test
parameters with a Perl-based code generation approach. This introduces
`util/perl/OpenSSL/fipsparams.pm` and `providers/fips/fipsparams.inc.in`
to generate the boilerplate code, simplifying `fipsprov.c` and reducing
macro complexity.
Co-authored-by: Gemini <gemini@google.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30213)
Detect and use LSX (128-bit SIMD) to accelerate the message scheduling
stage of SHA-512. The main compression round is not amenable to SIMD
optimizations because horizontal data dependencies are very heavy.
In the current approach, 8 vector registers are used to store the 16
active message schedule array elements, with each 128-bit register fully
utilized holding 2 64-bit element each. Thankfully this means the data
dependency between x[n] and x[n-2] for rounds >= 16 (0-based) is
completely side-stepped, and with no computational power wasted.
Performance numbers on Loongson 3C6000 (LA664 uarch) @ 2.2GHz:
Before:
```
version: 3.6.0-dev
built on: Sun Aug 3 10:22:36 2025 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
CPUINFO: N/A
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
sha512 27701.14k 109625.41k 206773.00k 311351.64k 367442.71k 371401.72k
```
After:
```
version: 3.6.0-dev
built on: Sun Aug 3 10:22:36 2025 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
CPUINFO: N/A
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
sha512 33440.93k 132238.88k 272890.18k 429715.11k 518770.04k 526172.98k
```
Which is an improvement of between 20.63% (for 64B inputs; 20.72% for
16B which is very close) and 41.67% (for 16KiB inputs). This is much
larger an improvement than for SHA-256.
A similar attempt at utilizing LASX is also done, with 4 256-bit XRs
being used to store 4 64-bit elements each, and with the sigma1
computation unrolled twice; performance actually dropped by -12.56%
(64B; -12.59% for 16B) to -22.31% (16KiB) (!!). This large drop is most
likely due to the fact that LASX is incapable of efficiently
transferring data across the higher and lower 128-bit halves -- 3 cycles
latency for every instruction capable of doing so. Specifically, with
the unrolled sigma1 computation, one needs to swap halves and zero the
other unused half, and do this twice; and re-aligning "1234" and "9abc"
parts also requires two such moves, such as moving x[4] from m4567[0] to
m1234[3]. So, ultimately I decided to remove LASX from the patchset.
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:17 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
Detect and use LSX (128-bit SIMD) to accelerate the message scheduling
stage of SHA-256. The main compression round is not amenable to SIMD
optimizations because horizontal data dependencies are very heavy.
Due to data dependencies between x[n] and x[n-2] for rounds >= 16
(0-based), at most 2 SIMD lanes can be efficiently utilized, which
unfortunately means half of space is wasted with LSX (128-bit = 4 32-bit
lanes), and LASX (256-bit, 8 32-bit lanes) is meaningless. In the
current approach, 8 vector registers are used to store the 16 active
message schedule array elements; only vr[0] and vr[2] are meaningful for
each VR.
Performance numbers on Loongson 3C6000 (LA664 uarch) @ 2.2GHz:
Before:
```
version: 3.6.0-dev
built on: Sun Aug 3 10:22:36 2025 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
CPUINFO: N/A
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
sha256 32676.25k 87543.16k 168349.71k 218342.74k 240099.57k 241639.34k
```
After:
```
version: 3.6.0-dev
built on: Sun Aug 3 10:22:36 2025 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
CPUINFO: N/A
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
sha256 37180.32k 104604.94k 206861.06k 276741.65k 306465.73k 308863.06k
```
Which is an improvement of between 13.78% (for 16B inputs) and 27.82%
(for 16KiB inputs).
I have also experimented with a denser storage of message elements, with
4 VRs each storing 4 elements, but performance dropped by 0.25% (16B) to
2.42% (16KiB) because sigma1 must be computed twice with this storage
layout: once on x[14..15], once on the fresh x[16..17].
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:15 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
To make the emitted assembly easier to read. No functional change.
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:12 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
De-duplicate the rounds to make the code shorter. No functional change.
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:09 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
ABI names (e.g. "$t0" instead of "$r12") on LoongArch are always
supported by mainline binutils and LLVM IAS, so use them for better
readability. No functional change.
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:06 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
No functional change.
Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Mar 11 13:56:03 2026
(Merged from https://github.com/openssl/openssl/pull/28192)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:37 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:35 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:34 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:32 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:31 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 11:22:30 2026
(Merged from https://github.com/openssl/openssl/pull/28373)
The example was for an older version of the code which used triadic
macros to define the functions. The code was simplified making these
dyadic but the example was skipped. This fixes the example.
Fixes: cccfc66828 "doc: document the internal integer overflow helpers"
References: b037e3637a "header: add integer overflow helper functions"
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Mar 11 10:19:05 2026
(Merged from https://github.com/openssl/openssl/pull/30266)
Issue https://github.com/openssl/openssl/issues/3030
Found a use after free case in ossl_quic_accept_connection in the event
that we fail to up_ref the associated quic listener object.
If we fail to take the up ref on the listener object in this function,
we free the SSL object, which calls into
SSL_free->ossl_quic_free->qc_cleanup, which because we have an
associated listener, we free the mutex for, and then get a use-afer-free
when we try to unlock that mutex shortly thereafter.
We really need to fix 3 problems here:
1) The use after free. Handle this bt ensuring that the listener is
assigned first.
2) A deadlock, since we already hold the associated mutex, we need to
defer the free operation until after we unlock the mutex.
3) Don't drop the refcount on the listener object in ossl_quic_cleanup
(since we failed to up-ref it here). Handle this by adding a flag to
indicate up-ref failure in the quic-connection object.
Problem was confirmed by synthetically failing the up ref in local
testing, and this patch was confirmed to fix the issue.
Also, we need to adjust some of the tests in quicapitest here, as
several tests just assume that SSL_accept_connection will return a
non-null value.
Fixes#30307
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 11 09:22:35 2026
(Merged from https://github.com/openssl/openssl/pull/30311)
Improve the NOTES section of SSL_CTX_use_certificate(3) to make it
clearer that:
- The certificate store is specific to each SSL_CTX or SSL object,
not a global store
- Multiple key/certificate pairs of different types can be loaded
- This enables offering different certificate types (RSA, ECDSA, etc.)
on a single TLS server socket
- OpenSSL automatically selects the appropriate certificate during
the TLS handshake based on cipher suite and signature algorithms
- Loading multiple pairs is done by calling the loading functions
multiple times
This helps TLS server developers understand that their configuration
should allow multiple key/cert pairs per context.
Fixes#28425
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Wed Mar 11 03:20:37 2026
(Merged from https://github.com/openssl/openssl/pull/29786)
In Windows makefile, "del /Q /S /F test\*.exp" command is called.
Due to use of /S switch and old filenames compatibility
magic, it deletes also all *.expected files.
This make subsequent run of configtest to fail.
As this is the only test using these names (and cryptic
workarounds in makefile are unreadable), let's just
rename expected files to *-exp.out suffix.
Also fix two alien tabs in script.
Fixes: https://github.com/openssl/project/issues/1894
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Mar 10 19:42:26 2026
(Merged from https://github.com/openssl/openssl/pull/30324)
We must free pre_comp before its overwrite.
Fixes: 3aef36ffef "Add CRYPTO_EX_DATA; remove EC_EXTRA_DATA"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Mar 10 19:04:33 2026
(Merged from https://github.com/openssl/openssl/pull/30320)
Fix CMS signing without signed-attributes for unknown (provider-supplied)
algorithms with don't operate on a digest (e.g. Falcon).
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 18:25:39 2026
(Merged from https://github.com/openssl/openssl/pull/30287)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Mar 10 18:22:20 2026
(Merged from https://github.com/openssl/openssl/pull/30289)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Mar 10 18:22:17 2026
(Merged from https://github.com/openssl/openssl/pull/30289)
This struct is accessed via atomics, which on some platforms require 8
byte alignment. Generally compilers provide that alignment, since the
first element of the struct is a uint64_t, but it appears that not all
do.
Force the alignment to be correct
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 10 18:16:34 2026
(Merged from https://github.com/openssl/openssl/pull/30293)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 10 17:42:48 2026
(Merged from https://github.com/openssl/openssl/pull/30325)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 10 15:52:35 2026
(Merged from https://github.com/openssl/openssl/pull/30298)
Freeing secure memory using OPENSSL_free causes badness. Use the proper
free call instead.
Fixes#30302
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 10 15:08:36 2026
(Merged from https://github.com/openssl/openssl/pull/30305)
Since it has been released before 4.0.0-alpha1.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:37 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:32 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Include various items from CHANGES.md, remove items pertaining
OPENSSL_sk_set_cmp_thunks() and crypto-mdebug-backtrace, split into new
features and significant/incompatible changes.
Also, while at it, added the leader to the 3.6.0 news entry.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:28 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:25 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Reorder entries, following general
additions-changes-deprecations-removals order.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:22 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
An attempt has been made to harmonise the language and style
of the changelog and news records a bit.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:20 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:17 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
A specific order makes link addition more consistent moving forward.
The links were sorted with "LC_ALL=C sort -V" command, "sort"
is from GNU coreutils.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Mar 10 13:39:11 2026
(Merged from https://github.com/openssl/openssl/pull/30338)
This reverts commit 0da29907e7 "Constify X509_find_by_subject",
as it operates on a stack of X509 (not const X509) objects, and returns
a pointer to one of them.
Fixes: 0da29907e7 "Constify X509_find_by_subject",
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 21:29:37 2026
(Merged from https://github.com/openssl/openssl/pull/30265)
This partially reverts commit 07ee3d5db8 "constify
X509_find_by_issuer_and_serial", as it operates on a stack of X509
(not const X509 objects), and returns a pointer to one.
The constification of PKCS7_signatureVerify argument is sensible
(as the argument is read-only inside the function) and is remained
in place.
Fixes: 07ee3d5db8 "constify X509_find_by_issuer_and_serial"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 21:29:34 2026
(Merged from https://github.com/openssl/openssl/pull/30265)
I placed these new notes prominently based upon how important I think that they are for applications developers targeting Windows platforms. With this new option, contributed (but not documented) by @nhorman in Commit 9431cc2, standalone executable applications can be distributed that do not require an installer and do not require modification of the target computer.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 1:50:49 2026
(Merged from https://github.com/openssl/openssl/pull/30064)
This partially reverts commit 367c54ef11 "Constify
X509_OBJECT_[get0|set1]_X509 and friends", as well as removes them from
the list added in c0f82d915f "Describe X509 constification and ASN1_STRING
changes". Constification of X509_get_pubkey() arguments remains in place.
Resolves: https://github.com/openssl/project/issues/1892
Complements: 367c54ef11 "Constify X509_OBJECT_[get0|set1]_X509 and friends"
Complements: c0f82d915f "Describe X509 constification and ASN1_STRING changes"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 18:36:10 2026
(Merged from https://github.com/openssl/openssl/pull/30276)
Remove mentions of un-constified X509_STORE_CTX_get_current_cert,
X509_STORE_CTX_get0_cert, X509_STORE_CTX_get0_current_issuer,
X509_STORE_CTX_init, X509_STORE_CTX_set_cert for the list of constified
functions.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 18:33:15 2026
(Merged from https://github.com/openssl/openssl/pull/30272)
This reverts constification of the return value types
of X509_STORE_CTX_get_current_cert(), X509_STORE_CTX_get0_current_issuer(),
X509_STORE_CTX_get0_cert() functions, and arguments
of X509_STORE_CTX_set_cert() and X509_STORE_CTX_init() functions.
Constification of users of these functions, as well as
X509_STORE_CTX_get_issuer_fn and X509_STORE_CTX_check_issued_fn types,
remained in place.
Complements: e5b563366b "Constify X509_STORE_CTX functions invoving X509 *"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 18:33:12 2026
(Merged from https://github.com/openssl/openssl/pull/30272)
This reverts commit ae8d50f211.
Fixes: https://github.com/openssl/project/issues/1893
messing with free is a bridge too far
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar 6 17:50:22 2026
(Merged from https://github.com/openssl/openssl/pull/30273)
We now restrict the max number of key_shares/supported groups/sig algs
that we will pay attention to as a server.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 6 10:33:04 2026
(Merged from https://github.com/openssl/openssl/pull/30263)
Test that we correctly ignore large numbers of key shares. Similarly we
do the same for a large number of supported groups.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 6 10:33:04 2026
(Merged from https://github.com/openssl/openssl/pull/30263)
Test that we correctly ignore large numbers of sigalgs
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 6 10:33:04 2026
(Merged from https://github.com/openssl/openssl/pull/30263)
We restrict the number of supported groups and sig algs that the server
is willing to accept from the client to 128 (for both). Any more than
this are simply ignored. This number is significantly more than the total
amount of current codepoints assigned by IANA for these extensions.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 6 10:33:03 2026
(Merged from https://github.com/openssl/openssl/pull/30263)
A client that sends an excessive number of keyshares to the server can
cause us to check that the groups are both in the client and server lists,
which is expensive. In reality there should be no reason to send a large
number of keyshares, so we restrict this to a sensible number (16). Any
more than this are simply ignored.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 6 10:33:03 2026
(Merged from https://github.com/openssl/openssl/pull/30263)
Fixes#29748
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 18:04:24 2026
(Merged from https://github.com/openssl/openssl/pull/29829)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 17:41:05 2026
(Merged from https://github.com/openssl/openssl/pull/30261)
- In various structures with optional X.509 extensions, deallocate and
NULL out the extensions pointer when the extensions become empty after
an extension is deleted. This uses a new X509v3_delete_extension()
helper function. Added corresponding docs.
- Do the same in X509V3_EXT_add_nconf_sk() if after processing all
the pending updates the stack becomes empty.
- Handle resulting NULL stack in X509V3_EXT_REQ_add_nconf() and
update_req_extensions().
- Improved testing of certificate SKID/AKID addition and implicit
removal via "none" value.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 17:40:10 2026
(Merged from https://github.com/openssl/openssl/pull/30252)
Using del on files that are not present creates many warning
messages. Let's wrap them in "if exists" check to make
them silent if not present.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Mar 5 17:37:20 2026
(Merged from https://github.com/openssl/openssl/pull/30222)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Thu Mar 5 16:35:20 2026
(Merged from https://github.com/openssl/openssl/pull/30259)
Critical extension enforcement (introduced in #8a639b9) is incorrect. These
checks were intended as CA requirements to prevent misinterpretation by
verifiers that don't support certain extensions. However, since we do support
these extensions, we have no requirement for them to be marked critical,
enforcing that is a mistake.
As noted in: #30233 (comment)
Co-authored-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 14:22:07 2026
(Merged from https://github.com/openssl/openssl/pull/30249)
Under some circumstances, the test script's output was mixed with
s_server's, resulting in a false negative. To avoid this,
redirect s_server’s output to stderr.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 14:03:32 2026
(Merged from https://github.com/openssl/openssl/pull/30230)
We need to avoid looking at the error stack unless we are in
error state.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 14:03:30 2026
(Merged from https://github.com/openssl/openssl/pull/30230)
We fix a problem with the record layer handling code where a fatal error
in the record layer that does not have an alert code associated with it
caused us to not transition the state machine into the error state. If we
have a fatal error we should always do that.
This patch was developed by Matt Caswell <matt@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 5 14:03:27 2026
(Merged from https://github.com/openssl/openssl/pull/30230)
of OPENSSL_free()
Fixes: 170b735820 "DANE support for X509_verify_cert()"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Mar 5 12:37:17 2026
(Merged from https://github.com/openssl/openssl/pull/30250)
Fix up format of NTT tables, which format nicely when the values
are converted to 12-bit hex.
Also slightly clean up the code for better readability.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Mar 4 17:46:54 2026
(Merged from https://github.com/openssl/openssl/pull/30245)
EVP_KDF-PBKDF2 has provider-dependent runtime behaviour w.r.t. lower
bounds checks. The default provider does not enforce them, but can opt
into them. The fips provider does enforce them, but can opt out.
The same is not true for the PKCS5_PBKDF2_HMAC, which always opts out
of the lower bound checks.
This leads to unexpected behaviour without user consent, they may
expect in error that when using FIPS provider the lower bound checks
will be enforced by default.
There are two popular tools for ACVP testing:
- 9ee15db6e6/app/app_kdf.c (L411)
- e1c094ae3a/backends/backend_openssl_common.c (L1836)
One of them creates params and then calls the one-shot EVP_KDF_derive
api, whilst the other calls the PKCS5_PBKDF2_HMAC convenience
wrapper. For the same ACVP test vectors the two produce different
results: with and without lower bounds checks.
But it seems like PKCS5_PBKDF2_HMAC is popular, as it outnumbers
EVP_KDF_derive 8x when doing a global code search on github
(anecdotal, as results are skewed by the number of forks). This thus
comes down to the expectations end users have. And it feels like, at
least for this API, the FIPS 140-3 users expectation would be for the
lower bound checks to be enforced.
Modify the PKCS5_PBKDF2_HMAC wrapper around EVP_KDF_derive to not set
PKCS5 parameter, such that the provider implicit default is used
instead. Thus no change for default provider users, and FIPS
enforcement by default in the FIPS case like it always has done when
calling via EVP_KDF_derive.
Test fixes:
Tests with too short salt would fail with fips provider.
Add test that FIPS provider rejects invalid salt length.
test/certs: Re-encrypt leaf-encrypted.key with a longer salt.
This way test cases can work with a FIPS provider
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 17:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/27431)
The RFC 9579 good files are always tested with the default provider.
The RFC 9579 good files use too short salt, and too short password
that a sticrly compliant FIPS provider with lower bounds enforcement
should no longer able to open.
If checking positive files is desired, these could be regenerated with
longer salt and password, but not too sure if it is worth it.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 17:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/27431)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 17:11:17 2026
(Merged from https://github.com/openssl/openssl/pull/30214)
The ECDSA KAT_Signature selftest can fail if the system time changes
after KAT DRBG initialization, this may trigger a time-based reseed
and break KAT determinism.
Disable time-based reseeding for the KAT DRBG to avoid spurious
selftest failures during e.g. fipsinstall.
In order to make this fix future proof we disable request based
reseeding as well to guarantee determinism during the selftest.
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Mar 4 16:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/29633)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 16:43:39 2026
(Merged from https://github.com/openssl/openssl/pull/30235)
Commit 262cda1cda ("Remove some safestack things that are no longer
needed", 2020-09-03) removed the last usage on this macro. Remove it in
the configuration as well.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 10:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/30199)
Commits 31659fe326 (Introduce OPENSSL_ATEXIT_CLEANUP env. variable.,
2025-11-24) and 994413f995 (Update NEWS.md, 2025-12-15) removed the last
uses of this macro. Remove it in the configuration as well.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 10:21:36 2026
(Merged from https://github.com/openssl/openssl/pull/30199)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Mar 4 09:34:09 2026
(Merged from https://github.com/openssl/openssl/pull/30242)
Also validate the input buffer and length properly.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Mar 4 09:30:18 2026
(Merged from https://github.com/openssl/openssl/pull/28859)
The new HT_KEY_COPY_RAW fails to account for copy lengths that exceed
the size of the configured buffer in a key, leading to stack overruns on
read.
Rectify that by claming the COPY macro to limit copies to the size of
the buffer
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Mar 4 07:04:07 2026
(Merged from https://github.com/openssl/openssl/pull/30257)
Now that we can dynamically size keys for our hashtable, take advantage
of that in core_namemap.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 3 13:23:03 2026
(Merged from https://github.com/openssl/openssl/pull/30211)
Currently our internal hashtable suffers from a performance issue, as
discussed here:
https://github.com/openssl/openssl/pull/30188
The hashtable requires that keys be defined at build time, and moreover,
be defined to support the maximum possible key length you might try to
insert to a given hash table, even if they actual key you are using is
shorter.
As a result, that hashtable hash function (typically ossl_fnv1a_hash,
but any hash function really) receives a buffer that is specified as the
maximal length of the build-time defined key, which often means hashing
of many 0 bytes for byte elements in the key that may never have been
used. This causes performance problems as we are always hashing the
maximum number of elements, even if they key is truly only a few bytes
long.
Lets give users an opportunity to improve on that.
Keys are defined to be a struct, so that users can access individual
field names within the key, but under the covers its all just one
contiguous uint8_t buf. We can implement macros that allow users to,
instead of setting individual field names, just copy needed data into
the raw buffer, keeping track of how many bytes have been used as we go.
The result of using these macros is that the hash function, while it
will receive a buffer that is still maximally sized for that particular
key, gets a length value that only represents the number of bytes used
while writing the key value.
This results in the hash function having to do much less work, giving us
a significant opportunistic speedup.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Mar 3 13:23:00 2026
(Merged from https://github.com/openssl/openssl/pull/30211)
upstream test harness project renamed its implementations.json file to
implementations_quic.json. We need to do the same in our CI file
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Mar 3 11:37:49 2026
(Merged from https://github.com/openssl/openssl/pull/30248)
If decoders setup fails, this is a fatal error.
We indicate EOF from the store as otherwise the store
users will loop indefinitely.
Fixes#28667
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Mar 2 19:38:43 2026
(Merged from https://github.com/openssl/openssl/pull/30170)
Reported by Luigino Camastra (Aisle Research).
Explicit curves returned a NID of NID_undef (which has a value of 0)
which resulted in the check >= 0 passing.
Changing the result to > addresses the issue.
Note that this is a NON issue in master since explicit curves are
now disabled by default. Note also that for any EC operation that
tries to use a loaded EC key, checks that the curve and security
strength are valid.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Mar 2 19:37:04 2026
(Merged from https://github.com/openssl/openssl/pull/30138)
- Drop empty requestExtensions CSR attributes
While `attributes` is a required CSR field, its `requestExtensions`
attribute is optional, and should be avoided if empty.
- Detail documentation of req extension section selection
- Fixed req CI test case naming nits
- Refer to config(5) for meaning of "variable"
- In code comments, note possibility of fewer extensions after adding
an ignored empty extension while deleting a previous value.
- Mention new "nonss" AKID qualifier in CHANGES
- I x509_config(5) Clarify AKID issuer as fallback (unless ":always")
- In stock config file, comment proxy cert issuer SKID expectation.
- Clarify comment on empty SKID/AKID vs. prior value
- Use B<default> not C<default> for unnamed section
- Polish (mostly CSR) extension handling
* In update_req_extensions() drop extraneous duplicate
X509at_delete_attr() call.
* Consolidate empty SKID/AKID detection in new
ossl_ignored_x509_extension().
* Handle empty SKID/AKID also in X509V3_add1_i2d().
* In test_drop_empty_csr_keyids() exercise the full NCONF extension
management stack, using X509_REQ_get_attr_count() to check that
after "subjectKeyIdentifier = none" not an even an empty extension
set remains as a CSR attribute (X509_REQ_get_extensions() always
returns at least an empty stack because NULL signals an error).
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Mar 2 17:04:22 2026
(Merged from https://github.com/openssl/openssl/pull/30217)
There are multiple changes - updated ciphers to more current ones,
also better documentation for COMPLEMENTOFDEFAULT.
Fixes#6653
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Mar 2 15:56:39 2026
(Merged from https://github.com/openssl/openssl/pull/30153)
Fixes#30039
In order to fix this, the ossl_sha3_ related functions have been
renamed so that ossl_sha3_XXX() functions are the high level
functions that contain calls to platform specific methods.
ossl_sha3_XXX_default() etc are the 'general' platform methods.
All of the state checking has been moved out of the platform specific
methods. The sha3 provider dispatch functions now share the
ossl_sha3_XXX() calls.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Mar 2 11:58:44 2026
(Merged from https://github.com/openssl/openssl/pull/30104)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Mar 2 09:58:58 2026
(Merged from https://github.com/openssl/openssl/pull/30155)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Mar 2 09:55:44 2026
(Merged from https://github.com/openssl/openssl/pull/30175)
Document that providers must be unloaded with OSSL_PROVIDER_unload()
before their associated library context is freed with OSSL_LIB_CTX_free().
Calling OSSL_PROVIDER_unload() after the library context has been freed
results in undefined behavior (heap-use-after-free).
The warning is added to both OSSL_PROVIDER(3) and OSSL_LIB_CTX(3) man pages
to ensure users encounter it regardless of which documentation they consult.
Fixes#27522
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun Mar 1 19:03:43 2026
(Merged from https://github.com/openssl/openssl/pull/29785)
Its older, and generally replaced by PKCS7_verify, but its not
deprecated, so we should document it.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sun Mar 1 14:18:17 2026
(Merged from https://github.com/openssl/openssl/pull/30158)
PKCS7_dataVerify returns 1 on success or 0 on failure, just like
PKCS7_verify.
except, if everything else goes right, it returns the value of
PKCS7_signatureVerify, which may be -1, which seems wrong.
Instead, check the retun of PKCS7_signatureVerify within this function
for an error, and make PKCS7_dataVerify return 0 in the event
signatureVerify fails.
This brings us into line with PKCS7_verify behavior
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sun Mar 1 14:18:14 2026
(Merged from https://github.com/openssl/openssl/pull/30158)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sun Mar 1 02:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/30157)
Add tests for suppression of skid/akid via explicit "none"
values and per-keyword "nonss" qualifiers and update docs.
Signing of X509 certs and X509_REQ CSRs rejects empty AKID/SKID
extensions, document and test this behaviour.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 28 15:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/29057)
With the advent of the new AKID and SKID value syntax:
- subjectKeyIdentifier = none
- authorityKeyIdentifier = none
the resulting extensions are not directly suppressed, instead they
are parsed respectively as an empty OCTET STRING or an empty SEQUENCE.
There was new code in "apps/" to then drop the extension when signing
certificates, but this did not address applications that sign
certificates via the API, nor did it avoid adding these in CSRs.
We now drop these specific empty extensions from both certificates and
CSRs as part of X509v3_add_ext(), with the parsed extension never added
to the extension stack.
This means that in the "apps" the default "hash" or "keyid, issuer"
values must now be created first, with config settings and command-line
options applied after replacing the default as requested (including
"none" to suppress the extensions if desired).
If somehow an application manages to construct a TBS cert or CSR with a
pending empty SKID or AKID extension, an error is raised and the TBS is
not signed.
When no SKID is present in a self-signed cert, attempts to
force an AKID keyid need to fail, rather than produce an AKID
that will never match.
Similarly, when issuer cert == subject cert (same object in memory), but
the issuer key is not the subject key (forced signing key), there is no
way to infer the unknown issuer's name or serial number, so, with
"issuer:always" we must fail, rather than record the subject's own
issuer name and serial.
New "keyid:nonss" and "issuer:nonss" syntax is now supported, which
allows either part of the AKID to be conditional on the certificate not
being self-signed. In the case if "issuer:nonss" this is also
conditional on there being no non-empty issuer keyid. To force
inclusion of issuer+serial in the AKID use "issuer:always".
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 28 15:22:47 2026
(Merged from https://github.com/openssl/openssl/pull/29057)
Requested by @levitte in #30075
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 28 14:04:35 2026
(Merged from https://github.com/openssl/openssl/pull/30148)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 28 13:23:47 2026
(Merged from https://github.com/openssl/openssl/pull/30189)
The option was a remnant of the FIPS canister and wasn't used anywhere.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30200)
This refers to an option that is no longer supported or available.
The option is a remnant of the old FIPS canister from OpenSSL 1.0.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30200)
This flag was used to support the old FIPS canister and isn't used or
needed anymore. It's only set in the data structures and never queried
so it's removal is low impact.
Fixes#30156
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30200)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Sat Feb 28 09:17:23 2026
(Merged from https://github.com/openssl/openssl/pull/30089)
- Also suppress duplicate ciphersuites
- Also ignore case in both TLS 1.3 and TLS 1.2 ciphers
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Sat Feb 28 09:11:33 2026
(Merged from https://github.com/openssl/openssl/pull/30140)
CRLs with a malformed Issuing Distribution Point are now rejected.
ASN.1 parsing errors from the IDP extension are propagated instead
of being suppressed.
Fixes#27251
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 27 20:06:59 2026
(Merged from https://github.com/openssl/openssl/pull/30171)
Add alternate wordings for ossl-guide-migration so that its a bit easier
to find.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Feb 27 18:45:50 2026
(Merged from https://github.com/openssl/openssl/pull/30165)
In a CHANGES.md entry and in ossl-guide-migration, to
cover the constification of the X509 related functions and
the change to ASN1_STRING to be opaque.
Fixes: #30060
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Feb 27 18:45:47 2026
(Merged from https://github.com/openssl/openssl/pull/30165)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 27 14:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/29381)
This outputs the description field which is easier to understand than a
pointer.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 27 14:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/29381)
Added a description to all encoder and decoder fields.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 27 14:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/29381)
Added LMS 'SubjectPublicKeyInfo' encoder/decoder support.
Modified LMS keymanager and signature code to work with pkey and
pkeyutl.
Test data for public keys and signatures were generated by modifying
BouncyCastle code tests.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 27 14:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/29381)
Constify this funcitons X509 parameter, as it generally doesn't modify
the structure, save for the caching information that it computes.
Note: As the caching opertions in ossl_x509v3_cache_extensions modify
X509 data all over the place, this change centralizes those updates,
which is something of an increase in complexity, but it does allow us to
reduce the critical section of the write lock there which (hopefully)
will make other accesses that take that lock a bit faster.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Feb 26 14:58:30 2026
(Merged from https://github.com/openssl/openssl/pull/30067)
Fixes: #29931
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
MergeDate: Thu Feb 26 14:26:16 2026
(Merged from https://github.com/openssl/openssl/pull/30100)
Constify the return value of X509_find_by_issuer_and_serial, and fix up
the callers to handle it properly (affects two pkcs7 functions)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Feb 25 15:05:11 2026
(Merged from https://github.com/openssl/openssl/pull/30092)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Feb 25 14:23:45 2026
(Merged from https://github.com/openssl/openssl/pull/30174)
The existing SSL_get_sigalgs() and SSL_get_shared_sigalgs() are not a
good fit for TLS 1.3, because signature schemes are no longer generally
combinations of separate digest and signing algorithms encoded in the
two byte codepoint.
The new SSL_get0_sigalg() and SSL_get0_shared_sigalg() functions just
report the signature scheme name and codepoint.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:30:16 2026
(Merged from https://github.com/openssl/openssl/pull/29982)
Use OPENSSL_malloc_array() for ee->suites array allocation, as it is more
semantically sound and performs a size overflow check.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:20:15 2026
(Merged from https://github.com/openssl/openssl/pull/30146)
The default CRYPTO_malloc() implementation (with OPENSSL_malloc()
and OPENSSL_zalloc() being wrappers for it) raises an error
on allocation, and both OPENSSL_strdup() and OPENSSL_memdup() use
CRYPTO_malloc() internally for memory allocation, so there is no need
to explicitly raise an error on an allocation failure; remove these.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:20:14 2026
(Merged from https://github.com/openssl/openssl/pull/30146)
corrupt_or_copy() may return 0 while still setting returning the allocated
memory in copy, avoid leaking it by always calling OPENSSL_free() on it.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1681460
Fixes: 5e5a76fc2c "Add tests and documentation and fix a couple of issues identified by added tests"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:10:57 2026
(Merged from https://github.com/openssl/openssl/pull/30139)
Free rcfgs before return when rcfgslen is 0, mostly to placate
Coverity, as it is expected to be NULL with the majority of realloc()
implementations.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1681463
Complements: 6c3edd4f3a "Add server-side handling of Encrypted Client Hello"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:10:55 2026
(Merged from https://github.com/openssl/openssl/pull/30139)
With keyshare floating, we no longer need CPP conditions to get the
right keyshare prediction defaults.
Also add "curveSM2" near the end of the list, after the stronger ECX and
EC groups, but before FFDHE.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:08:17 2026
(Merged from https://github.com/openssl/openssl/pull/30113)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:08:10 2026
(Merged from https://github.com/openssl/openssl/pull/30113)
Also fine-tune docs and add tests.
Fixes: #30109
Fixes: CVE-2026-2673
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:08:03 2026
(Merged from https://github.com/openssl/openssl/pull/30113)
This patch fixes several const qualifiers byu adding where required.
warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
Since glibc-2.43 and ISO C23, the functions bsearch, memchr, strchr,
strpbrk, strrchr, strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr
that return pointers into their input arrays now have definitions as
macros that return a pointer to a const-qualified type when the input
argument is a pointer to a const-qualified type.
Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Feb 25 11:04:09 2026
(Merged from https://github.com/openssl/openssl/pull/30136)
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 25 11:02:07 2026
(Merged from https://github.com/openssl/openssl/pull/30103)
Fixes#16862
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 25 10:37:27 2026
(Merged from https://github.com/openssl/openssl/pull/30011)
The DESCRIPTION section had inconsistent naming - some algorithm names
incorrectly had the "EVP_PKEY-" prefix while others did not.
Rewrote the section to clearly separate:
- Algorithm names (e.g., SLH-DSA-SHA2-128s) using hyphens
- Key type identifiers (e.g., EVP_PKEY_SLH_DSA_SHA2_128S) using underscores
This matches the format used in EVP_PKEY-ML-DSA(7) and allows the names
to be used correctly in code.
Fixes#29329
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Feb 25 10:26:59 2026
(Merged from https://github.com/openssl/openssl/pull/29788)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 25 10:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/30076)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:15:08 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
We also disable warnings for now ro avoid realloc warning
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:15:06 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:15:04 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:15:02 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:15:00 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
This then however breaks for other reasons
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:14:58 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
This laudable goal, should it land, will be followed
with an issue raised to eat our own dogfood and find
every file with <crypto/asn1.h> added to it in this
commit, and change to the appropriate accessors,
which should be possible in most places we aren't
actually implementing things that change the values
Fixes: https://github.com/openssl/openssl/issues/29860
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:14:57 2026
(Merged from https://github.com/openssl/openssl/pull/29862)
The build is otherwise erroring out with -Werror
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Feb 25 09:58:37 2026
(Merged from https://github.com/openssl/openssl/pull/29468)
There are still a few casts away from const where things do not actually
end up mutating the object, we'll deal with that later.
Part of #28654 and #29117Fixesopenssl/project#1781
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Feb 25 09:58:35 2026
(Merged from https://github.com/openssl/openssl/pull/29468)
Fixes#29993
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 25 09:53:18 2026
(Merged from https://github.com/openssl/openssl/pull/30087)
Fixes#28343
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 21:19:39 2026
(Merged from https://github.com/openssl/openssl/pull/30128)
Another internal-use undocumented public api that should be a
candidate for deprecation.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 19:33:07 2026
(Merged from https://github.com/openssl/openssl/pull/30127)
These are undocumented and look to have only one internal use.
They should probably be deprecated with an eye to moving them
internal, but that's for later.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 19:33:01 2026
(Merged from https://github.com/openssl/openssl/pull/30127)
For #30052
For #30095
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 19:32:57 2026
(Merged from https://github.com/openssl/openssl/pull/30127)
cascades to constifying X509_get_pubkey() as well
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Feb 24 19:16:50 2026
(Merged from https://github.com/openssl/openssl/pull/30117)
and make ASN1_BIT_STRING_set_bit compute the unused bits of the
BIT_STRING.
The implicit trunction behaviour allows you to set a value without
keeping the unused bits consistent, using ASN1_STRING_set, and then
have it magically "fixed" to account for the unused bits in the last
octet on output.
As it turns out, after much searching, nothing is using this behavior,
As we now have the new ASN1_BIT_STRING_set1 to set the entire value
and keep the unused bits correct, we make ASN1_BIT_STRING_set_bit
also do the same. Now that both the setters change the object
correctly we remove the implicit trunctation in ossl_i2x_ASN1_BIT_STRING
and make the provided BIT_STRING argument const.
See discussion in https://github.com/openssl/openssl/issues/29185
and in https://github.com/openssl/openssl/issues/29117
For https://github.com/openssl/openssl/issues/29117
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 19:11:26 2026
(Merged from https://github.com/openssl/openssl/pull/29711)
These all took const, but returned non const, they should return const.
This then triggers constifying of a whole class of get_ext() functions.
Part of #28654 and #29117Fixes: openssl/project#1779
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 18:53:25 2026
(Merged from https://github.com/openssl/openssl/pull/29465)
X509_get0_distinguishing_id
X509_keyid_get0
X509_alias_get0
X509_CRL_get0_by_cert
X509_issuer_name_hash
X509_issuer_name_hash_old
X509_subject_name_hash_old
are all const corrected
And PKCS12_add_localkeyid
as a result
X509_getm_notBefore
X509_getm_notAfter=
are const "corrected" by making their argument non-const
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 16:32:45 2026
(Merged from https://github.com/openssl/openssl/pull/30036)
Now that we have a suppression file, lets make sure we keep it up to
date. Run a nightly job in CI that runs all our tests under valgrind
with our current suppression file, and fail if any new errors are
generated so that we can either address them or add them to the
suppression file
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Feb 24 15:11:19 2026
(Merged from https://github.com/openssl/openssl/pull/30003)
Valgrind found a legitimate leak that, somehow asan missed.
v2i_issuer_sign_tool, when creating a new issuer sign tool,
automatically creates the member utf8 asn1 string objects for us.
However, based on configuration, this function will also create its own
utf8 asn1 strings, which overwrite those initial allocations, creating a
leak.
We don't need to create those strings at all in this fuction, just make
sure the ISSUER_SIGN_TOOL_new function did it for us, by checking them
all for NULL
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Feb 24 15:11:16 2026
(Merged from https://github.com/openssl/openssl/pull/30003)
Running valgrind in CI triggered a few errors that local testing missed,
add those to the suppression file
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Feb 24 15:11:14 2026
(Merged from https://github.com/openssl/openssl/pull/30003)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:25 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:22 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
This reverts commit 8101ce1e36.
This bikeshed also broke the docs
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:20 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
(Use the now non-deprecated function)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:18 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:15 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:13 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:10 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:08 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:05 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:05:01 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:58 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:55 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:53 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:50 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:47 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:45 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:42 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:40 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:37 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:35 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:32 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:30 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:28 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:25 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:22 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:20 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:17 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:15 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:12 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:10 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:07 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:04 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:02 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:04:00 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:57 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:52 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:49 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:47 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:44 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
This adds the functionality to VERIFY_PARAM to separately add multiple
ip's and email addresses for verification purposes.
We then mark the unfortunate SSL_add1_host API which unfortunately
aquired a confusing "maybe add an IP address" behaviour as deprecated.
We replace this with SSL_set1_<dnsname, email, ip, ip_asc> and
SSL_add1_<dnsname, email, ip, ip_asc> to set the things in the SSL
corresponding to the VERIFY_PARAM funcitons.
Fixes: https://github.com/openssl/openssl/issues/28418
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Tue Feb 24 14:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/29612)
BSD, when initializing a pthread_cond_t or pthread_mutex_t may allocate
additional heap. If we don't call pthread_[cond|mutex]_destroy on them,
those allocations leak.
clean that up here.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Feb 24 12:52:59 2026
(Merged from https://github.com/openssl/openssl/pull/30094)
Transitively, this also requires the constification of OCSP_resp_get0_signer
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Feb 24 12:45:57 2026
(Merged from https://github.com/openssl/openssl/pull/30096)
The CONTRIBUTING.md and PULL_REQUEST_TEMPLATE.md files have been updated
to include guidelines on what makes a desirable commit message and
PR description.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/30075)
For #30050
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Feb 23 22:45:42 2026
(Merged from https://github.com/openssl/openssl/pull/30074)
for https://github.com/openssl/openssl/issues/30052
This is a blatent cheat. While I can get pretty close to getting
around cheating by cacheing extensions as X509 objects are created it's
too fragile at the moment. In a future with a better not-copying all
the things X509, we would endeavour to not need this.
In the meantime, in the interest of getting the public API ready to
do that, we instead make a blatent cheat in the internal function of
int ossl_x509v3_cache_extensions(const X509 *x);
Which in a future world we can work to make go away.
And then the public API all changes to const.
long X509_get_pathlen(const X509 *x);
int X509_check_ca(const X509 *x);
int X509_check_purpose(const X509 *x, int id, int ca);
long X509_get_proxy_pathlen(const X509 *x);
uint32_t X509_get_extension_flags(const X509 *x);
uint32_t X509_get_key_usage(const X509 *x);
uint32_t X509_get_extended_key_usage(const X509 *x);
onst ASN1_OCTET_STRING *X509_get0_subject_key_id(const X509 *x);
const ASN1_OCTET_STRING *X509_get0_authority_key_id(const X509 *x);
const GENERAL_NAMES *X509_get0_authority_issuer(const X509 *x);
const ASN1_INTEGER *X509_get0_authority_serial(const X509 *x);
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Feb 23 16:34:29 2026
(Merged from https://github.com/openssl/openssl/pull/30055)
The "error" parameter to 'X509_check_certificate_times' gets an X509 error
value, which isn't a OpenSSL ERR reason code. Unfortunately, this was
conflated.
This restores the behaviour in the places of conflation to something
similar enough to what was done before 'X509_check_certificate_times'
was implemented.
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Feb 23 15:43:21 2026
(Merged from https://github.com/openssl/openssl/pull/30088)
The main intention is to allow setting the MSG_NOSIGNAL flag to avoid
a crash on receiving the SIGPIPE signal.
Fixes#16399
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30044)
What is there is a trap. I fell into it. I was sad.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Feb 22 21:47:54 2026
(Merged from https://github.com/openssl/openssl/pull/30122)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Feb 22 17:57:56 2026
(Merged from https://github.com/openssl/openssl/pull/30079)
Update the X509 parameter to be const
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun Feb 22 17:55:12 2026
(Merged from https://github.com/openssl/openssl/pull/30090)
X509_verify_cert_times returns a verify error code,
so X509_verify_cert_error_string() must be used to
convert it to text.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Sun Feb 22 17:52:13 2026
(Merged from https://github.com/openssl/openssl/pull/30097)
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Feb 22 17:49:25 2026
(Merged from https://github.com/openssl/openssl/pull/30098)
when configuring with:
./Configure no-sskdf --strict-warnings
The build breaks as sskdf_new is defined but not used (as the same sskdf
file is used to implement x963kdf with a different new dispatch
function). i.e. we will build the file when sskdf is disabled but
x963kdf is enabled, omitting any use of sskdf_new
Easy fix, just gate the inclusion of sskdf_new on #ifndef
OPENSSL_NO_SSKDF.
Do the same for X963KDF, which has the same problem (thank you for
pointing that out @t8m)
Fixes#30105
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sun Feb 22 17:46:00 2026
(Merged from https://github.com/openssl/openssl/pull/30106)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:26:53 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
- Adding support for "curveSM2" ECDH
- Integrating EdDSA and SM2 signature support into existing ECDSA code.
This removes ~500 lines of duplicated code.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:26:44 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
Also some additional tests for other MLKEM hybrids.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:26:36 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
This extends sslapi test for SM2-based key exchange.
Also add comments for #endif to clearly mark disabled code blocks.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Sat Feb 21 13:26:27 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
This adds support for the "sm2sig_sm3" TLS 1.3 signature algorithm, the
"curveSM2" key exchange group (ECDH over SM2) and the associated
post-quantum/traditional (PQ/T) hybrid "curveSM2MLKEM768" key exchange.
The default key agreement group list is expanded to add two additional
PQ groups, immediately after X25519MLKEM768. These are the P-256-based
SecP256r1MLKEM768 and the SM2-based curveSMMLKEM768. Neither of the new
groups is a default client keyshare group, these would only come into
play after a server HRR, if for some reason X25519MLKEM768 is not
supported by the server, X25519 is not then the server's most
preferred group, and the server supports and prefers one of these
of X25519.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
In the default and FIPS provider dispatch tables use corresponding
macros instead of string literals.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
Most signature algorithms will ignore this parameter, but for SM2 this
makes it possible to set the RFC8998 distinguished identifier.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
When the version is TLS 1.3, this sets the SM2 distinguished identifier to
the RFC8998 specified value: "TLSv1.3+GM+Cipher+Suite".
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:39 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
This is needed for certificate verification to work correctly.
Removed unnecessary explicit instances of the distid in most tests, and
documentation.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:30 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
SM digest sign/verify context initialisation needs to set the
"compute_z_digest" flag earlier, before calling sm2sig_signature_init(),
to process the provided parameters, because otherwise attempts to set
the "distinguished identifier" will erroneously fail.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:19 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
It can be useful to know how many parameters matched a decoded field,
(or at least whether that number is non-zero).
Tne new `produce_param_decoder_with_count` generator produces code that
updates a count output variable.
In particular, an RSA parameter handler did not handle requests for only
unexpected parameter as gracefully as one might want. It can now
return early when none of the provided parameters are relevant.
[ The number reported is a count of matching parameter values, not a
count of the resulting decoded fields, so if a parameter key occurs
more than once, the count can be larger than the number of fields
actually set. ]
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Sat Feb 21 13:25:11 2026
(Merged from https://github.com/openssl/openssl/pull/29953)
Make the X509 argument to both functions const, as we don't modify the
object at all in these functions.
Again, these functions, while public, appear undocumented, and so I'm
omitting any HISTORY notes
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Feb 20 21:26:47 2026
(Merged from https://github.com/openssl/openssl/pull/30073)
Functions seem not documented, but exported.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Feb 20 17:07:41 2026
(Merged from https://github.com/openssl/openssl/pull/30082)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 20 14:16:40 2026
(Merged from https://github.com/openssl/openssl/pull/30059)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 20 10:11:21 2026
(Merged from https://github.com/openssl/openssl/pull/30066)
And also a few additional code cleanups.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 20 10:11:20 2026
(Merged from https://github.com/openssl/openssl/pull/30066)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 19 09:22:37 2026
(Merged from https://github.com/openssl/openssl/pull/30048)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 19 09:20:46 2026
(Merged from https://github.com/openssl/openssl/pull/30051)
strspn() is called on likely non-NUL-terminated BIO buffer.
Copy it and add NUL-termination before calling the function.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 19 09:17:54 2026
(Merged from https://github.com/openssl/openssl/pull/30050)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Feb 16 15:41:15 2026
(Merged from https://github.com/openssl/openssl/pull/29200)
Fixes DEF-02-010
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:16 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
Call SSL_set1_host() to apply the outer hostname to the certificate
validation.
Fixes DEF-02-009
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:14 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
Fixes DEF-02-006
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:13 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
Fixes DEF-02-005
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:11 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
Fixes DEF-02-002
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:10 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
Fixes DEF-02-001
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 11 17:19:08 2026
(Merged from https://github.com/openssl/openssl/pull/29593)
And further minor refactoring.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jan 8 09:59:56 2026
(Merged from https://github.com/openssl/openssl/pull/29439)
This gives us the start of the buffer in use for the PACKET.
We then use this information when calculating the TLS PSK binder.
Previously we were assuming knowledge about where the buffer starts.
However, with ECH, we may be using a different buffer to normal so it is
better to ask the PACKET where the start of the buffer is.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27776)
and includes a minimal demo for some of those APIs.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24738)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24738)
Modify both functions to accept and return a const X509, respectively.
Again, neither of these functions appear documented, so omitting the
HISTORY updates here, though we should look into why they are missing
docs.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Feb 20 16:27:15 2026
(Merged from https://github.com/openssl/openssl/pull/30072)
Previously, a malformed ASN.1 INTEGER in the CRL Number or Delta CRL Indicator
extension would cause a parse error but the CRL would not be explicitly
rejected. Existing code discards the error and continues, accepting a CRL it
cannot fully parse, unlike other libraries and implementations that reject the
CRL outright.
Malformed encoding suggests a corrupt or tampered CRL, data that cannot be
parsed cannot be trusted. Reject the CRL outright if either extension cannot be
decoded, regardless of whether the extension is marked critical. This prevents
silent soft-fail behavior where revoked certificates could pass validation
unchecked.
Fixes#27374
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Feb 20 16:24:44 2026
(Merged from https://github.com/openssl/openssl/pull/30024)
As part of the effort to not allow mutable X509 objects where they
aren't needed, constify the cert parameter for these two functions
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Feb 20 13:33:04 2026
(Merged from https://github.com/openssl/openssl/pull/30054)
These functions are exported, but undocumented.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Feb 20 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/30080)
Turn the X509 parameters to X509_check_trust and X509_TRUST_add into
consts.
Interesting side notes: X509_TRUST_add and some others that we're
modified as a result of this pr, are listed as public functions, but
have no documentation for them, and make doc-nits doesn't complain about
it. Unsure as to why, but we should probably look at that eventually
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Feb 20 13:04:04 2026
(Merged from https://github.com/openssl/openssl/pull/30071)
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Feb 19 15:11:25 2026
(Merged from https://github.com/openssl/openssl/pull/30028)
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Feb 19 15:11:20 2026
(Merged from https://github.com/openssl/openssl/pull/30028)
This adds TLS_SM4_GCM_SM3 and TLS_SM4_CCM_SM3
as defined in RFC 8998.
Fixesopenssl/project#1871
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Feb 19 15:11:15 2026
(Merged from https://github.com/openssl/openssl/pull/30028)
As part of our effort to not allow mutable x509 objects where they
aren't needed, constify the parameters to these two functions
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Feb 19 13:08:11 2026
(Merged from https://github.com/openssl/openssl/pull/30053)
The function print_keyspec in apps/cmp.c previously dereferenced the 'alg' pointer
without checking if it was NULL:
if (paramtype == V_ASN1_UNDEF || alg->parameter == NULL) {
In certain situations, the 'alg' pointer could be NULL, which may result in a null
pointer dereference.
This commit adds an explicit null check for 'alg' before dereferencing 'alg->parameter'
to ensure safe handling:
if (alg == NULL) {
BIO_puts(mem, "Key algorithm: <absent>\n");
break;
}
This prevents potential crashes when print_keyspec is called with a NULL algorithm
pointer, improving the robustness of the CMP application.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Thu Feb 19 12:56:01 2026
(Merged from https://github.com/openssl/openssl/pull/30046)
Check the return value of ASN1_parse_dump
Fixes: 6b167313f4 "Attribute certificate printing functions"
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Feb 19 12:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/30065)
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 19 10:14:06 2026
(Merged from https://github.com/openssl/openssl/pull/28076)
This has been documented as a deprecated option for
a long time, as we are not even certain this does what
was originally intended anymore, as it has no tests and
it's time of usefulness has long since past.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 19 10:09:33 2026
(Merged from https://github.com/openssl/openssl/pull/30033)
PR https://github.com/openssl/openssl/pull/30045
Fixed an oss-fuzz failure that occured because we feed random data into
the pkcs12 kdf, which sometimes results in a huge iteration count, that
leads to timeouts in oss-fuzz.
The fix was to simply limit the number of iterations that we go through
during derivation. This breaks the kdf of course, but it doesn't really
matter during fuzzing, because we don't expect random input data to
produce reasonable results, so no harm, no foul.
except.
We also, in our CI, build our fuzzer tests and run them through our
regular CI unit tests, during which we both provide valid data, and
expect valid results, and pr 30045 breaks that expectation.
The conventional wisdom is to simply skip unit tests that break under
these sorts of conditions (we do this for things like
70-test_quic_record.t already).
however, the tests that broke here are 25_test_x509, 30_test_evp,
80_test_pkcs12, and 90_test_store_cases. It seems like we would want to
keep testing those unless we absolutely have to skip them.
So instead, lets indicate that we are running the unit tests with an
environment variable, and check that variable when we have an
UNSAFE_FOR_PRODUCTION build, skiping the iteration clamp in pkcs12kdf if
it is. This allows us to continue running these unit tests, while still
getting the oss-fuzz runs to pass.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Feb 19 08:49:56 2026
(Merged from https://github.com/openssl/openssl/pull/30070)
Move TSAN definitions to threads_common.h to make them available
globally and introduce the ANNOTATE_BENIGN_RACE macro.
Apply this annotation to the state check in ossl_deferred_self_test()
to suppress a benign race warning from ThreadSanitizer, as the race
is intentional and accepted to avoid cpu contention.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/30009)
Replace calls to ossl_get_self_test_state() with direct access to
st_all_tests[].state in the FIPS self-test code.
Atomic reads are unnecessary in functions like FIPS_kat_deferred()
and SELF_TEST_kats_execute() because they are executed with the
relevant lock already held.
For ossl_deferred_self_test(), removing the atomic read avoids
contention. The common case is that tests are already passed. If a
race occurs, the function safely falls back to the locked path in
FIPS_kat_deferred() which re-verifies the state.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/30009)
Direct access to the FIPS self-test state array caused race conditions in
multi-threaded environments when checking or updating test status.
Introduce atomic accessor functions `ossl_get_self_test_state` and
`ossl_set_self_test_state`, backed by a global lock, to ensure thread-safe
state transitions. Replace all direct structure accesses with these new
functions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/30009)
The on-demand self-tests could race with deferred tests executing
concurrently in another thread.
Pass the FIPS global state to SELF_TEST_post() to allow locking
around the critical section where module integrity is checked and
test states are modified. This ensures thread safety when resetting
and executing tests.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/30009)
First, use BIO_sock_should_retry().
Second, clear BIO retry flags. Otherwise after an SSL_sendfile that
failed, no matter how many succeded after, the flags would still be up.
Fixes: #29742
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 18 23:31:24 2026
(Merged from https://github.com/openssl/openssl/pull/29744)
This is a documented error code for sendfile(2) in FreeBSD. Being on a
conservative side embrace into ifdef for now.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 18 23:31:21 2026
(Merged from https://github.com/openssl/openssl/pull/29744)
Before this change ktls_sendfile() is basically 1:1 wrapper around Linux
sendfile(2). FreeBSD sendfile(2) API is richer than Linux, and reducing
it down to Linux API loses meaningful data. Instead, make ktls_sendfile()
more like FreeBSD sendfile(2) and adopt Linux version to that.
With this change we will be raising BIO_should_retry() flag after a short
write due to lack of buffer space in a non-blocking socket on FreeBSD.
That will allow an application to tell a short write due to lack of buffer
space from a short write due to end of file. Before this change, the only
way to tell between these two kinds of short writes was to immediately
retry the operation.
This change allows to cut nearly in half the number of sendfile(2)
syscalls when sending a large file over a non-blocking socket on FreeBSD.
Fixes: #29742
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 18 23:31:18 2026
(Merged from https://github.com/openssl/openssl/pull/29744)
- Raise X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER when AKID is not present.
- Raise X509_V_ERR_EMPTY_AUTHORITY_KEY_IDENTIFIER when AKID has no attributes.
- Raise X509_V_ERR_AKID_ISSUER_SERIAL_NOT_PAIRED when authorityCertIssuer
and authorityCertSerialNumber fields are not paired.
RFC 5280 section 4.2.1.1: The authorityCertIssuer and authorityCertSerialNumber
fields are paired and MUST either both be present or both be absent.
- Issuer without serial is ambiguous, and serial without issuer is meaningless,
leading to unresolvable and misleading issuer identification.
Fixes#27114Fixes#27360Fixes#20027
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 18 18:17:03 2026
(Merged from https://github.com/openssl/openssl/pull/29971)
OSS-FUZZ tripped over a timeout:
https://issues.oss-fuzz.com/issues/477959320
It occurs because the pkcs12 data the fuzzer feeds into the mac
verification routine requests a large number of iterations (I think gdb
read it as 15346721 or some such), which causes very long processing
times while verifying the mac. This is something of an artificial
problem unique to the fuzzer, as the fuzzer contains a 60 second timeout
on any single test iteration.
Fix it by limiting the iteration count to 100 only when running the
fuzzer tests.
Fixesopenssl/srt#89
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 18 18:07:05 2026
(Merged from https://github.com/openssl/openssl/pull/30045)
The fix for sparcv9-mont.pl came from Andy Polyakov (@dot-asm)
Fixes#15587
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 18 18:02:33 2026
(Merged from https://github.com/openssl/openssl/pull/29948)
@beldmit found some odd fips behavior when running cms tests after
attempting to remove the EVP_get_digestbyname call from the find routine
in cms when doing certificate signer validation.
It was occuring because the cms app, being an applet in openssl uses the
app libctx to load all the provided configuration, which implies the
fips and base providers are loaded to that ctx. However, in the find
routine (part of cms), it only ever fetches algorithms from the default
libctx, leading to failed lookups, and consequently, CMS errors.
Fix it by using the appropriate libctx, which in this case can be
fetched from the SignerInfo data, which initializes its libctx member to
the app libctx in all cases.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Wed Feb 18 16:28:44 2026
(Merged from https://github.com/openssl/openssl/pull/30034)
This should use #define strings instead of duplication.
Not everything is defined, though.
Fixesopenssl/project#1875
Co-Authored-By: Claude Opus 4.6 Extended <noreply@anthropic.com>
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Wed Feb 18 16:01:18 2026
(Merged from https://github.com/openssl/openssl/pull/30042)
This affects the function OPENSSL_uni2utf8
which caused heap buffer overflow when certain
unicode characters are converted.
The current fix is incomplete and does only prevent the
crash by making OPENSSL_uni2utf8 return a NULL pointer.
But with this change the OPENSSL_uni2utf8 will return the
correct utf8 string instead of a NULL pointer.
Additionally we add a simple test case that demonstrates
the original CVE.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 18 15:46:35 2026
(Merged from https://github.com/openssl/openssl/pull/29997)
We check in relevant functions (SSL_handshake(), SSL_read(), etc.) whether
a new error has been pushed onto the error stack, and if so, memorise this
fact in the SSL structure. After that SSL_get_error() uses this memorised
information instead of checking the error stack itself.
Fixes#11889Fixesopenssl/project#1715
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 18 15:27:38 2026
(Merged from https://github.com/openssl/openssl/pull/29991)
This avoids redefinition of the type.
CLA: trivial
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 18 13:09:26 2026
(Merged from https://github.com/openssl/openssl/pull/29994)
As they were already documented as "should be considered deprecated".
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 18 13:06:18 2026
(Merged from https://github.com/openssl/openssl/pull/30031)
Its dead code on that platform since we don't use it
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Tue Feb 17 14:11:49 2026
(Merged from https://github.com/openssl/openssl/pull/29968)
https://github.com/openssl/openssl/issues/29845
Found that our hardware accelerated path doesn't work on big endian
systems, so make sure that we only use it when little endian is defined
We also noted that PPC_AES_GCM_CAPABLE gets defined to zero when the
capabilities register notes that the hardware isn't capable of the
needed instructions, but that still includes the asm path as
PPC_AES_GCM_CAPABLE is still defined.
Fix both issues
Fixes#29845
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Tue Feb 17 14:11:46 2026
(Merged from https://github.com/openssl/openssl/pull/29968)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 17 14:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/29782)
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Tue Feb 17 09:17:37 2026
(Merged from https://github.com/openssl/openssl/pull/29981)
SLH-DSA spends a significant amount of time performing large
numbers of hash calculations. Initially this was done using
EVP layer calls. The overhead is significant when there are thousands
of calls. To reduce this overhead the lower level sha functions for
KECCAK1600_CTX, SHA256_CTX and SHA512_CTX are accessed directly.
Profiling showed that a significant amount of time is spent in
"WOTS+ Public key generation" (FIPS 205 Section 5.1 Algorithm 6) so
this was inlined for shake and sha2 (See slh_wots_pk_gen_sha2()).
In FIPS 205 Section 11 there is a list of Hash functions.
Many of these functions use a pattern of
Trunc(n)(SHA256(PK.Seed || toByte(0, 64-n) || ....)
Because this operation is done many times, this prehashed
value is calculated once and stored into a low level SHA256_CTX or
KECCAK1600_CTX.
This can then be block copied to stack based KECCAK1600_CTX or
SHA256_CTX that we can then perform low level SHA functions on.
The md_len field is written to directly before the SHA final() to
control the length of the output (which avoids performing a memcpy).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28941)
SLH-DSA uses SHA-512 truncated to n when (n = 24 or 32).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28941)
This code was sitting inside the sha3 provider where it could not be
called directly.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28941)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/30001)
Fixes#27698
OpenSSL uses `;` as the path delimiter on Windows.
Update the manpage to state this explicitly instead of implying
`:` everywhere.
CLA: trivial
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sat Feb 14 23:54:32 2026
(Merged from https://github.com/openssl/openssl/pull/27844)
ERR_get_state(), ERR_remove_state() and ERR_remove_thread_state()
and useless SYS_F_ macros are removed.
Fixes#4654
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 14 23:07:56 2026
(Merged from https://github.com/openssl/openssl/pull/30005)
The shlibloadtest used atexit() handler to verify
library pinning works as expected. The libcrypto
no longer arms atexit handler which also used to
fire upon shlib unload. We can not use the atexit
mechansim to test shared library pinning.
If the shlibload test does not crash on exit, then
library pinning must work.
Fixesopenssl/project#1869
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:15:04 2026
(Merged from https://github.com/openssl/openssl/pull/29987)
The functions malloc, realloc and free are included from stdlib,
therefore no need for redundant malloc.h include.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:13:13 2026
(Merged from https://github.com/openssl/openssl/pull/29989)
Ensure consistent formatting in NAME sections across all EVP_SIGNATURE
documentation pages. The algorithm name should be bold (B<ALG>) rather
than EVP_PKEY, following the pattern:
"- The EVP_PKEY B<ALG> signature implementation"
Fixes#29328
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:09:54 2026
(Merged from https://github.com/openssl/openssl/pull/29789)
Don't use BIO_printf() where BIO_puts() will do.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/29677)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Fri Feb 13 14:55:20 2026
(Merged from https://github.com/openssl/openssl/pull/29884)
Update README.md to include OpenSSL 3.6 in the documentation links.
Update README-FIPS.md examples to use 3.6.0 as the latest release.
Fixes#29876
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Fri Feb 13 14:55:19 2026
(Merged from https://github.com/openssl/openssl/pull/29884)
Users reading the documentation for the -<cipher> option often
misunderstand the syntax. The notation "B<-I<cipher>>" renders as
"-cipher" with "cipher" in italics, leading users to think they
should type "-cipher aes-128-cbc" when the correct usage is
"-aes-128-cbc" (the cipher name directly as the option).
Update the documentation in openssl-genpkey, openssl-enc, and
openssl-pkey to explicitly state that the cipher name is prepended
with a hyphen and used directly as the option, not as an argument
to a "-cipher" flag.
Also add a reference to "openssl list -cipher-algorithms" to help
users discover available ciphers, and fix a typo in openssl-pkey
("and and" -> "and").
Fixes#26089
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Fri Feb 13 14:52:00 2026
(Merged from https://github.com/openssl/openssl/pull/29843)
These man page source files only used the output_do_not_edit_headers()
template function, which just generates a comment. Since they don't
use any meaningful templating, rename them from .pod.in to .pod and
remove the template line and build.info generation rules.
Files renamed:
- openssl-asn1parse.pod.in -> openssl-asn1parse.pod
- openssl-cmds.pod.in -> openssl-cmds.pod
- openssl-fipsinstall.pod.in -> openssl-fipsinstall.pod
- openssl-info.pod.in -> openssl-info.pod
- openssl-sess_id.pod.in -> openssl-sess_id.pod
- openssl-version.pod.in -> openssl-version.pod
- openssl-configutl and openssl-errstr .pod.in
Fixes#27760
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Fri Feb 13 14:50:16 2026
(Merged from https://github.com/openssl/openssl/pull/29838)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Feb 13 14:46:30 2026
(Merged from https://github.com/openssl/openssl/pull/29813)
The X509_ATTRIBUTE accessor functions were not const-correct, preventing
callers from usefully interacting with a const X509_ATTRIBUTE pointer.
Update the following functions to accept const X509_ATTRIBUTE * and
return const pointers where appropriate:
- X509_ATTRIBUTE_get0_object: returns const ASN1_OBJECT *
- X509_ATTRIBUTE_get0_type: returns const ASN1_TYPE *
- X509_ATTRIBUTE_get0_data: returns const void *
Also update dependent PKCS12 functions:
- PKCS12_get_attr_gen: returns const ASN1_TYPE *
- PKCS12_get_attr: returns const ASN1_TYPE * (deprecated)
- PKCS8_get_attr: returns const ASN1_TYPE *
Update all callers to use const pointers for the return values.
Fixes#29811
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Feb 13 14:46:26 2026
(Merged from https://github.com/openssl/openssl/pull/29813)
Verify that calling EVP_PKEY_sign_init_ex2() with a mismatched
key/signature algorithm (RSA key with ECDSA signature) does not leak
EVP_KEYMGMT references. The test repeats the operation 100 times so
that ASAN can detect accumulating leaks.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Feb 13 14:42:40 2026
(Merged from https://github.com/openssl/openssl/pull/29810)
PBKDF2 uses HMAC internally, which does not support eXtendable Output
Function (XOF) digests such as SHAKE128 or SHAKE256. Document this
limitation to prevent user confusion when attempting to use XOF
digests with PBKDF2.
Fixes#22877
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 14:39:07 2026
(Merged from https://github.com/openssl/openssl/pull/29792)
Document that when the psk_use_session callback is invoked multiple times
and wishes to return the same SSL_SESSION pointer, it must call
SSL_SESSION_up_ref() first since ownership is transferred on each call.
This prevents use-after-free errors from incorrect callback implementations.
Fixes#28267
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 14:36:50 2026
(Merged from https://github.com/openssl/openssl/pull/29771)
Add a new -defer_tests option to openssl fipsinstall and a corresponding
defer-tests configuration parameter for the FIPS provider.
This allows the execution of self-tests to be postponed until the
first time an algorithm is used, instead of running all tests
during module initialization. This reduces startup time.
Update the self-test framework to handle the new SELF_TEST_STATE_DEFER
state, ensuring deferred tests are skipped at load and run on demand.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Reorganize the FIPS self-tests to group them by complexity.
The new order groups tests so that more complex ones are executed before
less complex one when all tests are run on_demand, improving the odds
that lower level tests are implicitly executed as part of higher level
tests and therefore reducing the amount of time spent running redundant
tests.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
FIPS 140-3 IG 10.3.A.8 requires known-answer tests for KDFs. Some of these
tests for PBKDF2 use a low iteration count (e.g., 2) which is below the normal
security threshold and would otherwise fail.
This change checks if a PBKDF2 self-test is in progress and, if so, lowers the
minimum accepted iteration count to 2. This allows the required self-tests to
pass while maintaining the security check for normal operations.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Introduce `SELF_TEST_STATE_IMPLICIT` to handle recursive self-test calls
when an algorithm is used by another algorithm's self-test (e.g., KDF
using HMAC). This prevents unnecessarily running tests when they are
effectively covered by a parent test.
Refactor `SELF_TEST_kats` and `SELF_TEST_kats_execute` to unify
execution logic, dependency resolution, and RNG setup. Remove the
`deferred` flag from test definitions in favor of dynamic state
evaluation. Explicitly add a dependency for AES-128-ECB on AES-256-GCM.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Add a self test id to the self test definition structure. This is used as a
sanity check to ensure that a test's enum ID matches its index in the
`st_all_tests` array.
This helps prevent programming errors when adding, removing, or reordering
tests in the future, improving the robustness of the self-test mechanism.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
The FIPS module integrity check (HMAC-SHA256) is refactored to use the
generic Known Answer Test (KAT) framework instead of a standalone
function.
- Remove `integrity_self_test` and use `ST_ID_MAC_HMAC` with
`SELF_TEST_kats_single`.
- Add `self_test_mac` to `self_test_kats.c` to support MAC tests.
- Move HMAC test data to `self_test_data.c`.
- Rename the self-test type from "KAT_Integrity" to "KAT_Mac".
- Ensure on-demand tests reset state so they can be repeated.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Update the FIPS module to run self-tests on demand (deferred) rather
than on module load. Change the test definitions in self_test_data.c
from SELF_TEST_ONLOAD to SELF_TEST_DEFERRED.
Add calls to ossl_deferred_self_test() in the newctx functions for
ciphers, digests, signatures, KDFs, KEMs and DRBGs to trigger execution
upon first instantiation. Introduce CIPHER_PROV_CHECK and
DIGEST_PROV_CHECK macros in common headers to facilitate these checks.
Define dependencies for composite tests to ensure prerequisite tests
run when needed.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
The lock for the deferred FIPS self-tests was previously a static
global variable, initialized with CRYPTO_ONCE. This is problematic
when multiple library contexts are used in a single application.
This change moves the lock into the FIPS_GLOBAL structure, making it
per-library-context. The lock is now initialized when the FIPS
provider is initialized and freed when its context is torn down.
This improves encapsulation and avoids global state.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Some FIPS Known Answer Tests (KATs) rely on other cryptographic algorithms
that also have their own KATs. This change introduces a formal mechanism to
ensure these dependencies are met before a test is run.
A `depends_on` field is added to the self-test definition to declare
prerequisites. A new recursive function, `FIPS_kat_deferred_execute`,
traverses this dependency chain, executing any required tests first.
This new logic also prevents tests from being run multiple times if they are a
dependency for several other tests. The `FIPS_kat_deferred` function is
updated to use this new dependency-aware execution function.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Consolidate separate self-test data arrays into a single `st_all_tests`
array indexed by a new `self_test_id_t` enumeration.
This replaces string-based algorithm lookups with direct array indexing
for running self-tests, simplifying the code and state management. The
`FIPS_DEFERRED_TEST` structure and `self_test_data.h` file are removed,
and the FIPS provider and implementations are updated to use the new
ID-based API.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
The SELF_TEST_kats_single() function runs an individual FIPS Known Answer Test
(KAT) on demand. These tests require a deterministic random bit generator
(DRBG) to be properly initialized to function correctly.
This change ensures a dedicated DRBG is set up for the single test run. The
existing private RNG is saved before the test and restored afterward,
isolating the test's random context from the rest of the library.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Refactor the FIPS self-test Known Answer Test (KAT) data definitions to use a
single, unified structure.
A new generic `ST_DEFINITION` struct is introduced to replace the various
algorithm-specific `ST_KAT_*` structs. This new struct contains fields common
to all tests and uses a union to hold the parameters specific to each test
category (cipher, digest, KEM, etc.).
A helper `ST_BUFFER` struct is also added to combine data pointers and their
lengths, simplifying data handling. This refactoring makes the self-test
framework more consistent, easier to maintain, and more extensible.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
This commit refines the design for FIPS deferred self-tests by simplifying how
test equivalencies are handled.
The explicit `also_satisfies` list has been removed from the design. Instead
of manually listing which tests are satisfied by another, the new approach
relies on implicit discovery. When a high-level self-test runs, it records all
the underlying cryptographic algorithms that are invoked during its execution.
Upon successful completion of the high-level test, the tests for all recorded
algorithms are automatically marked as passed. This approach is more direct,
less error-prone, and removes the complex logic associated with the previous
explicit dependency lists.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
This causes linters to blow up
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
The Known Answer Test (KAT) data, previously in `self_test_data.inc`, is moved
into its own compilation unit, `self_test_data.c`. This separates the large
data definitions from the test execution logic.
This refactoring improves code organization and modularity. A new header,
`self_test_data.h`, is added to declare the data arrays for external linkage.
The shared data structure definitions are moved to `self_test.h` to be
accessible by both the test logic and the data files.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
Fix sloppy style that will break clang style detector later once
we rename the .inc file back to be a regular .c file.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
The keymgmt->newdata function does not accept params. We introduce a
newdata_ex function that does, and we use that instead as a thread local
to pass legacy objects to the default provider
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:28 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
Make sure that when we use ex_data on a low level object that also
works when used with a provider.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:27 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
As we did for RSA objects we do the same for DH objects.
Fixes#29942
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:25 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
As we did for RSA objects we do the same for EC_KEY objects.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:24 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
As we did for RSA objects we do the same for DSA objects.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:23 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
If a low level RSA object has been assigned a custom RSA_METHOD and is
then assigned to an EVP_PKEY object, then we still want the default
provider to use that RSA_METHOD. To ensure this occurs we pass the low
level object across the provider boundary. We can only get away with this
because it is the default provider.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:21 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
We want to test that if we use a custom DH_METHOD, then it still works
even when we use a provider.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:18 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
We want to test that if we use a custom EC_KEY_METHOD, then it still works
even when we use a provider.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:17 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
We want to test that if we use a custom DSA_METHOD, then it still works
even when we use a provider.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:16 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
We need to test that if you set a custom RSA_METHOD (or similar) on a
low level object (e.g. RSA) then it will be used even in a provider.
This test case was inspired by the reproducer given in #29702
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 07:58:14 2026
(Merged from https://github.com/openssl/openssl/pull/29960)
a wrapper around EVP_MD_fetch/EVP_CIPHER_fetch when engines are not
supported anymore. Let's remove the fallbacks that don't do anything
useful
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Thu Feb 12 18:22:57 2026
(Merged from https://github.com/openssl/openssl/pull/29969)
The documentation incorrectly stated that RSA_set_method() returns
a pointer to the old RSA_METHOD. In fact, it returns int (1 for success).
The SYNOPSIS correctly shows 'int RSA_set_method(...)' but the
RETURN VALUES section was wrong.
Fixes#13884
CLA: trivial
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Feb 12 15:18:38 2026
(Merged from https://github.com/openssl/openssl/pull/29916)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Feb 11 22:35:08 2026
(Merged from https://github.com/openssl/openssl/pull/29978)
Document that passing NULL to SSL_set_client_CA_list() does not clear
the CA list; instead, the SSL_CTX's setting is used. Also note that
passing an empty stack created with sk_X509_NAME_new_null() clears the
per-connection client CA list, but during the handshake the generic CA
list (set via SSL_CTX_set0_CA_list()) may still be used as a fallback.
Fixes#10795
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Feb 11 20:02:47 2026
(Merged from https://github.com/openssl/openssl/pull/29917)
memory blocks
Co-authored-by: Matt Caswell <matt@openssl.org>
Co-authored-by: Tomáš Mráz <tm@t8m.info>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 11 19:40:10 2026
(Merged from https://github.com/openssl/openssl/pull/29966)
OSSLINAPPL (OpenSSL Is Not A Public Portability Layer)
I blame @nhorman and @sashan, who made me update the adjacent
documentation, and it was sitting there like an unloved and
ignored chronically ill pet with no hope for any future
quality of life.
Since this really does not need an alternative API or a
deprecation stragegy, we can simply remove it. Anyone
who was using this can use libc atexit() if they must.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Wed Feb 11 17:37:33 2026
(Merged from https://github.com/openssl/openssl/pull/29874)
Ensure that all the source files are formatted with the current
.clang-format configuration, to avoid spurious clang-format checker
errors when arbitrary files are touched.
Complements: 1b0f21f055 "Implementing store support for EVP_SKEY"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Feb 11 07:35:04 2026
(Merged from https://github.com/openssl/openssl/pull/29852)
Skip the OPENSSL_cleanup() call from the openssl app and in tests
when OSSL_USE_VALGRIND environment variable is set.
This can be used in the CI to test the valgrind suppressions.
Builds upon https://github.com/openssl/openssl/pull/29573
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 10 14:00:54 2026
(Merged from https://github.com/openssl/openssl/pull/29575)
our fuzzer caught this:
https://github.com/openssl/openssl/actions/runs/21625445341/job/62324333796
Overnight.
We're getting a heap buffer overrun in the SRTP KDF.
Its caused by the fact that the fuzzer will occasionally generate salt
parameters that are very small, which passes the
OSSL_PARAM_get_octet_string function, but isn't long enough to be a
valid salt. Because of this, when we actually do the key derivation,
the SRTPKDF function assumes the salt is long enough and blindly
attempts to copy KDF_SRTP_SALT_LEN (14) bytes from the fetched parameter
into a local buffer, resulting in an overrun.
Fix it by checking the parameter length in the ctx_set_params method for
SRTPKDF, and if the octet string value is less than the required amount,
return an error to fail the ctx_set_params call.
While we're at it, based on review suggestions, also check that the
provided key parameter matches the requested cipher's expected key
length
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29938)
Add documentation for EC_curve_nist2nid() and EC_curve_nid2nist()
functions which were previously undocumented. These functions convert
between OpenSSL NIDs and NIST standardized curve names (e.g., "P-256",
"P-384", "P-521" for prime field curves and "B-163", "K-233", etc.
for binary field curves).
The documentation includes:
- Function prototypes in the SYNOPSIS section
- Detailed descriptions explaining the purpose and behavior
- Examples of NIST curve names
- Return value documentation
Fixes#29180
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Mon Feb 9 09:59:04 2026
(Merged from https://github.com/openssl/openssl/pull/29341)
-wholename is mostly alias to -path, and -path is more
portable. E.g. -wholename does not exist on NetBSD.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Feb 9 09:53:10 2026
(Merged from https://github.com/openssl/openssl/pull/29944)
- Older versions of, e.g., the FIPS provider report the minimum
TLS version of the FFDHE groups as TLS 1.3, but we now need to
support these in TLS 1.2.
- Older OpenSSL runtimes may not be prepared to support the FFDHE groups
in TLS 1.2.
Therefore, instead of changing the default and FIPS providers to
advertise these groups as TLS 1.2 compatible, leave the capabilities
unchanged, and instead adjust the min(d)tls value when processing the
provider's capabilities in the new runtime.
This ensures cross-compatibility with everything except previous master
branch dev snapshots, but that's not a concern.
Fixes: #29958
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Feb 9 08:53:54 2026
(Merged from https://github.com/openssl/openssl/pull/29962)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Feb 7 18:11:19 2026
(Merged from https://github.com/openssl/openssl/pull/29640)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Feb 7 18:11:16 2026
(Merged from https://github.com/openssl/openssl/pull/29640)
Now that ossl_bsearch is capable of using a thunking function, lets
create a thunking function to use for the STACK_OF macros.
The problem we're addressing is one that gives rise to ubsan issues.
clang-16 forward have a ubsan test that confirms that the target symbol
that we call through a pointer matches the type of the pointer itself.
for instance
int foo(void *a, void *b)
{
...
}
int (*fooptr)(char *ac, int *bc) = foo;
fooptr(&charval, &intval);
is strictly speaking in C undefined behavior (even though in normal
operation this works as expected). Newer compilers are strict about
this however, as several security frameworks operate with an expectation
that this constraint is met.
See https://github.com/openssl/openssl/issues/22896#issuecomment-1837266357
for details.
So we need to create a thunking function. The sole purpose of this
thunking function is to accept the "real" comparison function for the
STACK_OF macros, along with the two items to compare of the type that
they are passed as from the calling function, and do the convervsion of
both the comparison function and the data pointers to the types that the
real comparison function expects
So we:
1) Modify the DEFINE_STACK_OF macros to create this thunking function
2) Add an OPENSSL_sk_set_cmp_thunks api to set the comparison function
3) modify the requisite places in the stack code to use the thunking
function when available
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Feb 7 18:11:14 2026
(Merged from https://github.com/openssl/openssl/pull/29640)
Add the initial groundwork to allow for the use of a thunking function
with bsearch. Normally our comparison function signature doesn't match
the type of the pointer we call it through, leading to ubsan errors,
this lets those signatures match and gives us a place to do the proper
casting
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Feb 7 18:11:11 2026
(Merged from https://github.com/openssl/openssl/pull/29640)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Feb 7 13:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/29932)
- Fix "and attempt" to "an attempt"
- Fix "BIO_BIN_NORMAL" typo to "BIO_BIND_NORMAL"
- Add missing B<> formatting around BIO_BIND_NORMAL and BIO_RR_ACCEPT
- Fix "at then end" to "at the end"
- Fix incomplete sentence about BIO_should_io_special()
- Update copyright year
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Fri Feb 6 13:34:18 2026
(Merged from https://github.com/openssl/openssl/pull/29910)
Since curl dropped support for using the OpenSSL quic stack, we have no
use for it anymore in our interop testing. Replace it with our own
http3 demonstration client.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Feb 6 12:46:26 2026
(Merged from https://github.com/openssl/openssl/pull/29922)
In order to use our http3 demo to do interop testing, said demo needs to
be able to handle multiple requests and responses written to specific
output files.
Add that code here, allowing us to specify optionally a list of requests
on the command line to send to the server, as well as a download
directory, so that requests made get written locally to the same name as
the request in the specified download directory.
while we're at it, also clean up the code infrastructure to use SSL_poll
to do read-ready checking, rather than iterating/mutating the internal
hash table, which is questionable to do (i.e. we shouldn't be removing
elements from the hash table while iterating over it).
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Feb 6 12:46:24 2026
(Merged from https://github.com/openssl/openssl/pull/29922)
Partially fixes issue in Discussion 22861
AES-WRAP pad is documented as only working for non streaming cases.
It did not however enforce this, so a user could potentially
wrap something incorrectly without an error and then not be able to
unwrap it without an error. The code now checks that update is only
called once.
An internal function returned an int which could be negative for bad
input values, and the return value was assigned to a size_t which
ignored the error condition.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29940)
Previously running the commandline "openssl enc -id-aes256-wrap-pad ...'
with a large PQ private key failed since AES-WRAP is not streamable,
and multiple calls to CipherUpdate() are not allowed. Increasing the
size causes CipherUpdate() to only be called once.
The size of the buffer has been changed from 4K to 8K.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29940)
(Your choice of G and A words)
This installs a global destructor if we have destructor support.
The global destructor does nothing and immediately returns under
normal operation. If a global flag indicating that global cleanup
is wanted, it does what OPENSSL_cleanup() used to do.
OPENSSL_cleanup() is then modified to set the global flag indicating
that global cleanup is wanted. At this point if we have destructor
support, it immeditely returns. If we do not have destructor support,
it manually calls the destructor function (meaning without destructor
support it does exactly what it used to do).
This ensures that if we have destructor support, the actions of an
OPENSSL_cleanup() requested by an application will only happen
after any subordinate library destructors which could call into
OpenSSL functions have already run.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 19:19:17 2026
(Merged from https://github.com/openssl/openssl/pull/29721)
In providers/applications that create custom libctx'es via
OSSL_LIB_CTX_new, its possible, if the default provider has never been
initaialized during the lifetime of the linked libcrypto, that we
actually wind up creating the default libctx when we free the
aforementioned custom libctx via, as an example:
legacy_teardown->
OSSL_LIB_CTX_free->
ossl_lib_ctx_is_default->
get_default_context->
get_thread_default_context->
default_context_do_init
While this isn't catastrophic, its needless, and in some cases has the
potential to leak memory (for instance if a provider is loaded and
unloaded repeatedly in an environment in which the provider is linked to
libcrypto.so while the calling application is statically linked to
libcrypto.a
Its also fairly easy to clean up, by adding an internal parameter to
gate the creation of the default libctx on the request of the caller, so
do that here
Fixesopenssl/project#1846
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Feb 5 17:08:13 2026
(Merged from https://github.com/openssl/openssl/pull/29830)
This patch fixes several const specifiers and unneeded casts
(visible with non-default const-qual warning).
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:13:46 2026
(Merged from https://github.com/openssl/openssl/pull/29800)
Also added a couple of missing markdown quotes around strings with
internal liternal underscores. More remain...
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:09:46 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
When the TLS max version is TLS 1.2, include supported RFC7919 FFDHE
groups in the supported_groups extension, provided we support at least
one DHE key exchange ciphersuite.
Also skip the EC point formats extension when the minimum (D)TLS version
is greater than 1.2. That extension is obsolete as of (D)TLS 1.3.
Finally, folded some extant long lines from the previous RFC7919 commits.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:09:43 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
Before this commit, the logic for generating a temporary DH key for DHE
cipher suites is the following:
1) If dh_tmp_auto is set (see SSL_set_dh_auto), the SSL server
automatically selects a set of DH parameters (P and G) appropriate
for the security level of the cipher suite. The groups are taken from
IKE (RFC 2409 and RFC 3526).
2) Otherwise, if the user provided a pre-generated set of DH parameters
(SSL_set0_tmp_dh_pkey), those parameters are used.
3) Finally, if neither 1) or 2) are applicable, a callback function can
be set using SSL_set_tmp_dh_callback, which will be invoked to
generate the temporary DH parameters. From OpenSSL 3.0, this
functionality is deprecated.
4) Using the parameters from step 1-3, an ephemeral DH key is
generated. The parameters and the public key are sent to the client.
The logic above is updated by inserting an additional step, prior to
step 1:
0) If tls1_shared_group returns any shared known group between the
server and the client, the DH parameters associated with this group
are selected.
This is still compliant with RFC7919, as the server will already have
checked the Supported Groups extension during the ciphersuite selection
process (implemented in the previous commit).
Now, the tests need to be updated: By default, the TLS 1.2 server will
default to RFC7919 groups. To bypass this behavior, the supported groups
on the client side is set to "xorgroup", ensuring that the client does
not advertise any FFDHE group support and the server falls back to the
old logic.
An additional test is also added to ensure that the TLS 1.2 server does
select the right group if the client advertises any of the RFC7919
groups.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:09:41 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
RFC 7919 states:
If a compatible TLS server receives a Supported Groups extension from
a client that includes any FFDHE group (i.e., any codepoint between
256 and 511, inclusive, even if unknown to the server), and if none
of the client-proposed FFDHE groups are known and acceptable to the
server, then the server MUST NOT select an FFDHE cipher suite.
We implement this behavior by adding a new function that checks this
condition as its inverse: only select FFDHE cipher suites if at least
one of the client-proposed FFDHE groups is known and acceptable, or
if the client did _not_ send any FFDHE groups.
Also add a test to verify two possible outcomes:
1) The client proposes FFDHE and non-FFDHE ciphersuites -> the server
will select a non-FFDHE ciphersuite.
2) The client only proposes FFDHE ciphersuites -> the server will end
the connection.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:09:40 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
Update tls1_shared_group to allow filtering for FFDHE and/or ECDHE
groups. This will be used for implementing RFC 7919 groups support in
the TLS 1.2 server. As defined in RFC 7919:
Codepoints in the "Supported Groups Registry" with a high byte of
0x01 (that is, between 256 and 511, inclusive) are set aside for
FFDHE groups
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 09:09:38 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
This patch explicitly defines the value `SIO_UDP_NETRESET` according to
both what Windows and ReactOS does.
Fixes: #29818.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb 5 08:54:17 2026
(Merged from https://github.com/openssl/openssl/pull/29826)
This patch fixes several const specifiers
(visible with non-default const-qual warning).
- Functions like SSL_set_tlsext_host_name takes
non-cost hostname parameter.
- packet buffer is read in BIO_read, so it
cannot be const
The rest is missing const specifiers where casting
to non-cost is not needed.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Feb 4 19:49:15 2026
(Merged from https://github.com/openssl/openssl/pull/29796)
We accidentally introduced a use of IPV6_PMTUDISC_PROBE without checking
if it was defined in
https://github.com/openssl/openssl/pull/28809
leading to build failures on systems that don't define it. Fix that.
Fixes#29903
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Feb 4 19:23:14 2026
(Merged from https://github.com/openssl/openssl/pull/29927)
Fixes: #29883
Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Feb 4 15:55:47 2026
(Merged from https://github.com/openssl/openssl/pull/29924)
This patch fixes several const specifiers and undeeded
casts (visible with non-default const-qual warning).
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 3 17:26:31 2026
(Merged from https://github.com/openssl/openssl/pull/29799)
Ml-dsa provider module requires der_digests.h which is generated
from der_digets.h.in. The dependency must be explicitly set in
build.info otherwise the .h file is missing when
providers/common/der/der_ml_dsa_key.c gets compiled.
The issue seems to affect only make found in base system on OpenBSD.
gnu-make (a.k.a gmake) is not affected.
It got introduced by #175cda569d
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Tue Feb 3 17:13:36 2026
(Merged from https://github.com/openssl/openssl/pull/29853)
This patch fixes several const specifiers
(visible with non-default const-qual warning).
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Feb 3 14:12:00 2026
(Merged from https://github.com/openssl/openssl/pull/29798)
Document that EVP_CIPHER_get_params(), EVP_CIPHER_CTX_get_params() and
EVP_CIPHER_CTX_set_params() return 1 for success and 0 for failure.
Fixes#29725
CLA: trivial
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Feb 3 09:51:47 2026
(Merged from https://github.com/openssl/openssl/pull/29779)
The previous wording "arrays are indexed by numbers" was misleading
as it suggested direct array indexing. Clarify that OSSL_DISPATCH
entries contain a function_id field that identifies the function.
Fixes#27125
CLA: trivial
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Feb 3 09:48:02 2026
(Merged from https://github.com/openssl/openssl/pull/29769)
The `SSL_CONF_CTX_set_flags` function did not prevent setting both
`SSL_CONF_FLAG_CMDLINE` and `SSL_CONF_FLAG_FILE` flags, which is an
invalid combination. This commit adds a check to prevent this and
updates the documentation to clarify that only one of these flags
can be set.
A new test case is also added to verify the correct behavior.
Fixes https://github.com/openssl/openssl/issues/15508
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 3 09:40:04 2026
(Merged from https://github.com/openssl/openssl/pull/29752)
The old Perl tool no longer exists, mention clang-format
and utilities.
Fixes: https://github.com/openssl/project/issues/1770
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Feb 3 09:07:35 2026
(Merged from https://github.com/openssl/openssl/pull/29755)
Additional ASN.1 parsing errors are now raised to the error stack,
allowing invalid CRLs to be rejected early with detailed error messages.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 3 09:02:15 2026
(Merged from https://github.com/openssl/openssl/pull/29750)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Tue Feb 3 08:50:53 2026
(Merged from https://github.com/openssl/openssl/pull/29679)
As mentioned by Viktor Dukhovni, the desired behaviour is:
The current_crl is NULL when the running callback invocation is about errors
unrelated to validation failures via a particular CRL a user may want to
report the issuer of.
The current_crl is (whenever possible) not NULL when reporting errors
specifically related to that CRL.
The problem with this happens when we call check_crl with something that
is not what current_crl is set to. We can potentially enter the time check
code, and we then need to call the callback with the certificate that
failed the time check which is not current_crl.
Correct this by removing the dance in the time check code, and always
setting current_crl whenver we call check_crl.
This means that when we are considering a delta crl, we report the
correct crl to the callback, instead of possibly handing them NULL
(if they get called after a failing time check clobbers it), or the
non-delta crl (because we are looking at a delta while having
current_crl set to crl - which was why we had the dance in the time code
to begin with. We don't need to change current_crl in the time check
code if we always have current_crl set to the thing we are evaluting.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 3 08:50:52 2026
(Merged from https://github.com/openssl/openssl/pull/29679)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Feb 3 08:47:06 2026
(Merged from https://github.com/openssl/openssl/pull/29675)
Otherwise there is mixing of ELFv1 ABI and ELFv2 ABI directives
and PPC64 big endian builds fail.
Fixes#29815
Signed-off-by: Danny Tsen <dtsen@us.ibm.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Feb 3 08:39:50 2026
(Merged from https://github.com/openssl/openssl/pull/29827)
test happy.
Fixesopenssl/project#1849
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Mon Feb 2 16:50:45 2026
(Merged from https://github.com/openssl/openssl/pull/29866)
As part of 6aaac9dd388a64d0f511544496608693e1105d13 in
https://github.com/curl/curl.git
Curl dropped support for using the quic-tls interface to use our quic
stack. Because our interop testing relies on using curl to do testing,
our builds broke.
Until we can find an alternate client to do https transfers over
http3/quic, we need to back off our quic build point to a commit prior
to the above so we can maintain our interop testing.
Long term, we need to enhance our own http3 demo client to support the
download/resumption/etc features that we need for interop. We're
tracking that effort in:
https://github.com/openssl/project/issues/1850Fixesopenssl/project#1848
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Fri Jan 30 12:20:11 2026
(Merged from https://github.com/openssl/openssl/pull/29857)
valgrind gripes about this, as its possible to reach the TEST_mem_eq
test without ever having initalized the buffer
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jan 29 16:37:35 2026
(Merged from https://github.com/openssl/openssl/pull/29573)
Passing uninitalized data to a syscall result in valgrind warnings, and
probably shouldn't be done anyway. Fix that
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jan 29 16:37:32 2026
(Merged from https://github.com/openssl/openssl/pull/29573)
Some tests (liek the mem_alloc and abort tests do things with malloc
intentionally as sanity checks that valgrind complains about, and so we
just shouldn't run those tests under valgrind at all
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jan 29 16:37:30 2026
(Merged from https://github.com/openssl/openssl/pull/29573)
As part of our effort to provide a supression file for valgrind that we
can maintain, we should have the ability to run our tests under
valgrind.
Add an environment variable OSSL_USE_VALGRIND to prefix all our app and
test executions with the valgrind tool so that we can run it
automatically
Fixesopenssl/project#1801
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jan 29 16:37:26 2026
(Merged from https://github.com/openssl/openssl/pull/29573)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jan 29 14:22:55 2026
(Merged from https://github.com/openssl/openssl/pull/29817)
This fixes#29808.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jan 29 14:22:50 2026
(Merged from https://github.com/openssl/openssl/pull/29817)
The KDSA instruction can operate in 2 different modes:
- Deterministic mode - nonce 'k' is supplied by user.
- Non-deterministic mode - nonce 'k' is randomly generated by the instruction
itself.
When running in the FIPS-Module, do not use KDSA's non-deterministic mode,
but generate the nonce 'k' using OpenSSL's random number generator. This
ensures that the nonce is generated using a FIPS-approved random number
generator.
It also makes the FIPS KAT tests work, because those use a pre-setup
deterministic random number generator to produce deterministic ECDSA
signatures even for non-deterministic mode.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29754)
The set1_groups and set1_curves functions do not modify their input
arrays, so the documentation should reflect const-correct signatures.
Fixes#27422
CLA: trivial
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29762)
Document that the returned pointer is internal, reference count is not
incremented, and should not be freed. Mention SSL_CTX_up_ref() for
callers who need to retain the SSL_CTX.
Fixes#28298
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29767)
Add DH_check_pub_key to NAME and SYNOPSIS sections. Fix typo where
DH_check_params() was incorrectly written instead of DH_check_params_ex()
in the description of the _ex functions.
Also remove DH_check_pub_key from util/missingcrypto.txt since it is
now documented.
Fixes#8473
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29768)
The "key" parameter documentation referenced a non-existent "algorithm"
parameter. Change to reference the actual "cipher" and "digest" parameters.
Fixes#12580
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29766)
The function can return on ctrl2params() returning 0 without freeing
the allocated memory associated with the got pointer. Fix it by jumping
to the err label that performs the cleanup instead of returning
immediately.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1680647
Fixes: 9c73843141 "Add support for CSHAKE."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jan 28 12:57:04 2026
(Merged from https://github.com/openssl/openssl/pull/29757)
ctx is dereferenced before NULL check to obtain libctx. Fix it
by moving the dereference after the NULL check.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1680648
Fixes: fe67753da4 "Add SRTPKDF implementation"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jan 28 12:57:00 2026
(Merged from https://github.com/openssl/openssl/pull/29757)
b->ptr cannot be NULL, so, the check is not needed, drop it.
Reported by Coverity as a potential NULL dereference in ctx->ibuf_len
access.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1680636
Fixes: f17230ae6c "Fix of EOF and retry handling in BIO implementations"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jan 28 12:56:56 2026
(Merged from https://github.com/openssl/openssl/pull/29757)
Co-authored-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jan 27 20:43:01 2026
(Merged from https://github.com/openssl/openssl/pull/29648)
ubsan reports an error in the free callback function for
OPENSSL_sk_pop_free.
Need to add a thunking shim to cast the pointer data types to their
proper types
Fixes#29616
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jan 27 17:25:34 2026
(Merged from https://github.com/openssl/openssl/pull/29690)
as a particular type
Issue was reported in ossl_ess_get_signing_cert but is also present in
ossl_ess_get_signing_cert_v2.
Fixes: https://github.com/openssl/srt/issues/61
Fixes CVE-2025-69420
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:53:36 2026
When ctx->stream (e.g., AES‑NI or ARMv8 CE) is available, the fast path
encrypts/decrypts full blocks but does not advance in/out pointers. The
tail-handling code then operates on the base pointers, effectively reprocessing
the beginning of the buffer while leaving the actual trailing bytes
unencrypted (encryption) or using the wrong plaintext (decryption). The
authentication checksum excludes the true tail.
CVE-2025-69418
Fixes: https://github.com/openssl/srt/issues/58
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:48:35 2026
pre-decompression allocation.
The patch was proposed by Tomas Dulka and Stanislav Fort (Aisle Research).
Fixes: CVE-2025-66199
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:45:21 2026
When a FIO_f_linebuffer is part of a bio chain, and the next BIO
preforms short writes, the remainder of the unwritten buffer is copied
unconditionally to the internal buffer ctx->obuf, which may not be
sufficiently sized to handle the remaining data, resulting in a buffer
overflow.
Fix it by only copying data when ctx->obuf has space, flushing to the
next BIO to increase available storage if needed.
Fixesopenssl/srt#48
Fixes CVE-2025-68160
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:41:40 2026
Previously input was silently truncated at 16MB, now if the input is
longer than limit, an error is reported.
The bio_to_mem() apps helper function was changed to return 0 or 1,
and return the size of the result via an output size_t pointer.
Fixes CVE-2025-15469
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:37:41 2026
The keylength value must be present and we accept
EVP_MAX_MD_SIZE at maximum.
The salt ASN.1 type must be OCTET STRING.
Fixes CVE-2025-11187
Reported by Stanislav Fort (Aisle Research) and Petr Simecek (Aisle Research).
Reported independently also by Hamza (Metadust).
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Alicja Kario <hkario@redhat.com>
MergeDate: Mon Jan 26 16:14:15 2026
There is no reason to run it in forks.
Similar to 6e5ce1ebb5.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 15:47:57 2026
(Merged from https://github.com/openssl/openssl/pull/29660)
The Authority Key Identifier's serial number field is an ASN1 integer, so use
the appropriate i2s_ASN1_INTEGER function instead of i2s_ASN1_OCTET_STRING
for string conversion. This fixes handling of negative serial numbers
which were previously displayed incorrectly.
While negative serial numbers are not RFC-compliant, we want to process
existing CRLs and certificates that may contain them, as this does not cause
any security issues. Rejecting invalid serial numbers during
generation is out of scope for this change.
Fixes#27406
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 15:29:33 2026
(Merged from https://github.com/openssl/openssl/pull/29717)
The functions X509V3_get_section() and X509V3_get_string() contain a
redundant null check after an identical check has already guaranteed
that the function pointer (ctx->db_meth->get_section / get_string) is
non-NULL. As a result, the final 'return NULL;' statement is unreachable.
This change removes the redundant condition and the dead code, improving
code clarity and eliminating warnings from static analyzers.
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jan 26 15:28:01 2026
(Merged from https://github.com/openssl/openssl/pull/29692)
Fixes#4952
Co-authored-by: Pauli <ppzgs1@gmail.com>
Co-authored-by: Tomáš Mráz <tm@t8m.info>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 15:26:21 2026
(Merged from https://github.com/openssl/openssl/pull/29646)
Unlike SHAKE this has default values set for the xof length.
CSHAKE uses either SHAKE or KECCAK[c] depending on whether
custom strings are set or not. If either string is set, it encodes
the strings and uses KECCAK[c], otherwise it behaves the same as
SHAKE (without the default xof length problem).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Jan 23 14:07:53 2026
(Merged from https://github.com/openssl/openssl/pull/28432)
This warning does not play well in combination with sanitizers
and its value is dubious. Instead of complicated decisions
based on configuration flags just remove it from global list.
Fixes: #29673
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Jan 23 14:00:29 2026
(Merged from https://github.com/openssl/openssl/pull/29714)
Otherwise UAF and doublefree appears when the duplicate
is freed.
Reported by Tomas Dulka and Stanislav Fort (Aisle Research)
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jan 23 10:37:36 2026
(Merged from https://github.com/openssl/openssl/pull/29707)
Otherwise UAF and doublefree appears when the duplicate
is freed.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jan 23 10:37:34 2026
(Merged from https://github.com/openssl/openssl/pull/29707)
When resuming session with the extended master secret support
dropped we should use SSL_AD_HANDSHAKE_FAILURE instead of
SSL_AD_ILLEGAL_PARAMETER according to the RFC7627 section 5.
Fixes#9791
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jan 23 10:33:12 2026
(Merged from https://github.com/openssl/openssl/pull/29706)
In compliance with RFC 3711, Section 4.3.3
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Fri Jan 23 10:19:32 2026
(Merged from https://github.com/openssl/openssl/pull/29435)
The yaml for the check-news-changes CI job had an error in the step
conditional that prevented skipping the check if the
no_news_changes_needed flag was set. Fix that.
While we're add it, also add some debug code so that we can better see
what the checks are looking at during the CI job.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 22 17:19:07 2026
(Merged from https://github.com/openssl/openssl/pull/29705)
Added handling for negative length in read functions.
Fixesopenssl/project#1739
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 22 17:12:37 2026
(Merged from https://github.com/openssl/openssl/pull/29401)
When ZLIB_SHARED is defined and DSO_load() fails to load the zlib
library, ossl_comp_zlib_init() incorrectly returns 1 (success) while
leaving all function pointers (p_compress, p_uncompress, etc.) as NULL.
This causes COMP_zlib() and COMP_zlib_oneshot() to return valid-looking
COMP_METHOD pointers, but when these methods are used (e.g., during
TLS 1.3 certificate decompression), the NULL function pointers are
dereferenced, causing a SIGSEGV crash.
The bug occurs because the NULL pointer check (lines 297-303) was inside
the `if (zlib_dso != NULL)` block, so it was skipped entirely when
DSO_load() returned NULL.
The fix moves the NULL pointer check outside the conditional block,
consistent with how c_brotli.c and c_zstd.c handle this case. Now if
the DSO fails to load, all function pointers remain NULL, the check
catches this, and the function correctly returns 0 (failure).
This also fixes an incorrect cast of p_uncompress from compress_ft to
the correct uncompress_ft type.
PoC demonstrating the bug: https://github.com/SiteRelEnby/openssl-zlib-pocFixes#23563
CLA: trivial
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 22 17:00:50 2026
(Merged from https://github.com/openssl/openssl/pull/29699)
Found by Linux Verification Center (linuxtesting.org) with SVACE.
CLA:trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jan 22 10:10:51 2026
(Merged from https://github.com/openssl/openssl/pull/29456)
As discussed, bad-function-cast and conversion produces strange results.
Add at least float-conversion - Warn for implicit conversions that reduce
the precision of a real value.
Also fix ct_test absolute value seconds calculation (without using math.h)
and then converts is to time_t.
(n.b. this is not stricly needed for the relaxed warnings, but it is more readable)
Fixes: https://github.com/openssl/project/issues/1816
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jan 22 09:58:07 2026
(Merged from https://github.com/openssl/openssl/pull/29663)
PowerPC support has been dropped in Mac OS X with the release of Mac OS
X Lion (10.7) in 2010, and the last supporting release, Snow Leopard
(10.6.x) is out of support since 2011.
Also remove Rhapsody (the Mac OS X precursor) targets.
Complements: https://github.com/openssl/openssl/pull/29653
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jan 22 09:55:26 2026
(Merged from https://github.com/openssl/openssl/pull/29672)
The SHA256_Update function (in fact all functions implemented via the
HASH_UPDATE macro) have mismatched prototypes with the
OSSL_FUNC_digest_update_fn.
This leads to ubsan errors with more recent versions of clang
Create a Thunk that does the proper casting on those function pointer
callbacks
Fixes#29615
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29650)
Upgrade prime ECDSA self tests from secp224r1 to prime256v1.
Upgrade binary ECDSA self tests from sect233r1 to sect283r1.
This is forward looking change to allow raising the lower bound in
ossl_ec_check_security_strength() /
OSSL_FIPS_MIN_SECURITY_STRENGTH_BITS in case legacy/deprecated
behaviour is not needed to be supported (for example builds with
support for primary curves only of P-256 or higher).
Did a test build to ensure that updating
OSSL_FIPS_MIN_SECURITY_STRENGTH_BITS to 128 passes fips
selftests. Note not currently recommended.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29674)
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29458)
Early returns when signature/key type are incompatible bypass cleanup
of `tmp_keymgmt` allocated via `evp_keymgmt_fetch_from_prov()`. Use goto
to ensure `EVP_KEYMGMT_free()` is called on all error paths.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Jan 20 19:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/29651)
The -Wunterminated-string-initialization is a strange gcc warning,
as C99 allows non-nul string initialization.
Note, it is included in -Wextra, but does not exist in old gcc versions.
However, it can report other real bugs.
Fixes: https://github.com/openssl/project/issues/1814
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Jan 20 18:43:39 2026
(Merged from https://github.com/openssl/openssl/pull/29661)
When changing the digest from MD5-SHA1 to a non-MD5-SHA1 digest,
`ctx->P_sha1` is freed but not set to NULL. If `ossl_prov_macctx_load()`
subsequently fails, `ctx->P_sha1` remains as a dangling pointer.
When the context is later freed via `kdf_tls1_prf_reset()`, this
causes a double-free.
Fix by setting `ctx->P_sha1` to NULL immediately after freeing it.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Jan 20 18:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/29649)
The allocated buffer for the file contents is then zero bytes long,
which `app_malloc()` used to refuse.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jan 20 18:17:12 2026
(Merged from https://github.com/openssl/openssl/pull/29613)
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Jan 20 18:06:27 2026
(Merged from https://github.com/openssl/openssl/pull/27996)
The new name is better for consistency with other tests.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Jan 19 14:20:35 2026
(Merged from https://github.com/openssl/openssl/pull/29550)
It is never changed anywhere.
Fixes#29518
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Jan 19 14:20:35 2026
(Merged from https://github.com/openssl/openssl/pull/29550)
The BIO_CTRL_FLUSH should just forward the call to the underlying
BIOs when not writing.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Jan 19 14:20:35 2026
(Merged from https://github.com/openssl/openssl/pull/29550)
The justification for this not being const was because of
lookup_certs_sk(). The reasons this function could not have a
const store, is that it set the ctx's error code
when we could not allocate memory and returned NULL.
However, the other lookup_certs function, X509_STORE_CTX_get1_certs,
already does not set this error code when failing to allocate
memory on a return.
Given that you can't depend on the out of memory error code being
set in the general case, and the Beyonce rule appears to indicate
that nobody likes this behaviour (as nobody put a test on it) I
think it's safe to say we should just not modify the ctx, and
constify it.
For #28654
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jan 19 12:03:05 2026
(Merged from https://github.com/openssl/openssl/pull/29488)
Fix this error:
```
rmdir "$PREFIX/lib64/cmake/OpenSSL"
rmdir "$PREFIX/lib64"
rmdir: failed to remove '$PREFIX/lib64': Directory not empty
```
Because `rmdir $PREFIX/lib64/cmake` is missing
CLA: trivial
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Jan 19 11:58:05 2026
(Merged from https://github.com/openssl/openssl/pull/29472)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jan 19 11:55:58 2026
(Merged from https://github.com/openssl/openssl/pull/29297)
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28915)
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28915)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/29670)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29655)
This includes KDF's for ss,x963,hmac-drbg,KB,KRB5,PVK,SNMP,SSH and X942.
SSKDF/X963KDF Changes: Modify code to handle algorithms being disabled via configuration options.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29576)
Anytime a new error code is added it generates error related files.
These are generated using a perl script which used readable indenting.
The indenting has been removed.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29631)
If a custom seed source is specified in the config file, it can be
silently ignored. For example if it is missing, fails to be created,
or fails to initialize it can be silently ignored and fallback to os
entropy instead.
To reproduce this, perform default configuration of openssl without
jitter entropy source, and then specify jitter entropy
source. Currently entropy will fall back to getrandom, instead of
erroring out.
This is not unique to jitter entropy source, there are a few other
entropy source providers out there on the market, and in all cases if
one is configuring OpenSSL to use a given seed source by name, it
should be honored.
Currently this will output a fresh rsa key, with this change however
it will now result in an error:
```
./Configure
make
./util/wrap.pl -jitter ./apps/openssl genrsa
Warning: generating random key material may take a long time
if the system has a poor entropy source
genrsa: Error generating RSA key
80ABAB8F9F7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:375:Global default library context, Algorithm (JITTER : 0), Properties (<null>)
80ABAB8F9F7F0000:error:12000090:random number generator:rand_new_seed:unable to fetch drbg:crypto/rand/rand_lib.c:613:
80ABAB8F9F7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:375:Global default library context, Algorithm (JITTER : 0), Properties (<null>)
80ABAB8F9F7F0000:error:12000090:random number generator:rand_new_seed:unable to fetch drbg:crypto/rand/rand_lib.c:613:
```
IMHO, if a user is configuring a custom seed source, it should be
honored without silently eating errors.
Note this partially reverts 1d180bbe8e
"rand: allow seed-src to be missing", which as far as I understand was
done to ensure that fallback seedsource is allowed to be missing. This
new implementation preserves this behaviour by ensuring error is not
raised if SEED-SRC (which since the above commit was changed to a
macro define OPENSSL_DEFAULT_SEED_SRC) is used as a fallback, and it
fails to be fetched. Previously all errors were popped unconditionaly,
thus same behaviour is preserved if SEED-SRC is completely missing and
it wasn't configured in the config file. cc @paulidale, also see: -
https://github.com/openssl/openssl/pull/13640
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29316)
In case the parameters don't exactly match the well-known ones
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/29639)
Drop support for the SSLv2 Client Hello. We allowed that a client send
an SSLv2 compatible Client Hello.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28041)
With our move to clang-format we no longer have a check-format script,
and so this make target is broken.
Fix it up to use clang-format-diff instead
Fixes#29594
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jan 16 14:37:09 2026
(Merged from https://github.com/openssl/openssl/pull/29634)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Jan 16 13:19:25 2026
(Merged from https://github.com/openssl/openssl/pull/29635)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29627)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29627)
Their semantics are poorly defined and they are rarely used. The _ne
version being completely unused & tricky to define properly.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29627)
The check for impacting a public api had an incorrect pattern in the
search, leading to erroneous failures. Fix it up.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jan 15 17:14:30 2026
(Merged from https://github.com/openssl/openssl/pull/29636)
These flags seems not to be part of -Wextra, but looks like
could be useful in CI. According to gcc man page:
disabled-optimization
Warn if a requested optimization pass is disabled.
pointer-arith
Warn about anything that depends on the "size of" a function
type or of "void".
Fixes: https://github.com/openssl/project/issues/1809
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Jan 15 16:16:40 2026
(Merged from https://github.com/openssl/openssl/pull/29622)
Expose the EC field degree as a gettable parameter for both provided
and legacy EC keys. In the latter case, drop a spurious assertion,
since even in debug builds an application may try to get an unknown
parameter, and this should return an error rather than abort.
In the EC `TEXT` encoding format, instead of reporting the bit count of
the group order, report the field degree (which matches the size number
in the curve's name when present) and also the symmetric-equivalent
security-bits (adjusted down the the standard numbers (80, 112, 128,
192, 256).
Along the way, add a missing getter method for the EC_GROUP security
bits.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Jan 15 16:10:26 2026
(Merged from https://github.com/openssl/openssl/pull/29539)
A proposed design for using EVP_SKEY objects in the TLS stack
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/29160)
Fixes#29618
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29629)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29590)
New version is out.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29566)
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29223)
Add script to run over a commit range looking for PR's that didn't add a
NEWS/CHANGES entry, but perhaps should have.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jan 13 19:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/29536)
During a release cycle we always wind up going through our git history
to try make sure we caught all the stuff that needed a CHANGES/NEWS
entry. Lets try make that at least a little more automated here. PR's
that reference CVEs, come from feature branches or impact public apis
generally need a NEWS/CHANGES entry, so lets flag those during CI. It
should serve as a reminder to add entries to NEWS/CHANGES to prs meeting
the above criteria, and can be ignored via the application of the
no_news_changes_needed label to the PR.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jan 13 19:17:37 2026
(Merged from https://github.com/openssl/openssl/pull/29536)
Some of these were fixed by LibreSSL in commit aa1f637d45
this fix includes the other fixes in that commit, as well as fixes for others found by a scan
for a similar unvalidated access paradigm in the tree.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29582)
The rest of the function conditions the presence/usage of pk/seed/sk
on the non-zeroness of pk_len/seed_len/sk_len, respectively, so perform
the *_len checks in a similar fashion; that makes it in line
with the similarly written ml_kem_key_fromdata() and stops giving Coverity
ideas that the pointers can be NULL when the respective len variables
are non-zero.
Fixes: 5421423ef9 "Flexible encoders for ML-DSA"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1680314
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29596)
VERSION_NEG packets are handled and returned from earlier in the function.
The later switch case and its helper are unreachable and contradictory.
Remove them to avoid confusion and future behavior drift.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:54:09 2026
(Merged from https://github.com/openssl/openssl/pull/28920)
SSL_free(conn_ssl) for a QCSO enters ossl_quic_free, which calls qc_cleanup.
qc_cleanup already frees qc->tls via SSL_free(qc->tls) and then frees qc->ch.
The additional SSL_free(ossl_quic_channel_get0_tls(new_ch)) releases the same
TLS a second time, which is redundant.
We also replace some of the pure condition checks with ossl_assert() checks
as these conditions cannot really fail.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:54:07 2026
(Merged from https://github.com/openssl/openssl/pull/28920)
If we pop a channel but fail to extract or adopt its SSL pointer,
we return without releasing the channel. Add a small cleanup at
the function epilogue to free new_ch when conn_ssl is NULL.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:54:05 2026
(Merged from https://github.com/openssl/openssl/pull/28920)
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:46:42 2026
(Merged from https://github.com/openssl/openssl/pull/29504)
Just like in previous commit, this define does not represent a toggleable
feature, but is entirely dependent on the OPENSSL_SMALL_FOOTPRINT define.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:44:27 2026
(Merged from https://github.com/openssl/openssl/pull/29204)
Just like in previous commit, this define does not represent a toggleable
feature, but is entirely dependent on the OPENSSL_SMALL_FOOTPRINT define.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:44:25 2026
(Merged from https://github.com/openssl/openssl/pull/29204)
It does not represent a feature that some arch may or may not possess, but
instead is entirely dependent on the OPENSSL_SMALL_FOOTPRINT option.
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:44:24 2026
(Merged from https://github.com/openssl/openssl/pull/29204)
Add check for the return value of BIO_new() to avoid NULL pointer dereference.
Fixes: 0cd9dd703e ("Improve base64 BIO correctness and error reporting")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jan 12 18:42:15 2026
(Merged from https://github.com/openssl/openssl/pull/27993)
Use BIO_free() to free "in" if error occurs to avoid memory leak.
Moreover, add check for "out" to avoid NULL pointer dereference.
Also replace OPENSSL_assert with return.
Fixes: e599d0a ("Add CMP fuzzing to fuzz/cmp.c, including a couple of helpers in crypto/cmp/")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:40:14 2026
(Merged from https://github.com/openssl/openssl/pull/27920)
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29587)
In PR #29145 a new OSSL_LIB_CTX_SSL_CONF_IMODULE was added, but
the OSSL_LIB_CTX_MAX_INDEXES value was left behind.
This should probably be converted to an enum, but I'll leave that work
to some other brave soul.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29581)
When --libdir was passed to configuration as an absolute path then
the makefile MODULESDIR_dir became concat(prefix, libdir) creating
an invalid path.
Fixes: https://github.com/openssl/project/issues/1797
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29579)
recvfrom() may return WSAECONNRESET when the destination port
used in a previous sendto() call is no longer available. This
causes QUIC PORT to swich from running state. This behavior
is not desired for QUIC protocol. The trick is to disable
SIO_UDP_CONNRESET flag on UDP port used by QUIC.
The issue was kindly reported and root caused by goforit22123-netizen@
Fixes: #29530
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jan 12 10:27:25 2026
(Merged from https://github.com/openssl/openssl/pull/29538)
commit 131c2a1adb ("Defang the lhash test") has reduced default number
of the thread workers in CI to HARNESS_JOBS / 4. Setting LHASH_WORKERS
will set it back.
Resolves: https://github.com/openssl/project/issues/1769
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Jan 12 10:09:54 2026
(Merged from https://github.com/openssl/openssl/pull/29565)
Now that we have removed lots of deadcode various files are including
more than they need to. We can slim down the list of includes.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29446)
We remove legacy fields that are no longer used for anything from the
EVP_CIPHER structure.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29446)
There were some final remaining legacy paths that are now redundant and
can be removed.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29446)
Remove some unneeded deadcode and fix the formatting
Also fix all users of those macros to avoid compilation warnings
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29446)
Add check for the return value of OPENSSL_malloc() to avoid potential NULL pointer dereference.
Fixes: f3b988d ("Add provider fuzzer")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27868)
For every function that was removed we add an entry to
ossl-removed-api.pod
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29405)
Now that EVP_PKEY_ASN1_METHODs have been removed from the public API we
need to update the documentation accordingly. They still exist internally
and so some references are still appropriate in the internal documetnation.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29405)
Now that the ability to register a custom EVP_PKEY_ASN1_METHOD has
been removed in an earlier commit, we can now remove the functions that
are used to create a custom EVP_PKEY_ASN1_METHOD.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29405)
Previously there were a few functions where you could obtain a handle
on registered EVP_PKEY_ASN1_METHODs and query information about them.
We remove the capability.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29405)
We remove the ability to add application defined EVP_PKEY_ASN1_METHODs
via the `EVP_PKEY_asn1_add0()` function. We also remove the related function
`EVP_PKEY_asn1_add_alias()`.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29405)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29560)
Somewhere in our conversion from .c files to .inc files for our rand
providers, we created code in drbg_hmac_set_ctx_params_locked to fetch
our digest and hmac when creating the rand instance. However, the
function drbg_fetch_algs_from_prov only fetched our digest for this rand
type, not the hmac, and returned 1 while doing so, indicating success.
This is problematic because it means that we never wind up fetching an
HMAC for this rand type. As a result we never compute the strength of
the DRBG and so any attempt to seed it fails.
Ensure that, if we load a digest for this DRBG, we also fetch an HMAC,
and fail if we can't do so, so the HMAC-DRBG is useful.
Fixesopenssl/private#853
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29560)
After the deadcode removal there were varios include files being used
that are no longer necessary. We remove them.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29460)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29460)
Remove fields that are no longer needed.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29460)
Remove the legacy EVP_MD implementation functions. These are no longer
used due to providers. This code is now unreachable due to the removal of
the functions related to custom EVP_MD methods.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29460)
<stdint.H> is part of libraries which come with C99 compiler.
Fixes: #29548
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29553)
OpenSSL's build file (Makefile) handles library directories via two
variables, 'LIBDIR' and 'libdir', where the former is empty when the
path given through ./Configure's '--libdir' is absolute.
This was forgotten when treating the resulting values in,
util/mkinstallvars.pl, which got libdir in exporters/libcrypto.pc
to not be quite right if .Configure was called with a '--libdir'
with an absolute path.
The fix turns out to be quite easy.
Resolves: https://github.com/openssl/openssl/issues/28779
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29540)
Due to an out of memory error, the i2d_ASN1_TYPE might fail
and cause a segfault.
This adds a missing check for NULL pointer and a test case
that exercises IMPLICIT and EXPLICT tagging in generate_v3,
since there was no test coverage at all for this code section.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 8 10:13:43 2026
(Merged from https://github.com/openssl/openssl/pull/29545)
Remove unused ossl_crypto_ex_data_get_ossl_lib_ctx() and memdbg_lock.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jan 8 10:08:08 2026
(Merged from https://github.com/openssl/openssl/pull/29500)
Found by Linux Verification Center (linuxtesting.org) with SVACE.
CLA:trivial
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jan 8 10:03:55 2026
(Merged from https://github.com/openssl/openssl/pull/29457)
Report of the static analyzer:
Function 'OCSP_cert_to_id' may return NULL on allocation failure,
but its return value is dereferenced in 'OCSP_id_issuer_cmp'
without prior NULL check at ocsp.c:1088. This can lead to a null
pointer dereference and cause a segmentation fault, resulting
in a denial-of-service (DoS) condition. Although such failures
are rare, an attacker could potentially trigger them under memory
pressure. All other calls to 'OCSP_cert_to_id' in the codebase
(e.g., add_ocsp_cert, add_ocsp_serial) properly check for NULL,
making this instance a clear omission.
Correct explained:
Added a NULL check after calling OCSP_cert_to_id() when creating
'ca_id' inside the issuer lookup loop. If the allocation fails, the
function now safely returns an internal error response instead of
risking a crash. This change aligns the code with existing
error-handling patterns in the same file and improves robustness
against resource exhaustion attacks.
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 8 09:01:09 2026
(Merged from https://github.com/openssl/openssl/pull/29033)
* Remove additional dependency for old build boxes (in particular centos)
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Jan 8 08:55:10 2026
(Merged from https://github.com/openssl/openssl/pull/24632)
(cherry picked from commit df0a0fd613)
the test_base64_simdutf test is commonly built but not ignored by our
.gitignore file, fix that up
Fixes#29529
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29551)
The base64_simdutf test has a printf statement inside a double for loop
that causes a huge amount of latency when run under our perl scripts.
Average run time on my system is about 1min 58 seconds.
We shouldn't be using a printf statement there anyway (likely TEST_info
instead), but we don't need that either, so just remove the printf
entirely. This decreases the run time to around a second to complete.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29542)
Replace #ifdef FIPS_MODULE with OSSL_PROVIDER_available() runtime check
in ecdsatest.c. The compile-time check is not meaningful for test cases
as the test binary may be compiled without FIPS_MODULE but run with the
FIPS provider loaded.
Fixes#28255
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29527)
* Modified the parsing logic to handle space-followed-by-comma patterns
* Updated the separator skipping logic to process at most one comma while allowing multiple spaces
* Added a test case with a mixed DNS and IP SAN entry that includes the problematic spacing pattern
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28471)
There is a memory leak of the addrinfo struct when
`./openssl s_server -dtls -sctp -accept 127.0.0.1:4433`
is used, but `sysctl -w net.sctp.auth_enable=1`
is not done before.
Additionally this fixes an oversight, when
`./openssl s_client -dtls -sctp -connect localhost:4433`
is used to connect to above server.
The first connect attempt is to IPv6 ::1, which might fail,
but the second attempt might still succeed, so continue to
try all addesses even when the SCTP socket fails for one of them.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29541)
https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1677829
With recent changes, evp_encodeblock_int may return a negative value,
which EVP_EncodeFinal does not anticipate. As the latter sets out[ret]
to "\0" where ret is the return value of evp_encodeblock_int, we may
underflow the array index and access invalid memory locations.
Only update the output buffer if the return value is greater or equal to
zero.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29525)
https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1677831
reports more dead code in b64_write
ret is incremented by inl in b64_write prior to being tested for zero.
Since inl is previously tested for being <= 0, and returns if it is, ret
must be at least 1 during the test, making the trinary test dead code.
Just return -1 here.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29525)
recent updates triggered this coverity issues:
https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1677834
Because ret is initalized to zero, and checked prior to any further
update, the first return statement in this change is unreachable
Further the return ret == 0 ? i : ret statement makes teh setting of
buf_len and buf_off unreachable.
Remove all of this unreachable code
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29525)
It's only use was to do some somewhat confused cruftery
inside of ossl_asn1_time_to_tm as a special case to
implement ASN1_TIME_set_string_X509.
As it turns out, you don't need the cruftery of a special
case inside of ossl_asn1_time_to_tm to implement this
function, so the flag is completely unnecessary.
This removes flag, and simplifies this to work without it.
It removes the cruft only from ossl_asn1_time_to_tm,
minimally. This function really needs some cleanup and
makes my eyes bleed but I am resisting the temptation
to do that with this PR and making this a the minimal
change needed for review. I will clean up that function
in a follow on pr.
As tests on the behaviour of ASN1_TIME_set_string_X509
were added with it, Beyonce dances happily for me and I
only need to pass the existing tests, not write as bunch
of new ones.. .
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29187)
Recently, the addition of some vector register save restore logic from:
https://github.com/openssl/openssl/pull/28990
Triggered an issue in our quic_multistream_test, notably causing a
connection shutdown with error code 1, rather than successful
completion.
The problem has been root caused to an error in how the ppc aes code
saves and restores vector registers.
The aes gcm code uses VSR instructions (vsldoi, etc), to maniuplate
vector registers, which only operate on the upper half of the vector
register file (VS32-63), and operands are implicitly offset to do this.
(i.e. <instr> v31 actually operates on register vs63).
However, the SAVE/RESTORE macros which save and restore those values use
stxv/lxv instructions to do the save and restore, which are VSX
instructions that have access to the full vector register file, and so
by restoring V1, rather than V33, etc, we actuall restore values to the
wrong registers, causing various issues (most notably the above
misconfiguration of the quic SSL shutdown event, which sets the error
code erroneously to 1 instead of the expected 0 value).
Fix it by offsetting the SAVE_REGS and RESTORE_REGS macros to reference
the proper registers when doing save and restore.
Fixes#29516
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29528)
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29452)
Modify the IV update method to further improve the performance of
SM4-CBC encryption on the RISC-V architecture.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29451)
RISC-V Cryptographic Vector Extension provides ZVK instructions which
can be used to accelerate SM3 computing.
By calculating SHA512 performance on C930 FPGA, it is proven that sm3
speed is improved from 120695K to 323844K.
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29264)
The key improvements include:code formatting unification、instruction scheduling optimization、register allocation strategy update、updates to addition/subtraction carry and borrow flag handling.
These enhancements aim to improve both the code maintainability and its execution performance, particularly on out-of-order RISC-V cores.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29438)
Add check for the return value of BIO_new() to guarantee the success.
Fixes: 0f113f3ee4 ("Run util/openssl-format-source -v -c .")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27919)
Add check for the return value of BIO_new() to avoid NULL pointer dereference.
Fixes: fd19fc4c27 ("Test that a key is usable after an EVP_PKEY_fromdata call")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27994)
We currently support gcc 9 as a minimum compiler version. We should run
at least one ci job against that minimal version to make sure we don't
break anything.
Most notably this will help us catch errors if we attempt to use
intrinsics that aren't supported by that compiler.
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29482)
In the bn_sqr8x_mont function, a comment describing the accumulation step for the partial product a[1]*a[0] incorrectly referenced the low part ('lo') of the product. The value being added to the temporary register t[2] is actually the high part ('hi') of that multiplication.
Correct the comment from "t[2]+lo(a[1]*a[0])" to "t[2]+hi(a[1]*a[0])".
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29436)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Explain the changes to configure
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Show a deprecated warning if users attempt to run Configure script with
no-ssl3, no-ssl, or no-ssl3-method. Also adds a fix to the Configure
script preventing users from enabling deprecated flags.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Updated error code names and references from SSL3 to TLS in error definitions and error strings. Legacy error codes are preserved in sslerr_legacy.h for backward compatibility
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Also remove the SSL_TXT_SSLV3 name.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29474)
This patch is dedicated to improve SHA512 speed with RISCV
Cryptographic Vector Extension.
Below performance output is calculated by Xuantie C930 FPGA with VLEN256.
- sha512 speed might be improved from 197032K to 1010986KB
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29263)
It was broken since the OpenSSL 3.0 release and
nobody complained. Apparently nobody is using it.
It would be practically impossible to reimplement
it with the provided EVP_MDs in backwards-compatible
manner.
Fixes#29413
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29445)
Co-authored-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29385)
Co-authored-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29385)
Co-authored-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29385)
libcrypto does not arm OPENSSL_cleanup() function as atexit(3) handler by default.
If application/user wants libcrypto to install OPENSSL_cleanup() as atexit handler,
then OPENSSL_ATEXIT_CLEANUP env. variable must be set.
If platform's libc does not provide atexit(3), then OPENSSL_ATEXIT_CLEANUP has no effect.
The OPENSSL_atexit() is wrapper of atexit(3) provided by libc now.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29385)
This avoids crash if a legacy BIO callback is set and
BIO_sendmmsg() or BIO_recvmmsg() is used.
Reported by Stanislav Fort (Aisle Research)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29395)
When the array is empty then copy.pl fails, because there is nothing to
copy. The empty check was done on a different variable.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29427)
The `openssl rehash` should be used instead.
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29427)
... with perl truthiness in mind
Most of all, this means not having undue expectations that its value
is numerical (this is particularly true when HARNESS_VERBOSE isn't given
by the user, and this script's default is "yes").
We do this by ensuring that $tap_verbosity is turned into an appropriate
number if HARNESS_VERBOSE's value isn't numerical.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29443)
The implementation failed to restore VSX vector registers from vs14-vs22.
Re-implemented based on Linux kernel version.
Fixes#28961
Signed-off-by: Danny Tsen <dtsen@us.ibm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28990)
This test tries to use all stub macros and compare return values
to verify that OPENSSL_ENGINE_STUBS define works.
Fixesopenssl/project#1762
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29414)
This was an internal function and should not be here.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29414)
Used types are only available if OPENSSL_NO_DEPRECATED_3_0
is not defined.
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29414)
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29414)
The deserialization functions for SHA2 and SHA3 digest contexts did not
sufficiently validate the incoming data. Corruption in transmission or
on saved disk data could cause a out-of-bounds memory access if buffer
sizes did not match expected values.
Add sanity checks to the SHA2 and SHA3 deserialization functions to validate
buffer-related fields before they are used. The serialization format for these
digests has been changed to place these critical fields early in the stream to
enable this validation.
Additionally, add a note to the EVP_DigestInit man page to warn users that
deserialization should only be performed on trusted data. The checks we
implement are not meant to address processing of untrusted data
maliciously crafted by an attacker.
Application that need to store data or transmit it through untrusted
media SHOULD implement proper encryption and message authentication
on their own using things like CMS or other appropriate secure message
containers.
These check have been added also to quiet a bit security researchers
that try to find any way to claim CVE bounties even in completely
unlikely or invalid scenarios.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29404)
The "Verify-Message" type looks for private keys only,
which meant anything using a public key got skipped.
Changed the entries to "Verify-Message-Public" which tries the public
key first.
This uncovered one test that needed to be removed since ECDSA-MD5 is not
a valid fetchable algorithm (in any OpenSSL provider).
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28040)
A small script that tries to perform reformatting of a patch set.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29356)
There's this one random string where we have the word "Hellow". It's a
random string, "correct" spelling is really not important, so we tell
codespell to just ignore that line.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29437)
- add 'external/*' to the list of patterns to skip
- add '*.csr' to the list of patterns to skip
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29437)
Fixes: #1631
This changes the previously internal ossl_x509_check_certificate_times()
to be the public X509_check_certificate_times(). It adds documentation
for the new function and marks X509_cmp_time, X509_cmp_timeframe,
and X509_cmp_current_time as deprecated in 4.0, as discussed in #1631.
Since the function is now public, we can replace the remaining
uses of deprecated stuff with this function.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29152)
When ASYNC_start_job is called with args != NULL but size == 0,
OPENSSL_malloc(0) is called. Depending on the libc implementation,
malloc(0) may return NULL, causing a silent failure.
This patch modifies the logic to skip allocation if size is 0.
CLA: trivial
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29377)
On AIX, the environment of the test executable for test_includes doesn't
contain a resolvable search path to the just built libcrypto. Setup
LIBPATH to point to the build results.
Fixes#29352.
Signed-off-by: Matthias Kraft <Matthias.Kraft@ibm.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29375)
These functions have been removed so the documentation should be updated
accordingly.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
We retain the opaque type because it is still used by the ENGINE stubs.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
We don't set this field anymore so we should remove all usage of it.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
It is no longer used so can be removed
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
It is no longer used so can be removed
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
It is no longer used so can be removed
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
It is no longer used so can be removed
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
It is no longer used so can be removed
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
We retain custom EVP_PKEY_ASN1_METHODs for now - to be removed in some
subsequent PR.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29384)
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29376)
Reported by Murali Aniruddhan
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29376)
Also remove ready_for_gc_next(), it is not needed any more.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29402)
This reverts commit 2b97f4d300.
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28717)
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
This resulted in some source reformatting becoming a bit less trippy
This is the script I used to run clang-format appropriately enough:
#! /bin/bash
include_re=$(yq -r '.repos.[].hooks.[] | select(.id == "clang-format") | .files' < .pre-commit-config.yaml)
known_generated=( crypto/bn/bn_prime.h
crypto/objects/obj_dat.h
crypto/objects/obj_xref.h
include/openssl/obj_mac.h
crypto/conf/conf_def.h
crypto/asn1/charmap.h
'*_err.c'
'*err.h' )
exclusions=()
for g in "${known_generated[@]}"; do
# Convert pattern to a regex
g=${g//\./\\.}
g=${g//\*/.\*}
exclusions+=( "^${g}\$" )
done
# Join all exclusions into one regex
exclude_re=$(IFS='|'; echo "${exclusions[*]}")
(set -x; git ls-files | grep -E $include_re | grep -Ev $exclude_re | xargs clang-format -i)
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
I looked for them with the following grep pipe, and then read through
the output to discern what are actual type definitions, and converted
what I found manually.
git grep -En -e '#define [a-zA-Z_0-9]+ ' -- '*.h' \
| sed -e 's|//.*||' -e 's|/\*.*\*/||g' \
| grep -Ev ' ([0-9]|.*".*|.*\\$)'
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
This resulted in an adjustment of reformatting that is a bit less trippy
in some places.
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
For some reason, source reformatting didn't catch everything.
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
This is bascially eating my mac, as it now runs for 80 seconds
and eats all the CPU's exercising lock contention.
This dials it back to consume at most a quarter of the CPU's in
use by HARNESS_JOBS, unless LHASH_WORKERS is set to override it
in which case we use that.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/29406)
The key output will be always private.
Reported with a proposed fix by Stanislav Fort (Aisle Research).
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29397)
Coverity flagged a use before NULL check error in
kdf_snmpkdf_set_ctx_params.
In this function the ctx pointer was dereferenced to obtain a
OSSL_LIB_CTX pointer, and only after that dereference was ctx checked
for being NULL.
fix is pretty clear, just move the OSSL_LIB_CTX computation down to a
point after ctx is checked for NULL.
fixesopenssl/project#1765
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29400)
This allows setting the ML-KEM and ML-DSA output formats.
At the same fixing surprising lack of password encryption
of PKCS#8 private keys in DER output form in the CLI apps.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29324)
Clang format removes a space here, which creates a compiler error when
building for PAC/BTI. Fix this and Turn off clang format for this line
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/29399)
Unless we have reduced the verbosity level, or overridden it with
a HARNESS_TIMER setting.
This makes it easier to realize when you are making a test that is
starting to dominate testing time for developers, and makes it
easier for developers to see it.
For: https://github.com/openssl/project/issues/1767
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/29408)
All the EVP_MD_meth* functions have been removed so they should be
documented as such.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29366)
With the removal of EVP_MD_meth* we need to update the documentation
accordingly.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29366)
Custom MD methods are considered legacy and have been deprecated
since 3.0. With the removal of ENGINEs they become a lot less useful
and add significant complexity to the code. We should therefore remove
them in 4.0.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29366)
Its been reported that, when using SSL_listen_ex to obtain a new
connection from a listener, that, if the listener is freed prior to the
obtained connection, we get use-after-free conditions when freeing said
obtained connections.
This occurs because SSL_listen_ex fails to take a reference on the
parent listener SSL object (in the same way that SSL_new_from_listener
does). If the listener is freed first, then several listener resources
are freed, which the obtained connection still makes use of, hence the
use-after-free.
The fix is to do what SSL_new_from_listener does, namely:
1) Increase the reference count on the listener SSL object.
2) Ensure that the connection qc->listener points to the listener object
so that, when the connection is freed, we call SSL_free on the
listener object, dropping the reference count we take in
SSL_listen_ex.
While we're at it, this PR also modifies the quicapi test for testing
the SSL_listen_ex call, freeing the listener first to ensure that the
increased refcount holds the SSL object data stable until the connection
is freed.
Thanks to Stanislav Fort at Asile Research for pointing out this issue.
fixesopenssl/project#1766
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29398)
cstyle change only
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29369)
Update ossl_ec_key_fromdata to compute the public key if it is not provided in
the input parameters but the private key is. This allows for the creation of a
complete EC_KEY object from only private key data.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29054)
We still build with crypto-mdebug-backtrace enabled in a few ci jobs,
but it does nothing.
With the upcoming merge of feature/removesslv3, the code changes there
prevent the use of this option (i.e. enabling it results in
configuration failure).
It seems the most sensible thing to do here, given we have a major
release is to eliminate the option entirely, as it hasn't done anything
since 1.0.2.
Fixesopenssl/project#1763
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29380)
Remove the paragraph that is no longer relevant.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29374)
In the ASN.1 structures we define the BIGNUM as positive and enforce
this during parsing. If the encoded value is negative, we raise an error
and reject the material.
Fixes#29210Fixes#27407
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29370)
All the EVP_CIPHER_meth* functions have been removed so they should be
documented as such.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29299)
With the removal of EVP_CIPHER_meth* we need to update the documentation
accordingly.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29299)
Custom cipher methods are considered legacy and have been deprecated
since 3.0. With the removal of ENGINEs they become a lot less useful
and add significant complexity to the code. We should therefore remove
them in 4.0.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29299)
Add tests to verify that `EVP_MD_CTX_serialize` and
`EVP_MD_CTX_deserialize` fail when called on a finalized `EVP_MD_CTX`.
A finalized context is in a terminal state and should not be serializable for
resumption or have a new state deserialized into it. These tests confirm the
expected failure behavior.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28837)
Refactor the SHA provider's context parameter handling in sha2_prov.c to use
the generated parameter decoder framework.
This change replaces manual parameter lookups using `OSSL_PARAM_locate` and
static `OSSL_PARAM` arrays with generated decoder functions and structs. A new
template, `sha2_prov.inc.in`, is added to create the necessary decoders during
the build.
This simplifies the code, reduces boilerplate, and improves type safety.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28837)
Implement context serialization and deserialization for the SHA3, KECCAK,
SHAKE, and KMAC provider-based digests.
This is achieved by handling the `OSSL_DIGEST_SERIALIZATION` parameter in
get_ctx_params and set_ctx_params. A custom format is used to store the KECCAK
state, including a magic number and an algorithm identifier to ensure the
context is not loaded into an incompatible digest instance.
This allows an EVP_MD_CTX to be saved and restored, which is useful for
applications that need to checkpoint hashing operations. The existing EVP
serialization tests have been extended to cover these new algorithms.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28837)
This commit introduces the ability to serialize and deserialize the internal
state of SHA-2 digest contexts (SHA-256 and SHA-512 families).
This functionality is exposed via the new OSSL_DIGEST_SERIALIZATION parameter,
which can be used with EVP_MD_CTX_get_params() to retrieve the state and with
EVP_DigestInit_ex2() to restore it into a new context.
This allows an application to save the state of a hash operation and resume it
later, which is useful for process migration or for saving the state of long-
unning computations. A new test case has been added to verify this.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28837)
This commit introduces two new functions, EVP_MD_CTX_serialize and
EVP_MD_CTX_deserialize, to the EVP digest API.
These functions allow an application to save the state of a digest
context (EVP_MD_CTX) and restore it later. This is useful for
checkpointing long-running computations, enabling them to be paused
and resumed without starting over.
The implementation adds the OSSL_FUNC_DIGEST_SERIALIZE and
OSSL_FUNC_DIGEST_DESERIALIZE dispatch functions for providers to
supply this functionality.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28837)
2025-12-12 09:08:33 +01:00
2259 changed files with 138049 additions and 118456 deletions
Other than that, provide a description above this comment if there isn't one already
Include a clear description of the issue or feature above this comment if not already provided. This should briefly outline the issue or feature being addressed, along with any relevant implementation details. For performance improvements, include benchmark results as well.
Please always add meaningful commit messages. Commit message titles (the first line of each commit message which should be separated by an empty line from the rest of the message) should be kept to 50-70 characters if possible. Further details and Fixes #issue number annotations should be placed in the commit message body (i.e, after the empty line).
Pull requests and commits should be self-contained, allowing readers to understand what changed and why without needing to reference related issues or having prior knowledge. Individual commit messages should include all relevant details to ensure future contributors can easily follow the git history. Clearly explain what is changing and why, and feel free to include detailed (long) descriptions when beneficial to understanding.
If this fixes a GitHub issue, make sure to have a line saying 'Fixes #XXXX' (without quotes) in the commit message.
