Added documentation of the addition of group tuples in openSSL 3.5
in HISTORY section of SSL_CTX_set1_curves.pod.
CLA: trivial
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 24 13:13:26 2026
(Merged from https://github.com/openssl/openssl/pull/32007)
EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured
signature digest rejected a valid signature whose recovered payload is
empty, instead of returning success with a recovered length of zero.
RSA_public_decrypt() returns -1 on error and otherwise the number of
recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5
signature that encodes an empty payload. Pull request #28306 ("Make
error checks on RSA_public_decrypt() consistent") changed the error
check in the raw, no-digest verify-recover path from "ret < 0" to
"ret <= 0", so a valid zero recovered length was mistaken for an error.
Restore the "< 0" check in that branch only, leaving the digest-aware
PKCS#1, X9.31, PSS and ordinary verification paths untouched.
Add test_RSA_verify_recover_empty_payload, which performs a complete
zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and
fails on the unmodified implementation specifically at the
EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same
signature and reports a zero-byte result.
The behavior regressed as a result of #28306.
Fixes#32000
Assisted-by: OpenCode:GLM-5.2
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Fri Jul 24 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32001)
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.
Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.
Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.
Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)
The LoongArch SHA dispatch shim uses the same deprecated typed
interfaces as the RISC-V shim. Switch its entry points to void *
so it no longer depends on deprecated SHA context types.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:31 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
The RISC-V MD5 and SHA dispatch files use low-level digest context
types that are hidden in no-deprecated builds. Switch their shim
entry points to void * so they no longer depend on deprecated typed
interfaces.
Update the local MD5 declaration to match the untyped shim
interface.
Fixes: openssl/openssl#29357
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:30 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
Fuzz OSSL_ECHSTORE_read_echconfiglist with raw
fuzzer input in stage 1. Then fixup the starting
bytes to reach deeper code withotu relying only on
corpus. Fixup is done for binary encoding only (not base64).
Assisted-by: ChatGPT:gpt-5.5
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 13:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/32021)
Document that a generated key is returned separately from its generation
context and that a new key-bound context is needed for subsequent
operations. Correct the encrypt and decrypt initialization descriptions
and examples accordingly.
Correct two copy-and-paste errors in the verify-recover documentation:
describe its initializer as starting a verify-recover operation and refer
to EVP_PKEY_verify_recover() when discussing its input.
Fixes#31989
Assisted-by: Grok:Grok-4.5
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 23 08:29:24 2026
(Merged from https://github.com/openssl/openssl/pull/31995)
Coverity caught some potential overflows in do_name_ex. Seems unlikely
to occur, but lets just do all the adds under safe_math to ensure we
don't overflow our buffer length.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695278
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 08:24:23 2026
(Merged from https://github.com/openssl/openssl/pull/31992)
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents")
Signed-off-by: Todd Short <todd.short@me.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
- Do not reject external PSKs when client-side sid_ctx is set, fixed
by copying the sid_ctx into the pending session.
Tests added for this and also the server side sid_ctx issues.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:06 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969
Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5
Fixes: 70741ee62a "Configurations/unix-Makefile.tmpl: make cleanup faster"
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
As the latter was deprecated in commit f584ae959c "Let's support
multiple names for certificate verification".
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
...instead of defining it (incorrectly).
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382ca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad "Convert demos to primary build system"
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: dad45ea769 "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb "Add demo QUIC non-blocking server"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b5 "MVP demo TLS
server", which, while was applied after 2000281dad "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b5 "MVP demo TLS server"
Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
This change documents the new Configure option, `--manpage-format`.
Address formatting issues and expound on the `Reconfigure` section.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:30 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Introduced in commit 05301b100f (PR #25918).
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Jul 20 09:47:35 2026
(Merged from https://github.com/openssl/openssl/pull/31874)
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Cover the success path (state advances to FINISHED_WRITING, empty body)
and the invalid-state error path.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:47 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Parameterize prime_ssl() by message type and extract a generic
finish_msg() so the scaffolding is reusable by other client construct
tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:45 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
The msg_cb message callback used by the -msg option only recognised
DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as
"Not TLS data or unknown version" instead of being decoded. Add
DTLS1_2_VERSION to the recognised version check and to the ssl_versions
lookup table, and wrap the now-overlong condition.
Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and
DTLSv1.2, logging the protocol messages via -msg, and checks that every
record is decoded (no "Not TLS data or unknown version" lines).
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jul 20 09:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/31994)
The internal provider test intentionally retains its configured provider
when OPENSSL_cleanup() is skipped under OSSL_USE_VALGRIND. The existing
suppression accounts for this state but no longer matches the provider
activation stack because provider_init() appears between
OSSL_provider_init() and provider_activate().
Add the missing frame so the provider context and its diagnostic strings
are correctly suppressed.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:11 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The QUIC radix test creates a new thread-local key for each script but
only clears the associated value during teardown. The key itself
is never deleted.
Delete the thread-local key after all child threads have joined and the
main-thread value has been cleared.
1,536 bytes in 3 blocks are still reachable in loss record 873 of 915
at 0x488D0B0: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
by 0x49561CF: pthread_setspecific@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
by 0x5C0FD7: CRYPTO_THREAD_set_local (threads_pthread.c:1030)
by 0x41132F: radix_thread_init (quic_bindings.c:570)
by 0x4114F7: bindings_process_init (quic_bindings.c:604)
by 0x422563: test_script (main.c:28)
by 0x5152DF: run_tests (driver.c:518)
by 0x517447: main (main.c:52)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:10 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The test provider's fake AES-128-GCM cipher works by running the real
sub-cipher for its side effects and then copying the memdup'd input
back over the output buffer, so the "encrypted" record is really the
plaintext.
In a TLS record the buffer handed to the cipher reserves an
uninitialised 8-byte explicit IV at the front and a 16-byte auth tag
at the end for the cipher to fill. OPENSSL_memdup() duplicated those
uninitialised IV/tag regions, and the subsequent memcpy(out, inbuf, inl)
copied them into out. That output was then written to the socket,
triggering valgrind's "Syscall param write(buf) points to uninitialised
byte(s)":
at sock_write (bss_sock.c:155)
by bwrite_conv (bio_meth.c:79)
by BIO_write (bio_lib.c:397)
by statem_flush (statem.c:963)
by ossl_statem_client_post_work (statem_clnt.c:881)
...
Track whether EVP_CTRL_AEAD_TLS1_AAD was set (recorded in
set_ctx_params) and, when encrypting a TLS record, copy only the
plaintext payload back, leaving the explicit IV and tag that the real
sub-cipher actually produced intact.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:08 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Append the %p (process ID) placeholder to valgrind's --log-file in
both app() and test(). When a test spawns multiple processes sharing
the same result index, they previously wrote to the same log file and
clobbered each other's output. Using %p gives each process its own
log, so no valgrind findings are lost.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:07 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
The new edge case tests cover potential parser invariant violations
fixed in the prior commit.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 20 07:12:31 2026
(Merged from https://github.com/openssl/openssl/pull/31926)
- Don't attempt to float its keyshare if any
- Include active tuple in memmove() that excises a newly empty closed tuple.
Add comments to clarify the logic.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 20 07:12:30 2026
(Merged from https://github.com/openssl/openssl/pull/31926)
WRAP[] lists mix OpenSSL functions with libc/POSIX ones such as read()
or socket(), which mkwraps.pl reported as "declaration not found" since
it only searched the project's INCLUDE[] directories.
Fall back to the C compiler's default include search paths for functions
missing from the project headers. They are queried lazily, only on such
a miss, so the all-OpenSSL case still does not walk /usr/include. Parse
the glibc trailing attribute macros (__THROW, __wur, ...) and restrict
qualifier, and add --cc and --no-system.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 20 07:00:57 2026
(Merged from https://github.com/openssl/openssl/pull/31936)
For GCM-SIV:
1. AAD must precede the payload
2. the payload must be single shot
(2) was already happening, this change moves from a silent fail to
an explicit error message for multiple update calls on the payload.
For (1), this change unifies the logic for (2) one level up in the wrapper.
So the code previously allowed (1), and now errors out after this change.
Follow-up to #31906
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 06:56:04 2026
(Merged from https://github.com/openssl/openssl/pull/31940)
The -keyform (OPT_KEYFORM) option of the dgst app was not exercised by
any test. Add a subtest that converts the RSA test keys to DER and
then signs and verifies with -keyform DER, covering the option for both
the private and public key loading paths.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 06:40:45 2026
(Merged from https://github.com/openssl/openssl/pull/31946)
If pkcs11-provider external test fails, only output of failed tests
is printed.
Signed-off-by: Ondrej Moris <omoris@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
MergeDate: Mon Jul 20 06:29:41 2026
(Merged from https://github.com/openssl/openssl/pull/31947)
The -text option of the dsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testdsa.pem keypair rather
than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 06:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/31949)
This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)
The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.
Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.
We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().
ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.
Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.
Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.
Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.
Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.
Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Jul 18 12:53:26 2026
(Merged from https://github.com/openssl/openssl/pull/31927)
The -encopt option of the pkey app was not exercised by any test; the
existing ML-DSA codec tests only used genpkey -encopt and pkey with
-provparam. Re-encode the seed-priv key into each supported PKCS#8
output format via 'pkey -encopt output_formats:<form>' and check the
result matches the reference for that form. A control compares against
the default (no -encopt) encoding so the match is attributed to -encopt
rather than the default behaviour.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:51:40 2026
(Merged from https://github.com/openssl/openssl/pull/31951)
The -text option was not exercised for the ec or ecparam apps. Add a
subtest to 15-test_ec.t that prints a private and a public EC key and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testec-p256.pem keypair as
well as the curve identification. Add a subtest to 15-test_ecparam.t
that prints named and explicit parameters, checking the named form emits
the expected curve OID and NIST name while the explicit form emits the
field parameters and no OID.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:47:12 2026
(Merged from https://github.com/openssl/openssl/pull/31952)
RADIX framework keeps objects needed by test scripts
in two places:
- hash table bound to radix process (`RP()->objs`), all
objects are stored there
- slot which is an array bound to radix thread (`RT()->slot[]`)
The `slot` is an array which is used to pass arguments
to RADIX ops. The typically script is doing something
like this:
```
OP_SELECT_SSL(0, C); /* places 'C' object to slot 0 in thread */
OP_FUNC(print_ssl); /* calls print_ssl function, which prints object */
```
All objects are managed by RADIX framework, scripts have very
limited options to control object's lifetime. The only way for
scripts to let object go is to use `OP_UNBIND()`. The operation
removes the object from hastable (`RP()->objs`) and frees the
object afterwards. This is good enough as long a all tests
are running in single thread. Currently `OP_UNBIND()` is
required when test needs to accept/create more than one stream.
The test has two options. It can use unique name for each
stream it creates/accepts:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_ACCEPT_STREAM_WAIT(C, C1, 0);
OP_ACCEPT_STREAM_WAIT(C, C2, 0);
```
Or script may re-use the same variable for stream,
in that case `OP_UNBIND()` is needed:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
```
Unfortunately `OP_UNBIND()` can not be used when test
uses more than one thread due to missing locking of `RP()->objs`.
Introducing a locking scheme seems to be bit invasive change,
The OP_BIND() here hopes to be sufficient and good enough for now.
The idea is as follows:
- `OP_BIND()` allows script to insert empty object
into `RP()->objs` OP_BIND() is supposed to run before
script spawns thread(s). No manipulation of `RP()->objs`
is allowed after threads are spawned, operations
OP_BIND()/OP_UNBIND() are not thread safe.
- Introduce `OP_F_REPLACE_STREAM` flag which tells
`OP_ACCEPT_STREAM_WAIT()`/`OP_NEW_STREAM()` to re-use
existing id for stream. This `_REPLACE_` flag requires
read-only access to `RP()->objs` hash table.
- change introduces a per radix object mutex so object can
be updated safely w.r.t. RADIX thread which ticks SSL object
bound in radix object.
The guideline for tests which require more then one thread
is as follows:
- the first thread creates complete set of empty objects
for all threads.
- each test thread gets its own set of variables, so it
can populate them later during test with SSL objects
- objects are not supposed to be shared between threads
This is a snippet of script executed by main thread before
additional threads are spawned:
```
...
OP_BIND(C1); /* stream id for child */
OP_BIND(S1); /* stream id for parent */
OP_SPAWN_THREAD(child);
for (i = 0; i < 10; i++) {
OP_NEW_STREAM(S, S1, OP_F_REPLACE_STREAM);
OP_WRITE_B(S1, "foo");
OP_CONCLUDE(S1);
}
```
This snippet comes from child:
```
for (i = 0; i < 10; i++) {
OP_ACCEPT_STREAM_WAIT(C, C1, OP_F_REPLACE_STREAM);
OP_READ_EXPECT_B(C1, "foo");
OP_EXPECT_FIN(C1);
}
```
As you can see parent and child don't use OP_BIND()/OP_UNBIND()
after child thread is spawned.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri Jul 17 08:02:04 2026
(Merged from https://github.com/openssl/openssl/pull/31821)
The seeding macro logic was mixed up and incompletely applied. The
macro logic was also cleaned up.
Co-authored-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 17 04:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31970)
The tests addded in commit d8a7e8e uncovered an odd error case.
https://github.com/openssl/openssl/actions/runs/29303845665/job/86993085732
Is failing when attempting to read in a der file converting from a
corresponding PEM file containing DSA parameters.
Interestingly The problem was only occuring when:
1) The input was a DER file
and
2) Blake2 was not configured
Doing some tracing of the decoder operation showed that this is occuring
because the OSSL_STORE lookup used to find the proper decoder uses a
"first successful decode wins" approach, after which the loading code
checks to see if the decoded type matches the expected key type.
When decoding PEM, this isn't a problem, as the PEM armoring gives the
decoder a hint as to why type of data the input file is.
But with DER, there is no such hint, and we're at the mercy of whichever
decoder happens to decode the data correctly first. Normally it works
just fine, but when features are disabled or enabled, the order in which
the decoders are attempted may change, affecting the outcome. In this
particular case, disabling blake2 caused the DHX decoder to be attempted
first, which decodes the input der file without issue. That in turn
caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting
a DSA key), and so the test fails.
Fortunately, the code that the dsaparam applet uses to do this decode
provides a keytype hint, which we can use to guide the decode process.
keep the old store lookup method around in case anyone doesn't pass a
uri that is a file path or provide a keytype, but if we do both those
things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell
the decoder that we want to decode the input data as the expected type
(in this case a DSA key).
Fixes#31944
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Thu Jul 16 15:28:32 2026
(Merged from https://github.com/openssl/openssl/pull/31954)
This fixes failing rand mfail test when jitter used
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:18:29 2026
(Merged from https://github.com/openssl/openssl/pull/31938)
The -gendelta, -key and -keyform options of the crl app were previously
untested. It adds a subtest that generates two CRLs with an incrementing
crlNumber and then uses -gendelta with -key to produce a delta CRL,
checking the result carries a Delta CRL Indicator. It also loads the
signing key from DER via -keyform DER, and checks that a mismatching
-keyform and a missing -key both make -gendelta fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:05:31 2026
(Merged from https://github.com/openssl/openssl/pull/31910)
Add coverage for encrypting the generated private key with a cipher,
checking it can only be read back with the correct passphrase, and that
a cipher is rejected together with the -genparam option.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/31893)
Run the fuzz corpora under mfail in addition to the normal path, so the
existing inputs also exercise malloc-failure handling. The fuzz.pl harness
sizes the mfail runs to a time budget and, on a leak, bisects down to the
exact file and injection point. Adds a budgeted asan/ubsan CI job to run it.
Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:43 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
It also fixes related memory leaks and removes extensive asserts that
should not be present in fuzzy tests.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:42 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
This adds an initial setup for unit testing on Windows that allows
mocking of system functions using Detour library. This works only for
library functions and not object function like wrap so it is a bit
limited but it is still useful for BIO mocking.
An initial BIO bss_dgram test is added covering the Windows specific
parts.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:00:35 2026
(Merged from https://github.com/openssl/openssl/pull/31915)
The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
routines through call_internal(), which on non-Win64 emitted a call to
the public global symbol by its bare name. These calls textually
precede the callees' .globl declarations, so x86_64-xlate.pl never
prepends the platform's leading underscore to the referenced symbol.
On ELF (Linux) that is harmless since symbols carry no leading
underscore, but on Mach-O (macOS) the call references the un-decorated
SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
_SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
breaking the darwin64-x86_64 link of libcrypto:
SHA3_shake128_x4_inc_absorb_avx512vl
SHA3_shake256_x4_inc_absorb_avx512vl
SHA3_shake128_x4_inc_squeeze_avx512vl
SHA3_shake256_x4_inc_squeeze_avx512vl
Call the local .L_<name> entry label instead -- the same address as the
public symbol and the pattern the finalize calls already use -- so the
reference resolves locally and these internal routines cannot be
interposed. The Win64 path is unchanged.
Fixes: https://github.com/openssl/openssl/issues/31941
Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration")
Assisted-by: Pi:z-ai/glm-5.2
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 14 12:33:50 2026
(Merged from https://github.com/openssl/openssl/pull/31942)
Create dummy encoder/decoder and store algs in p_ossltest.
They do nothing, except return algorithms on query. This allows our
unit test 30-test_evp_list_noncache.t to exercise the refcounting of
these objects when the provider requests no caching
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
https://github.com/openssl/openssl/pull/31782
Fixed method refcounting for EVP objects when the provider they are
fetched from requests no-caching, but I neglected to add simmilar
refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a
different fetch path (these use inner_[decoder|encoder|loader]_fetch
rather than inner_evp_generic_fetch.
They got missed because the p_ossltest provider that we use to test
these paths don't provide these objects, so the path never got
exercised.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:36 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Add a new CI workflow that runs AVX512 specific tests under Intel SDE
v10.8, since GitHub Actions runners do not currently have AVX512
hardware.
SDE emulates AVX512 instructions and spoofs CPUID so the AVX512 code
paths can be exercised.
Two jobs are included: linux (ubuntu-latest) and windows (windows-2022).
Each job builds OpenSSL with no-shared and enable-fips, then runs the
following tests under `sde64 -icx` (Icelake Server):
- ml_dsa_internal_test: exercises AVX512VL ML-DSA sampling
- sha3_x4_internal_test: exercises AVX512VL SHAKE x4 functions
- openssl fipsinstall: runs the full FIPS KAT suite (including ML-DSA
and SHA3 self-tests) against the FIPS provider under emulation
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:57 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Add a new `sha3_x4_internal_test` target and recipe to validate the
internal SHAKE x4 implementation against scalar SHA3 reference paths.
Cover SHAKE-128 and SHAKE-256 in one-shot and incremental modes, plus
multi-absorb and multi-squeeze cases across varied input and output
sizes. Tests are skipped when AVX512VL extensions are not available.
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:55 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Changes:
- Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported.
- Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl).
- Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules.
- Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable.
Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns
either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending
on the build and CPU capabilities.
- Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc,
included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined.
Co-authored-by: Tomasz Kantecki <tomasz.kantecki@intel.com>
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:54 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Make the check correctly handle versions such as '3.00rc8'.
It was incorrectly expecting major.minor.patch.
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Mon Jul 13 15:48:03 2026
(Merged from https://github.com/openssl/openssl/pull/31420)
Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged
initialization. If no key has been installed, update still dispatched
into the uninitialized Poly1305 state, which can crash on POLY1305_ASM
builds.
Guard update with the same key_set check used by final and report no key set.
Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before
calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE.
Fixes#31332
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 13 15:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/31382)
The -sigopt and -vfyopt options of the x509 app were previously
untested. It adds a subtest that signs a certificate from a CSR with
-sigopt rsa_padding_mode:pss and verifies the issued certificate uses
the rsassaPss signature algorithm, and that verifies an SM2 CSR whose
self-signature uses a non-default distinguishing id supplied via
-vfyopt. It also checks that an unknown -sigopt or -vfyopt makes the
command fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:41:57 2026
(Merged from https://github.com/openssl/openssl/pull/31908)
A late AAD update (AAD supplied after the payload has started) must be
rejected, and reported the same way, for every AEAD. #31673 checked this
for ChaCha20-Poly1305 alone, so this change extends it to all AEADs.
test_evp_aead_late_aad covers both the encrypt and decrypt directions and
asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 13 15:40:39 2026
(Merged from https://github.com/openssl/openssl/pull/31906)
The -pkeyopt option of the req app was previously untested. It adds a
subtest that generates an EC request with -pkeyopt
ec_paramgen_curve:P-384 and verifies the selected curve is used, and
that an unknown -pkeyopt value makes the command fail.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:36:42 2026
(Merged from https://github.com/openssl/openssl/pull/31905)
Add coverage for the -rev option of the pkeyutl app, checking that the
input buffer is reversed before the operation and that -rev is rejected
together with raw input.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/31891)
Add coverage for the DER (ASN.1) output of the dsaparam app, exercising
both the parameter output (i2d_KeyParams_bio) and the -genkey private key
output (i2d_PrivateKey_bio).
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31888)
Add coverage for the -modulus option of the dsa app, checking the
public value is printed for both private and public key input.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:31:54 2026
(Merged from https://github.com/openssl/openssl/pull/31887)
Exercise the previously uncovered show_digests() path in dgst app by
adding a subtest that runs "openssl dgst -list". It checks the header
and that sha256 and sha512 are listed, without assuming the full set of
digests which depends on the build configuration.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:05:45 2026
(Merged from https://github.com/openssl/openssl/pull/31886)
Add test/ocsptest.c, exercising check_cert_ocsp_resp() in x509_vfy.c
through X509_verify_cert() with X509_V_FLAG_OCSP_RESP_CHECK and
responses attached via X509_STORE_CTX_set_ocsp_resp(). This path was
previously only covered indirectly through the TLS multi-stapling
tests in sslapitest.c.
The test builds signed OCSP responses at run time from a flat
root -> leaf PKI (the root is both the trust anchor and the authorized
responder), and covers the good, grace-period, non-successful status,
expired, no-response, and wrong-certificate cases, plus a mfail run
over the success path. The PKI is generated by the test-tools ocsptest
command.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31828)
Cover the previously untested -RSAPublicKey_in and -RSAPublicKey_out
options of the rsa app, which select the PKCS#1 RSAPublicKey structure
rather than the SubjectPublicKeyInfo used by -pubin/-pubout. The new
subtest checks that the RSA PUBLIC KEY header is written, that the
encoding round-trips, and that it is interchangeable with the
SubjectPublicKeyInfo form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:01:22 2026
(Merged from https://github.com/openssl/openssl/pull/31802)
Exercise the previously untested -param_enc option of the ecparam app
by round-tripping the secp384r1 fixtures between named_curve and
explicit encodings (compared byte for byte against the reference
files), and check that an invalid value is rejected.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Exercise the previously untested -param_enc option of the ec app,
covering named_curve and explicit parameter encodings (compared
against checked-in reference encodings) as well as rejection of an
invalid value.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Exercise the previously untested -ec_param_enc option for pkey,
covering named_curve and explicit parameter encodings as well as
rejection of the option on a non-EC key.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:59:39 2026
(Merged from https://github.com/openssl/openssl/pull/31798)
The fake cipher provider was only available in-process, linked into test
binaries via fake_cipher_start(). To exercise app success paths (e.g.
skeyutl -genkey) the openssl app needs to load it as a provider module the
same way it loads legacy.
Make test/fake_cipherprov.c dual-buildable: drop the testutil dependency so
the source links cleanly into a module, add an OSSL_provider_init entry point
under FAKE_CIPHER_AS_MODULE, and add a fake-cipher MODULES target in
test/build.info. Also implement skeymgmt generate so opaque key generation
works, and cover the skeyutl -genkey success path in 20-test_skeyutl.t.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:58:53 2026
(Merged from https://github.com/openssl/openssl/pull/31781)
In FIPS mode EC keygen was doing 3 self tests.
ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and
ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and
comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4.
These tests covered both Keygen PCT for Key Agreement and Signatures.
ossl_ec_key_pairwise_check() was also being called from within ec_gen().
The advice from Atsec (lab) is that the sign/verify test within
ecdsa_keygen_pairwise_test() is sufficient according to the updated
rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of
the generated key is unknown at the time of key generation.
Detected during testing of Jipher by Roshith Alankandy (Oracle).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:47:00 2026
(Merged from https://github.com/openssl/openssl/pull/31761)
Introduce `reduce_twice_signed` that reduces from `(-2q,q)` to `[0,q)`.
Fix `montgomery_multiplication_vectorized` in `ml_dsa_ntt_vec128.c`
by calling `reduce_twice_signed` at the end of the computation ensuring
that the result is in `[0,q)` and not only in `(-2q,q)` or `(-q,q)`.
Do not call `reduce_once_signed` in `ossl_poly_ntt_mult_scalar_vec128`
and at the end of `ossl_ml_dsa_poly_ntt_inverse_vec128` anymore as it is
not necessary anymore after `reduce_twice_signed`.
Without this fix, keygen, sign or verify might fail or produce wrong
results.
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Mon Jul 13 14:45:11 2026
(Merged from https://github.com/openssl/openssl/pull/31744)
The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.
With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.
RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.
Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.
Closes#31635Closes#26101Closes#31629
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:41:34 2026
(Merged from https://github.com/openssl/openssl/pull/31695)
We do this odd thing in rio_notifier. when we initalize it, we call a
run_once routine to call WSAStartup(), create a lock and init a
refcount. The purpose of those last two items is to track the refcount
so that we record how many times we init that rio notifier. when the
refcount reaches zero, we tear down the windows socket api by calling
WSA cleanup, destroy the lock and refcount, and then re-initzlize the
run_once gate.
That last step is sketchy. Even though our implementations of run_once
allow doing so, we should never be re-initing those gates, as its going
to be very prone to races, and they are, well, run_once, so we should
only run them once.
It would be nice to get rid of that behavior, which we can fortunately
do.
https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-wsastartup
Indicates that WSAStartup is internally refcounted, so instead of just
calling it once and tracking when we need to correspondingly call
WSACleanup(), just call it every time we initalize an rio_notifier
object, and call WSACleanup when we tear it down. The Winsock api will
take care of knowing when it actually needs to be cleaned up for us. As
such we can eliminate the run_once routine, the refcount and the lock
entirely.
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 13 14:26:58 2026
(Merged from https://github.com/openssl/openssl/pull/31777)
Sampled tests cap allocation-failure injection at a fixed number of
sampled points, running exhaustively when the allocation count is below
that. Non-sampled tests fall back to counting only on non-cached-fetch
builds, where exhaustive injection is impractical.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 09:43:50 2026
(Merged from https://github.com/openssl/openssl/pull/31780)
asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers
commonly loop, decoding concatenated DER values until the call fails, and
rely on a failure with no queued error to recognise a clean end of input.
CPython's ssl module does this in _add_ca_certs() when loading the Windows
certificate store via SSLContext.load_verify_locations(cadata=...); it
re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
fatal.
Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
The rewrite in commit 35852da1d9 carried this behaviour forward. As a
result Python 3 on Windows fails to initialise an SSLContext with:
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
middle of an object (some bytes already buffered), or on an EOF while still
inside an indefinite-length value awaiting its end-of-contents octets - all
of which are genuine truncation. A clean EOF at a top-level object boundary
again fails without queuing an error, restoring the long-standing behaviour
that looping callers depend on.
Add regression tests covering the clean-EOF, truncated, indefinite-length
truncation and partial-header cases, and document the read behaviour in
ASN1_item_d2i_bio(3).
Fixes#31807
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 08:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/31818)
Similar to Windows CE, Windows Itanium has not had a
toolchain to work on it since VS 2010, and Windows
server 2008 was the last thing that ran on it.
This does *not* change the other (linux, HPUX) targets
which have modern toolchain support, and likely even still
run these days.
While never letting go seems noble when you won't share
the door you're floating on, the time has come.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 17:39:39 2026
(Merged from https://github.com/openssl/openssl/pull/31913)
Add NAME_CONSTRAINTS_check() coverage for empty directoryName
subtrees in both excluded and permitted constraints.
The tests assert the existing results in ordinary builds and catch
the NULL memcmp() argument when run under UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:03 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.
Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.
Fixes#31687Fixes#31688
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
Add memory-failure injection coverage to rand_test for the full
RAND_bytes_ex/RAND_priv_bytes_ex stack on a fresh library context, the
SEED-SRC entropy acquisition and the CTR-DRBG operations with a
TEST-RAND parent. The cipher fetches used by the DRBG setup are warmed
up outside the injection window so that the injection targets the RAND
machinery itself.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
The DRBG instantiation probes the parent nonce callback with a NULL
output buffer to obtain the nonce length before requesting the actual
nonce. The generate mode branch of test_rng_nonce() wrote the bytes
without checking the output pointer, crashing when TEST-RAND with
generate=1 is used as a DRBG parent. The entropy-buffer branch already
handles a NULL output correctly.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Fixed invalid-pointer-pair in the existing branch by ensuring thisex != NULL
before subtraction.
Fixes#31689
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:40:21 2026
(Merged from https://github.com/openssl/openssl/pull/31875)
Specifically bring them closer to the suggested naming conventions
and make them clang-format compliant.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:20 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
To be at the prototype site in the internal header file.
The major reason *Why* we would like to have Doxygen style comments
describing what internals do is so that they work with modern IDE's
since most common ones support them.
It's wonderful to be looking at an internal function, thinking "wtf is this",
and be able to hover over it and - boink - up comes the docs. This
typically only works (or works better) when the Doxygen comment is
at the prototype site, not if it is at the implementation site.
This also reinforces the requirement that "yes you do this for shared
functions but you don't need to for statics".
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:18 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
So this repatriates DOCUMENTATION.MD from the web page to the
code base, and links both STYLE.MD and DOCUMENTATION.MD from
CONTRIBUTING.MD
It does a large rototilling of STYLE.MD to address many of the
outstanding concerns noted when I started this before clang-format
last year, and brings us roughly in line with the things that are
addressed in similar style guides for other projects.
Most of the changed or updated reccomendations reflect what we
currently have been doing, or have expressed as a desire to
move to in the future.
Most larger "OpenSSL-isms" I've tried to explicitly call out
to make this a more cohesive and useful guide for a new contributor
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:16 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
This is effectively, the current coding style policy web page
changed to accomodate clang-format. This is more or less the
same file I have had in the various clang-format sample PR's since
September.
It does include an additional sections on Integers and on
Return Values that are not in the original coding style
policy
It is changed from the September version in that it does not
have mention of keeping include files self contained. I believe
that is achievable and desirable, but I think should be done
as a separate change from this.
There were a number of issues brought up in discussion of this
file in the clang-format PR's. I recorded those in 818, 819,
820, 821, 822, 823, 824, 825, and 826, which we can
link in there to the appropriate section of the document.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:13 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
The thread-assisted idle test advances fake time in 10ms steps while the
connection is kept alive solely by the background assist thread sending
keepalive PINGs. The test stepped fake time without checking that a due
keepalive had actually been sent, so whether it went out before the
server's idle deadline lapsed depended on thread scheduling - hence the
intermittent failure.
Now, before each step, check the event timeout (next_deadline minus
fake-now): while a keepalive is still due to be sent it stays at zero, so we
wake the assist thread and re-check without advancing until it goes positive
(or the existing real-time watchdog fires). Only then do we step fake time.
The negotiated 30s idle timeout and 60s idle duration are unchanged, so the
keepalive is still required and still tested; only the race is removed.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:33:45 2026
(Merged from https://github.com/openssl/openssl/pull/31746)
MinGW-w64 has provided bcrypt headers and import libraries since
version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding
path for supported MSVC builds. Enable the existing direct
BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or
newer, and link MinGW builds with bcrypt alongside the other Windows
import libraries.
Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined
by both the 32-bit and 64-bit MinGW-w64 toolchains.
Builds targeting older Windows versions keep the CryptoAPI fallback
because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is
below 0x0600.
Fixes#13878
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 12:05:09 2026
(Merged from https://github.com/openssl/openssl/pull/13882)
Spotted by idrassi on review. thanks!
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:21 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Now that C99 is the base level, and we are no longer supporting old
GCC's, The ossl_bio__printf__ / ossl_test__printf__ indirection only existed
to pick the gnu_printf attribute over the printf attribute for MinGW's MS-CRT printf, but
MinGW is already excluded by the outer guard, so we can use the modern attribute
everywhere this code runs.
Spotted by idrassi on review, thanks!.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:19 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
The minimum gcc to compile our code appears to be version 9, and
we are now C99.
All these older checks become a tautology on anything that will
build a modern OpenSSL tree, so clean this up.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:17 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
The only Watcom-specific code in the tree was a <tchar.h> _vsntprintf
mapping in crypto/cryptlib.c. There is no Watcom entry in Configurations/,
no CI job builds with Watcom, and the tree has had no other Watcom-aware
code in many years. The _vsntprintf symbol is supplied by <tchar.h>
on every supported Windows toolchain (MSVC, MinGW), so the conditional
fallback is dead.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Decouple the ec_point_formats extension from TLS 1.2 X.509
selection and acceptance. Remove tls1_check_pkey_comp() and its
callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3
disregards the extension already, and we can decode any point form
a peer might send, so refusing a compressed peer cert in TLS 1.2
because we didn't advertise compressed buys nothing.
The RFC 4492/8422 section 5.1.2 requirement that the peer's list
contain "uncompressed" used to be enforced in a final hook on the
client side only. Move it to the two points where the negotiated
ciphersuite is known: the client's ServerHello parse hook, and the
server's ServerHello construct hook. Both sites fire the alert
only when an ECC TLS 1.2 ciphersuite has been negotiated, so a
missing "uncompressed" is ignored under TLS 1.3 or a non-ECC
cipher. The client- and server-side parse hooks now share one
function.
Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL;
our own list is built directly inside the constructors. The
peer's list continues to be stored verbatim, and is also exposed
through the SSL_get0_ec_point_formats() accessor (now documented).
New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS
1.2 vs 1.3) plus that a compressed point form EC cert is usable on
both sides without any opt-in.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.
Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped. Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.
EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.
Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
This is a helper script that can be used to provide a boilerplate code.
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:15 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
This adds the unit testing framework that extends the build so it can
be enabled and tests are built. It is executed as part of the test
using a recipe which executes all unit tests.
The documentation is added with more info about writing the unit tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
The unit-test configure option exists only to expose the
SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
Instead of renaming it, deprecate the option and the SSL_test_functions()
function so both can be removed in OpenSSL 5.0.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:13 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
This is used for adding per target --wrap ld flags for each listed
function.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:12 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)
Commit 774525b38b moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.
Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.
Fixes#31755
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)
Set a verify tag while decrypting (which must succeed) before
attempting the read, so the test asserts that a tag cannot be read
back while decrypting even when one is _actually_ present.
This isolates direction logic from tag present logic.
Follow-up to #31734
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:06:40 2026
(Merged from https://github.com/openssl/openssl/pull/31826)
The NID_keyBag branch of dump_certs_pkeys_bag() was not exercised.
Export a file with -keypbe NONE and dump it, checking the key bag is
reported and its private key is output.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 18:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/31665)
Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.
The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.
Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.
SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).
SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().
SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Usually Emscripten emulates `/dev/urandom`, but in some cases,
like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms,
where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed
its PRNG. This fixes that by instead using the POSIX function it
implements, like which was already done for WASI.
See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 17:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31882)
(cherry picked from commit dc219a0408)
We've been concerned about ubsan errors comming with more recent
versions of clang. specifically versions of clang later than 17
generate hundreds of function pointer type validation errors, i.e.
assigning a function of type void (*)(TYPE *) to a function pointer of
type void (*)(void *).
Fixing these requires the creation of lots of thunk function that get
littered through the code base, and are generally unpleasant to carry.
A better fix requires siginficant code refactoring, and potentially
large changes to our ABI, which we can't support until the next major
release.
So, for now, just suppress those ubsan errors, so we can more properly
deal with the issue when we are able.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 16:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31837)
The standalone property_memfail.c program is superseded by memory-failure
tests added directly to property_test.c using the MFAIL harness. They
cover the same property store API surface under allocation failure
injection: ossl_method_store_new, ossl_method_store_add,
ossl_method_store_cache_set and the providerless ossl_method_store_cache_get
lookup, plus the method == NULL cache_set branch.
Unlike the old NO_CHECK-only program, the new tests run as checked mfail
tests, verifying both clean error propagation and the absence of reference
leaks on every failure path. The old program also relied on a stale,
pre-lockless STORED_ALGORITHMS layout to poke the cache directly, which no
longer matches property.c.
Drop property_memfail.c along with its wiring in test/build.info and the
90-test_memfail.t recipe.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 13:05:16 2026
(Merged from https://github.com/openssl/openssl/pull/31880)
They are failing and thus the coveralls output is not produced.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 12:20:03 2026
(Merged from https://github.com/openssl/openssl/pull/31878)
BIO_vprintf() first formats into a 512-byte stack buffer. Since
vsnprintf() returns the required length excluding the NUL, a return
value of 512 means truncation. The old strict greater-than check
therefore wrote the truncated buffer for exactly 512-byte output.
Use >= for the realloc path and add boundary coverage for 511-, 512-
and 513-byte outputs.
Fixes: a29d157fdb "Replace homebrewed implementation of *printf*() functions with libc"
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31842)
Commit aa4b47483f "Fix util/mkinstallvars.pl to treat LIBDIR
and libdir correctly" added more logs while bc44134c32 "Configure:
Remove extensive debug output by default" was under review, so those
were missed.
Complements: bc44134c32 "Configure: Remove extensive debug output by default"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 11:03:11 2026
(Merged from https://github.com/openssl/openssl/pull/31843)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:22 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:20 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:18 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:16 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:15 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Since return is an operator and not a function, parentheses
are not required.
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:13 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Found by running the checkpatch.pl Linux script to enforce coding style.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 10:11:11 2026
(Merged from https://github.com/openssl/openssl/pull/31860)
Replace #ifdef HTTP_DAEMON with #ifndef OPENSSL_NO_POSIX_IO for code
that only requires POSIX {,f}stat(), improving portability.
Retain syslog() call only when HTTP_DAEMON is defined, use
BIO_printf(bio_err) otherwise.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:43 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
Call stat() instead of fstat() when the FILE pointer provided
by BIO_get_fp() is unavailable (as it may be the case in case of UPLINK
builds).
Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:42 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
On Windows with UPLINK enabled, BIO_get_fp() may return a FILE * pointer
incompatible with the C runtime. Ensure that it returns NULL instead,
preventing undefined behavior in applications. Update the documentation
to include the missing return type for BIO_[gs]et_fp() and remove
the mention that BIO_get_fp() never returns 0, as it does so now
when NULL fp is returned.
Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 09:47:40 2026
(Merged from https://github.com/openssl/openssl/pull/28172)
EVP_MD_CTX_copy_ex() might crash on an NULL pointer access when an
inconsistent context is copied. This happens when a context is copied
where digest is set but algctx is NULL, i.e. due to an incomplete
initialization.
The copyctx shortcut for cases where the in and out contexts use the
exact same digest call the copyctx function attempting to copy
the algctx, but it does not check if algctx is NULL on the in or out
contexts.
Fix this by only taking the copyctx shortcut if algctx is non-NULL on
both, in and out. Otherwise use the full copy path which will only
duplicate the algctx if it is non-NULL.
Closes: https://github.com/openssl/openssl/issues/31831
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31867)
This is because ML-KEM change from #31432 is not backported there.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 7 16:36:07 2026
(Merged from https://github.com/openssl/openssl/pull/31870)
when sk_X509_OBJECT_push() fails after x509_object_dup() has already
allocated the duplicate, the dup is neither stored on the destination
stack nor freed: the error path only pop_free()s the stack the dup was
never pushed onto, so it is leaked.
Set env ASAN_OPTIONS in test explicitly to detect_leaks=1 to force
ASAN to fail the test. Otherwise, the test reports ok even with valid
leak.
Fixes: 08cecb4448 "Add X509_STORE_get1_objects"
Fixes: https://github.com/openssl/openssl/issues/31771
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 7 07:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/31784)
The new statem client tests added in comimt c36a9b4 assume that if
OPENSSL_NO_DTLS is not defined, that we have DTLS support, but we have
this odd setup in which we can have DTLS enabled, but DTLS1_2 disabled,
in which case the needed support isn't present, and the test fails.
why we have it setup that way, I'm not sure, but we should only run the
dtls tests if both DTLS and DTLS1_2 support is available.
Fixes#31851
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 6 09:42:44 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
This tests handshake level phase using mfail covering SSL_do_handshake.
It is a test for #31323.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:57:38 2026
(Merged from https://github.com/openssl/openssl/pull/31324)
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:53:24 2026
(Merged from https://github.com/openssl/openssl/pull/30857)
This function should never have existed. Its a TOCTOU waiting to
happen. Now that we've eliminated all internal uses, and given that its
an internal function, send it to a nice farm upstate, where it can run
and play with all the other functions that shouldn't have been.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
BIO_free_all makes use of CRYPTO_GET_REF to determine if there is
another user of a BIO chain at some artibrary point within the chain.
But CRYPTO_GET_REF is begging for a TOCTOU error, and so we're
deprecating it.
replace the use of GET_REF with an internal version of BIO_free that
returns the value of the resultant ref count, and use that instead, so
we are TOCTOU free
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:13 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
CRYPTO_GET_REF is almost by definition a TOCTOU race, and we shouldn't
use it.
As part of the effort to deprecate it, eliminate its use from
sslapitest.
Avoid the use-after-free possibility by getting a session with
SSL_get1_session (which increments the refcount) and freeing it after
we're done with it.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:10 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
The -keyform, -CAform and -CAkeyform options were not covered. Add a
test that self-signs a CSR with a DER-encoded key and signs a CSR with
a DER-encoded CA cert and CA key.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/31733)
Cover the previously untested PVK code paths of the dsa app: round-trip
the test key through the PVK encoding (mirroring the existing rsa PVK
test, and skipped unless rc4, legacy and pvkkdf are enabled), and check
that requesting PVK output for a public key input is rejected.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:30:48 2026
(Merged from https://github.com/openssl/openssl/pull/31801)
Changed internal prov_drbg_st member variable from DRBG_STATUS
to int to reflect how it was actually used.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 3 19:29:47 2026
(Merged from https://github.com/openssl/openssl/pull/31745)
The CRL signature verification path was not exercised. Add a test that
verifies a CRL signature against its issuer certificate supplied via
-CAfile, -CAstore and -CApath.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31736)
The OPT_SET_SERIAL case in req_main() was not covered. Add a test that
generates a self-signed certificate with an explicit -set_serial value
and checks it, plus the error path when -set_serial is given twice.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:25:05 2026
(Merged from https://github.com/openssl/openssl/pull/31730)
Exercise the previously uncovered X509_V_FLAG_USE_DELTAS path in
get_delta_sk(): a current delta CRL revoking kLeaf must be honored.
The base and delta CRLs are generated by `ossl-test-tools crltest delta`.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jul 3 19:22:29 2026
(Merged from https://github.com/openssl/openssl/pull/31714)
The crls != NULL block of pkcs7 -print_certs was not exercised. Build
a PKCS#7 structure containing a CRL with crl2pkcs7 and check the CRL is
both printed and output in PEM form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 3 19:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/31666)
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously
merged adjacent entries with an in-place loop that called
sk_..._delete() after each merge, making the merge O(N^2) due to the
per-merge stack shift.
Replace the merge with a single linear sweep using a write index
distinct from the read cursor: mergeable entries fold into the
previous output's upper bound in O(1), non-mergeable entries are slid
forward into the write slot, and the source slot is set to NULL so the
ASN.1 free machinery cannot double-free on a subsequent abort.
Canonicalisation is now O(N log N) overall, bounded by the existing
sort.
Mixed-state-on-error safety is provided by the caller's normal
teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set
replaces without freeing the displaced value, and
ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on
an inner failure leaves the stack in a state that the choice's normal
free path handles cleanly.
New regression tests in test/v3ext.c at N=8192 cover the all-merge,
no-merge, interleaved (slide-forward), range-merge,
overlap-mid-sweep, and inverted-range-mid-sweep paths; the
mixed-state teardown invariant is exercised under ASan + UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Jul 3 19:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/31147)
Previously the cross-compile workflow only ran the EVP tests on pull
requests, with the full test suite done only for push events. Allow the
full suite to run on a pull request when it has the 'extended tests'
label which is already used for extended tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 3 14:39:38 2026
(Merged from https://github.com/openssl/openssl/pull/31705)
Use openssl list, which uses EVP_*_do_all_provided on non-caching
algorithms. The do_all_provided path callbacks expect the algorithms
that are looked up to be saveable via up_ref, so this, when run under
asan, makes for a good test to ensure we don't trigger any use after
free situations when not caching algs.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Add the ability to direct p_ossltest to request no caching so that we
can test the provider driver non-cache code path.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:15 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
We recently removed reference counting for EVP objects, but kept the
refcounting when we build with no-cached-fetch.
There is a corner case in which providers in builds that do caching may
still request non-caching by setting *no_cache = 1 in their query
operations.
OQS tripped over this here:
https://github.com/open-quantum-safe/oqs-provider/pull/787
When a provider requests no caching, we need to treat those algorithms
as though we are running in a no-cached-fetch build and still do ref
counting on them.
Teach our algorithms implementation to understand when a provider is
requesting non-caching, mark them as such and ref count only those.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:13 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Coverity complains that the switch statements in PEM_X509_INFO_read_bio_ex()
switches on PEM_INFO_NONE, while the enclosing condition
(itype != PEM_INFO_NONE) explicitly rules it out. Pacify it by changing
the switch case to default (not removing it to avoid triggering
-Werror=switch).
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695453
Complements: 0e8f2844ed "fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
This adds test for #31268 with using SSL_read for QUIC client and
forcing key update.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Jul 2 07:21:14 2026
(Merged from https://github.com/openssl/openssl/pull/31272)
evp_asym_cipher_from_algorithm, in its error path frees the allocated
cipher with EVP_ASM_CIPHER_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_asym_cipher_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695449
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:25 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_signature_from_algorithm, in its error path frees the allocated sig
with EVP_SIGNATURE_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_signature_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695450
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:23 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
keymgmt_from_algorithm, in its error path frees the allocated keymgmt
with EVP_KEYMGMT_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keymgmt_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695452
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:21 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_keyexch_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keyexch_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695455
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:18 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
evp_kem_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_kem_free (the internal
function that acutally does free the alg) instead.
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695456
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 15:32:16 2026
(Merged from https://github.com/openssl/openssl/pull/31748)
The shutdown-side drain uses a TCP half-close and a fixed 500 ms
select() timeout to let peers consume buffered alerts before close.
Running it for DTLS/QUIC datagram connections causes an unnecessary
delay after the connection has otherwise completed.
Limit this workaround to non-DTLS, non-QUIC connections.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 13:35:53 2026
(Merged from https://github.com/openssl/openssl/pull/31558)
In www_body() and rev_body(), con = SSL_new(ctx) is called before
rpk_enable(con), but ownership of con is transferred to ssl_bio only
later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code
jumps to err: before that transfer without freeing con, leaking the SSL
object.
Add SSL_free(con) before goto err in both rpk_enable() failure paths,
matching the adjacent SSL_set_session_id_context() and BIO_new_socket()
error paths. sv_body() is unaffected because its err: block already
frees con.
The global rpk_files is not leaked. Its lifetime is managed
by s_server_main(), which frees it in the end cleanup block.
Resolves: https://github.com/openssl/openssl/issues/31769
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 12:04:13 2026
(Merged from https://github.com/openssl/openssl/pull/31789)
applink.c deliberately stores legacy CRT function pointers because
ms/uplink.h expects the old fopen and _open signatures. Keep the
table entries unchanged and suppress MSVC warning C4996 locally
around OPENSSL_Applink() instead of switching to fopen_s or
_sopen_s.
Fixes#8241
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 09:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/31765)
After the windows.h include optimization introduced in
commit 1eaf29ef6c, the _WIN32_WINNT default was changed, causing
performance regressions.
Currently, _WIN32_WINNT is defined as 0x0501, which means WinXP.
This causes the code to be compiled with WinXP-compatible code, notably
- without USE_RWLOCK
- using legacy thread implementation
- legacy RNG seeding (no BCryptGenRandom)
This patch increases the requirement to 0x600 (Windows Vista).
Note that code running on WinXP cannot currently be compiled with
any default configuration, as supported compilers generate executables
for Windows Vista and above.
If we provide some way to support WinXP, it can be done by
redefining _WIN32_WINNT.
Resolves: https://github.com/openssl/project/issues/2010
Fixes: 1eaf29ef6c "Remove direct includes of windows.h where possible"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
Current path for Windows RNG (for Vista and above) should
use BCryptGenRandom() function but the symbol is not included
in platform_symbols.
The issue was hidden before commit 1eaf29ef6c reordered
Windows header inclusion.
Moreover, a cast to ULONG is required for strict warnings build.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:17 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
For the re-init case where only the IV is specified, but no key, the 'nap'
field must also be initialized.
Instead of setting the s390 specific fields in a special case block, call
ctx->hw->init() also in this case. It performs the necessary setup already
(when the KM function code was once set already).
Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also
be called with a NULL key. It then only performs the IV setup as well as
setting up the 'nap'.
Closes: https://github.com/openssl/openssl/issues/31766
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Jul 1 09:12:26 2026
(Merged from https://github.com/openssl/openssl/pull/31775)
When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.
The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).
The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.
Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.
Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.
Fixes: 0499de5add "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)
When two providers cache the same nid and property query, the first one
to do so must own the providerless cache entry, so that a NULL-provider
lookup keeps resolving to that provider. This covers commit 9d476175d7.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 11:01:57 2026
(Merged from https://github.com/openssl/openssl/pull/31738)
The DTLS 1.2 tests exercise the same verification logic and confirm that the
behavior matches the TLS 1.2 implementation. The tests pass as expected and
provide additional coverage for DTLS 1.2 without requiring any functional
changes.
Fixes#31250
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 30 11:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/31389)
What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)
Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.
Fixes: https://github.com/openssl/openssl/issues/31195
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
Nothing set the "vfy" parameters in any of these functions to anything but 0.
Remove the parameter and stage things related to SSL_OP_SECOP to go away in the
future.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
I've been down this road a few times and nhorman@ just hit it.
While technically true, most of our opaque pointers have internal
defninitions. Stop people going down the garden path by explaining
what this is
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 09:51:37 2026
(Merged from https://github.com/openssl/openssl/pull/31708)
The signerfile != NULL block in smime_main(), reached when more than one
-signer is given (including the case where a preceding -inkey leaves
keyfile != NULL), was not exercised: the existing multi-signer tests run
through the cms command, and the smime app was only ever run with a
single signer. Add a two-signer test, with an explicit -inkey, to the
pkcs7 test set so it runs through smime when signing.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jun 30 08:57:47 2026
(Merged from https://github.com/openssl/openssl/pull/31675)
This tests memory failures in remote connection ID manager code.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:45 2026
(Merged from https://github.com/openssl/openssl/pull/31602)
Add a record layer test that executes qrx_process_pkt() under mfail
on a freshly created qrx whose rx_free freelist is empty. This
deterministically lands the qrx_ensure_free_rxe() call for the first
packet of a multi-packet datagram among the enumerated injection points
which is the precondition for triggering assert failure in
qrx_validate_hdr_early(). The test reuses rx_script_5's coalesced
Initial+Handshake+1-RTT datagram and only provides the Initial secret,
since the bug fires before any decryption is attempted.
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:00 2026
(Merged from https://github.com/openssl/openssl/pull/31331)
Add a new test which calls tls_construct_client_hello() directly,
creating an SSL_CONNECTION enough to invoke the construct function
without making a full handshake, then verifies the produced
ClientHello structurally and by round-tripping it through the
server-side tls_process_client_hello().
The covered branches include TLS 1.3 (with and without middlebox
compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS
cookie and client_random reuse paths, the deterministic error branches
(WPACKET overflow and no usable ciphers), and the ECH wrapper path
(happy path with server-side decryption, the TLS 1.2 version error, and
OOM). Out-of-memory branches are exercised with the mfail tests.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Previously this just resulted in the skip of the group but such failure
should result in a proper error. This is not a big issue but it impacts
mfail tests so it would be good to fail.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:47 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
We've tried to fix this properly using InitOnceExecuteOnce, but it
results in an ABI breakage, so we're doing it this way.
on windows, CRYPTO_THREAD_run_once, on weakly memory ordered systems,
may complete the write of the run once variable lock before some of the
writes made by the init callback routine complete. The result is that
on a heavily multithreaded application, other therads may see the data
that was meant to be in an initalized state, as in some erroneous
in-between state, leading to errors.
Fix it by inserting a full memory barrier after we return from the init
callback, and prior to setting the run once variable to ONCE_DONE.
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 08:51:16 2026
(Merged from https://github.com/openssl/openssl/pull/31713)
The RIO notifier smoke test is currently limited to
Windows targets in both the build metadata and the
test recipe.
The test exercises the notifier abstraction and can
run on other platforms as well, so this removes the
Windows-only guards.
The test remains conditional on QUIC being enabled.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jun 30 08:49:54 2026
(Merged from https://github.com/openssl/openssl/pull/31494)
Also fixes a bug in the OP_STREAM_RESET macro
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 07:54:46 2026
(Merged from https://github.com/openssl/openssl/pull/31707)
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
The default provider stored two function pointers from the core
dispatch table (c_gettable_params, c_get_params) in file-scope statics,
written by ossl_default_provider_init() without any synchronization.
When OSSL_PROVIDER_load() is invoked from multiple threads concurrently,
TSAN reports a data race on both writes[1].
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the default provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
[1] https://github.com/openssl/openssl/issues/28935
CLA: trivial
Resolves: https://github.com/openssl/openssl/issues/28935
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:52 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
This slightly improves openssl pkey text coverage.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Jun 28 17:42:46 2026
(Merged from https://github.com/openssl/openssl/pull/31521)
Since tmpstring's ownership is transferred to tmp in ASN1_STRING_set0(),
it should be allocated using OPENSSL_strdup() and not strdup()
(as it will be freed with OPENSSL_free() in ASN1_STRING_clear_free()).
Also, don't try to free tmpstring on error, as at no point there is a jump
to err when tmpstring is allocated and not owned by tmp.
Reported by Coverity, issue 1695274.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695274
Fixes: 68c0321e90 "Provide ASN1_STRING_new_not_owned()"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 28 16:22:28 2026
(Merged from https://github.com/openssl/openssl/pull/31667)
This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly
written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1,
OFB128, CTR).
Expanding macro-generated functions improves overall code readability, allows
code navigation tools to properly index the function signatures, and provides
clearer stack traces during debugging.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are
shared across multiple hardware-specific provider implementations but lacked
the internal `ossl_` prefix. They have been renamed to
`ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update`
respectively to follow OpenSSL naming conventions and prevent potential
namespace collisions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from
individual mode-specific files into a single unified file
(cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to
improve code organization and maintainability.
Additionally, this change removes the unused `keybits` parameter from several
SPARC T4 hardware initialization routines to clean up the internal API.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and
XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file.
Centralizing the platform-specific logic simplifies the code structure and
improves maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:58 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
A new helper function, zvkned_key_schedule_supported, is introduced to
centralize the verification of 128-bit and 256-bit key lengths.
This replaces multiple duplicated, hardcoded checks across the RISC-V AES
implementations to improve code readability and maintainability. It also
ensures consistent check handling for XTS mode by correctly evaluating half
the key length.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:56 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM,
and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need
for separate files for GCM and CCM, and extracts RV64-specific XTS code from
the generic XTS hardware file, improving code organization.
Additionally, remove the unused `keybits` parameter from the RV64 AES hardware
retrieval functions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:54 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM,
and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the
need for separate files (`cipher_aes_gcm_hw_rv32i.c` and
`cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally,
unused `keybits` parameters are removed from the provider hardware
initialization functions to clean up the code.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:52 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the ARMv8-specific hardware implementations for AES GCM into a single
consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific
optimizations together to improve code organization and maintainability.
Additionally, remove the unused `keybits` parameter from the ARMv8 provider
functions to simplify the function signatures.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:50 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes
from individual mode files into a single consolidated file
(`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations
together, improving code organization and maintainability.
As part of this refactoring, the unused `keybits` parameter was removed from
several AES-NI provider functions, and necessary XTS initialization and
context copy functions were exported for shared use.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc`
to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW`
dispatch structure.
This refactoring removes standalone initialization wrappers and integrates the
s390x hardware backend more cleanly with the generic AES-XTS provider code. It
also reduces code duplication by relying on the generic layer for common
validations (such as the maximum blocks per data unit limit) before invoking
the hardware-specific stream cipher.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:46 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Replace complex AES XTS initialization and hardware selection macros
(`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and
`PROV_CIPHER_HW_select_xts`) with standard C functions.
Architecture-specific initializers, particularly for RISC-V, are consolidated
to evaluate CPU capabilities within dedicated initialization functions rather
than relying on macro expansion. This refactoring improves overall code
readability, maintainability, and simplifies debugging by eliminating opaque
multi-statement macros.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:44 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The hardware-specific AES CCM implementations were previously included
directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them
to standalone `.c` files and updates the build configuration, improving
modularity by treating them as separate compilation units.
Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new
`ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code
duplication, removes unsafe macro logic, and introduces proper error handling
during provider key initialization.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:42 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Replace architecture-specific `.inc` files with standalone `.c` files for AES
ciphers and consolidate CFB mode logic into these new modules.
This eliminates the direct inclusion of source files and compiles each
hardware implementation as a separate translation unit.
This refactoring simplifies code organization and remove macro
complexity that makes it hard to understand what is implemented and
where enhancing maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:40 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper
function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA
GCM, the macro expansion was manually inlined.
This refactoring eliminates a multi-line macro to improve debuggability and
type safety. Crucially, the new function checks the return value of the
underlying key setup routines, ensuring that key initialization failures are
now correctly caught and propagated instead of being ignored.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
These files have no reason not to be just regular .c files.
Additionally apply formatting fixes which were not done on .inc files
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:35 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
After removal of Win CE support in commit c60fddbbcf "Drop Windows CE
support.", this file is no longer used. Remove it.
Complements: c60fddbbcf "Drop Windows CE support."
Reported-by: Nikola Pajkovsky <nikolap@openssl.org>
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 17:36:16 2026
(Merged from https://github.com/openssl/openssl/pull/31718)
OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme. The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed. Add OPENSSL_free(scheme) before the goto.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: e599893a9f "x509: allow SAN URIs to contain userinfo"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: 4acc3e907d "Initial support for certificate policy checking and evaluation."
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Because the duplicate test expects the cache get operation to take
a reference count (which we no longer do), we need to not count it down
before checking the resulting ref count
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:17 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:13 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:05 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:02 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:00 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:51 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
The -cipher option was not covered. Add KRB5KDF test cases that
exercise it, both via -cipher and the equivalent -kdfopt cipher: form.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:01:33 2026
(Merged from https://github.com/openssl/openssl/pull/31651)
Two subtest descriptions read "Ed2559" instead of "Ed25519".
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:37 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
The non-mmap buffer fallback in do_raw_keyop() for oneshot (only_nomd)
keys was never exercised on Unix, since any file with non-zero size
takes the mmap path and returns before reaching it. Signing and
verifying an empty file gives filesize 0, which skips the mmap block
(guarded by filesize > 0) and falls through to the buffer switch,
covering both the SIGN and VERIFY arms.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:36 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
ossl_lms_pubkey_decode() only freed pkey->encoded when the new public key
had a different length, so re-decoding a same-length key on the documented
repeated-call path overwrote the old buffer without freeing it. Always free
the existing buffer first.
Also clear pkey->encodedlen on the error path so a failed decode leaves the
key in a consistent state instead of keeping a stale length.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:58:46 2026
(Merged from https://github.com/openssl/openssl/pull/31345)
We want to add the printed out pubkey and not
just 1. Also add a comment clarifying intention of this
exercise.
Fixes 77c979faf4
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 16:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/31700)
Update the existing 4.0.0 changelog entry for the ERR state cleanup to list the removed ERR_FLAG_MARK, ERR_FLAG_CLEAR, and ERR_NUM_ERRORS macros.
Fixes#31056
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:37:57 2026
(Merged from https://github.com/openssl/openssl/pull/31598)
the d2i_*/i2d_* fp and bio wrappers for RSA_PUBKEY, the DSA and EC key
types, and the EVP_PKEY Private/PUBKEY converters passed their
type-specific functions to ASN1_{d2i,i2d}_{fp,bio}, which invoke them
through the generic d2i_of_void / i2d_of_void / void *(*)(void) pointer
types.
Add file-local thunks with the exact generic signatures that forward to
the concrete functions, and pass those instead of cast pointers. This
removes the mismatched calls while keeping the public API unchanged.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:13:01 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
use IMPLEMENT_ASN1_DUP_FUNCTION(GENERAL_NAME) so duplication goes
through ASN1_item_dup() instead of calling ASN1_dup() with cast
i2d/d2i function pointers. This avoids UBSan function type errors
while preserving the public GENERAL_NAME_dup() API.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:59 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
decode PEM payloads through the generated typed d2i_* functions in the
PEM read macros instead of routing them through the d2i_of_void
callback path. This avoids UBSan function type mismatch reports while
preserving the public PEM reader APIs.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:57 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:55 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
PEM_X509_INFO_read_bio_ex stored d2i_X509, d2i_X509_AUX, d2i_X509_CRL
or d2i_AutoPrivateKey -- each with a distinct, type-specific signature
returning X509*, X509_CRL* or EVP_PKEY* -- in a single d2i_of_void*
variable and dispatched through it:
d2i = (D2I_OF(void))d2i_X509;
...
d2i(pp, &p, len)
Replace the function-pointer dispatch with an enum tag
(pem_info_type) and a switch that calls each typed d2i_* directly
with the correctly type.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
d2i_OCSP_REQUEST/d2i_OCSP_RESPONSE are declared with type-specific
signatures returning OCSP_REQUEST*/OCSP_RESPONSE*, but the
d2i_OCSP_{REQUEST,RESPONSE}_bio macros routed them through
ASN1_d2i_bio_of -> ASN1_d2i_bio, which calls them via a
d2i_of_void* pointer:
void *(*)(void **, const unsigned char **, long)
The analogous i2d_OCSP_{REQUEST,RESPONSE}_bio macros did the same
through ASN1_i2d_bio_of -> ASN1_i2d_bio with i2d_of_void*.
Rewrite the macros to dispatch through
ASN1_item_d2i_bio/ASN1_item_i2d_bio with ASN1_ITEM_rptr(OCSP_*)
directly. This eliminates the function-pointer cast entirely; both old
and new paths bottom out in the same ASN1_item_d2i_ex / ASN1_item_i2d
call, so behavior is identical.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:50 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
ensure typed stack duplicates keep their compare, copy, and free thunks so
later operations do not call typed callbacks through erased void * function
pointer signatures.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:48 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
call OPENSSL_sk_set_thunks for sk_${nametype}_new and
sk_${nametype}_new_reserve, and wrap the long generated stack
constructor and deep-copy macros across multiple lines so the nested
thunk setup is easier to read and maintain.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:46 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Windows CE has been out of mainstream support since 2018
and will not have a modern toolchain capable of compiling
a modern OpenSSL.
The vc_wince_info Perl helper, the crypto/LPdir_wince.c
directory backend, and a long tail of _WIN32_WCE
/ OPENSSL_SYS_WINCE guards across the Windows code paths
get removed.
Spotted by idrassi.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:27:18 2026
(Merged from https://github.com/openssl/openssl/pull/31601)
Only PEM input/output was exercised. Add a subtest that round trips a
key through DER, for both unencrypted and encrypted PKCS#8.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:24:30 2026
(Merged from https://github.com/openssl/openssl/pull/31653)
ML tools do not satisfy the authorship requirement, so they are merely
used, and not "create" on their own.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Thu Jun 25 07:22:26 2026
(Merged from https://github.com/openssl/openssl/pull/31643)
Incorrect check for the upper bound allowed the value of 256 to slip
through, which could lead to OOB read one element beyound the end
of the os_toascii/os_toebcdic arrays. Fix that by changing
the comparison with 256 from strictly great to great-or-equal.
Found by cppcheck.
Fixes: a1df06b363 "This has been added to avoid the situation where some host ctype.h functions return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:19:30 2026
(Merged from https://github.com/openssl/openssl/pull/31661)
Apply change similar to the one made in d41a922519 "tls_common.c: prevent
max_early_data overflow in rlayer_early_data_count_ok()"
to ossl_early_data_count_ok(), that has similar logic in it
(as rlayer_early_data_count_ok() has been copied
from ossl_early_data_count_ok() in 9dd90232d5 "Move early data counting
out of the SSL object and into the record layer").
Complements: d41a922519 "tls_common.c: prevent max_early_data overflow in rlayer_early_data_count_ok()"
Fixes: 70ef40a05e "Check max_early_data against the amount of early data we actually receive"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:13:07 2026
(Merged from https://github.com/openssl/openssl/pull/31628)
Cover the help, option-parsing and error paths of the skeyutl command.
The successful -genkey path is not exercised as no built-in provider
implements opaque symmetric key generation yet.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:10:05 2026
(Merged from https://github.com/openssl/openssl/pull/31648)
This cover various function for SRTM.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:06:31 2026
(Merged from https://github.com/openssl/openssl/pull/31593)
Align behavior with AES GCM, which already rejects this misuse with a hard
error, by tracking whether plaintext processing has started and returning an
error if AAD is supplied afterwards.
Fixes#31188
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 07:01:44 2026
(Merged from https://github.com/openssl/openssl/pull/31673)
break long chain of MIDR_IS_CPU_MODEL() alternatives packed onto a
single line, which was effectively unreadable and impossible to review
or diff one model at a time.
move the OPENSSL_armcap_P feature-flag test to the front of the
expression so the guard is obvious before the model list. This is a
formatting-only change.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 06:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31664)
The -conv_form option was not covered. Add a subtest that checks a
valid form changes the public key encoding and that an invalid form
is rejected. The DER encodings are also compared against committed
reference files, as they are deterministic for testec-p256.pem.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 06:08:38 2026
(Merged from https://github.com/openssl/openssl/pull/31652)
ML-DSA keys should become immutable once key material has been added.
This is already the case for at least ML-KEM keys, and should generally
be the case across all key types.
- Added the requisite check in the key management provider ml_dsa_import()
function.
- Also, consolidated the ML-KEM checks in ml_kem_import(). These were
previously partly in ml_kem_key_fromdata().
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jun 25 02:03:35 2026
(Merged from https://github.com/openssl/openssl/pull/30421)
"gost2012_256/512" sigalgs aliases of IANA-GOST2012-GOST8912-GOST8912 equals
to sigalgs of LEAGACY-GOST2012-GOST8912-GOST8912 so we can't distinguish
between them for the legacy algorithm
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:04 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:02 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Avoid accessing src[len] by swapping the check order and bound check
the iterator variable before the access.
Found by cppcheck.
Fixes: cc4ea5e000 "Introduce new internal hashtable implementation"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jun 24 13:09:25 2026
(Merged from https://github.com/openssl/openssl/pull/31663)
As per RFC8446 this value must be ignored.
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jun 24 13:06:55 2026
(Merged from https://github.com/openssl/openssl/pull/31662)
We document which names and name constraints will be evaluated
as well as the limits that will be placed on the evauluation on
a per certificate basis.
We call out in the BUGS section that the RFC 5280 requires a byte
per byte match of name constraints unless the higher level protocol
has defines a different matching method for wildcards. This
"deferall of specification" and corresponding lack of specification
by upper level protocols means that across implementations encountering
the default behaviour is to be expected, and that therefore relying
on excluded names to constrain signers in a PKI from signing wildcards
is ill advised.
This is then cross referenced in the documentation for X509_verify_cert
and the maximum possible comparisons which can be forces in a certificate
validtion noted in the BUGS section of X509_verify_cert.
Fixes: https://github.com/openssl/openssl/issues/30706
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun 24 13:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/31334)
TLS 1.3 reserves handshake message type 0 and must not silently
ignore HelloRequest records. The legacy client-side HelloRequest skip
path in tls_get_message_header() could run before the TLS 1.3 state
machine had a chance to reject the message, so a zero-length
HelloRequest injected after ClientHello was discarded instead of
triggering unexpected_message.
Restrict the skip to cases where TLS 1.3 is no longer possible.
Before ServerHello selects a version, s->version is the configured
maximum; after ServerHello or during renegotiation, it is the
negotiated version. Skip only when that value is below TLS 1.3,
preserving the existing TLS 1.2-and-below behavior.
Add TLSProxy regression tests covering rejection while TLS 1.3 is
possible and the preserved TLS 1.2 skip after ServerHello.
Fixes#31531
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 13:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31577)
This prevents a theoretically possible integer overflow
in OPENSSL_malloc(outlen + 1) at the end of ASN1_mbstring_ncopy,
when outlen is exactly INT_MAX.
That affects conversions from MBSTRING_ASC to MBSTRING_UTF8
and MBSTRING_UTF8 to MBSTRING_ASC,
because a terminating zero has to be added to the result.
And also conversions MBSTRING_BMP to MBSTRING_UTF8
in cases when UTF8 characters 0x800..0xFFFF are encoded
as 3-byte UTF8-characters and the resulting UTF8-string
is exactly INT_MAX in size.
Fixes: 97f6b621f7 ("Reject oversized inputs in ASN1_mbstring_ncopy()")
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 12:49:08 2026
(Merged from https://github.com/openssl/openssl/pull/31527)
A zero-length AEAD message driven through the one-shot EVP_Cipher() interface
must agree with the streaming EVP_CipherFinal_ex() path. This checks:
- an empty message yields the same tag via both interfaces
- the true tag passes verification on decrypt
- the modified tag fails verification on decrypt
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 24 12:47:11 2026
(Merged from https://github.com/openssl/openssl/pull/31555)
Document the propq argument in the Ed448 key generation, signing,
and verification helper comments.
CLA: trivial
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 24 11:00:00 2026
(Merged from https://github.com/openssl/openssl/pull/31599)
Reject negative indices before looking up the recipient info stack
entry. This makes negative out-of-range indices match the existing
behavior for too-large positive indices and avoids dereferencing
a NULL recipient info.
Add a regression test for the negative index case.
Resolves: https://github.com/openssl/openssl/issues/30910
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed Jun 24 09:10:22 2026
(Merged from https://github.com/openssl/openssl/pull/30914)
This problem resulted in the wrong location of openssl being used
for one step in subtest 7. The error condition is hidden if openssl
appears in the PATH.
Resolves: https://github.com/openssl/openssl/issues/31496
Fixes: 3638ffc380 "Refactor cache_objects() loop and object type handling"
Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Wed Jun 24 08:47:58 2026
(Merged from https://github.com/openssl/openssl/pull/31647)
ossl_ackm_on_rx_ack_frame() stored ack_ranges[0].end into
largest_acked_pkt[pkt_space] without checking it against the highest
packet number actually sent in that space. Because largest_acked_pkt
only ever increases and drives loss detection, an ACK acknowledging a
packet number that was never sent (up to 2**62 - 1) pins the value and
causes every in-flight and subsequently-sent packet to be declared lost,
permanently corrupting loss detection for the connection.
RFC 9000 s. 13.1 recommends treating an acknowledgment for a packet the
endpoint did not send as a connection error of type PROTOCOL_VIOLATION,
where it can be detected.
Reject any ACK whose largest acknowledged packet number exceeds the
highest packet number sent in that space; the bound, highest_sent, is
already tracked. The depacketiser raises PROTOCOL_VIOLATION when the ACK
manager rejects the frame.
Update the QUIC tests for the new behaviour: cases 7 and 8 now assert
rejection, case 14 covers the 2**62 - 1 boundary, two pre-existing
fixtures that acknowledged one packet past the highest sent are
corrected, and the "fictional PN" script now expects a PROTOCOL_VIOLATION
close.
Fixes: fa4e92a70a "QUIC ACK Manager, Statistics Manager and Congestion Control API"
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:36:27 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
RSA_PSS_PARAMS_dup() can return NULL on failure (e.g. memory
allocation failure). The subsequent code dereferenced dupkey->pss
unconditionally when checking dupkey->pss->maskGenAlgorithm, which
would result in a NULL pointer dereference.
Check the return value and jump to the error handling instead, which
properly frees the partially constructed key.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:32:24 2026
(Merged from https://github.com/openssl/openssl/pull/31619)
Update signature_tls13_scheme_list array in accordance with the current
state of the "TLS SignatureScheme" table at [1]; leave TLS 1.2 GOST
definitions be for now.
Note: these are used only for debugging output when -security_debug
option is provided to s_client/s_server commands.
[1] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jun 23 16:30:02 2026
(Merged from https://github.com/openssl/openssl/pull/31248)
The macro definitions for the SignatureScheme values and names
are available "include/internal/tlssigalgs.h" (contrary to what comment
says), use them and also order the items in the order they are present
in the header file.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jun 23 16:29:59 2026
(Merged from https://github.com/openssl/openssl/pull/31248)
key2ms_newctx() returned struct key2ms_ctx_st *, but is registered
as OSSL_FUNC_ENCODER_NEWCTX and called through OSSL_FUNC_encoder_newctx_fn
(void *(*)(void *)), which is a case of undefined behavior, flagged
by -fsanitize=function. Same class as [1], missed there.
Give it the correct signature and add the self-check forward
declaration, as key2ms_freectx() already has.
[1] https://github.com/openssl/openssl/pull/31078
CLA: trivial
Fixes: 0cc0164d19 "PROV: Add MSBLOB and PVK encoders"
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jun 23 14:45:54 2026
(Merged from https://github.com/openssl/openssl/pull/31189)
This slightly improves its coverage.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 14:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31589)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 13:16:52 2026
(Merged from https://github.com/openssl/openssl/pull/31249)
quic_multistream test to radix without dealing with conflict+rebase.
the idea is there will be one PR for each script, so more people
will be able to submit those PRs without rsiking a conflicts around
the scripts array. This should allow for smoot reciew/git push
flow.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 23 12:21:25 2026
(Merged from https://github.com/openssl/openssl/pull/31547)
Attempt to make the documentation match the code.
Not attempting to change what the code does at this point, it's
all very random, and since it's been there, it is effectively established
public API now.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 11:56:58 2026
(Merged from https://github.com/openssl/openssl/pull/31549)
Return 0 when the passed object to PKCS7_set_digest() is not of type PKCS7
digest.
Fixes: c5a5546389 "Add support for digested data PKCS#7 type."
Resolves: https://github.com/openssl/openssl/issues/31551
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jun 22 08:17:32 2026
(Merged from https://github.com/openssl/openssl/pull/31559)
The check referenced USE_INTERLOCKEDOR64, but the macro defined above
for MSVC (with the right architecture/version) and 64-bit MinGW is
OSSL_USE_INTERLOCKEDOR64. As a result, OSSL_ATOMICS_LOCKLESS was
never defined on Windows, even though those toolchains do provide
lockless atomics.
Reported-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Fixes: 26c5742393 "Use the actually correct define for solaris and gcc"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 07:22:31 2026
(Merged from https://github.com/openssl/openssl/pull/31600)
Make the local max_early_data variable uint64_t so an overflow
cannot occur if the max_early_data field in the record layer struct
has the maximum value: UNT32_MAX (0xFFFFFFFF).
Resolves: https://github.com/openssl/openssl/issues/31533
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Sun Jun 21 23:50:02 2026
(Merged from https://github.com/openssl/openssl/pull/31538)
Replace the per-call-site `(ASN1_aux_const_cb *)aux->asn1_cb` cast in
ASN1_item_ex_i2d() and asn1_item_print_ctx() with a shared helper,
ossl_asn1_aux_const_cb(), which invokes the legacy non-const callback
through its real type. This avoids the UBSAN function-pointer-type
mismatch while preserving backward compatibility.
Fixes: https://github.com/openssl/project/issues/1970
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 23:38:12 2026
(Merged from https://github.com/openssl/openssl/pull/31541)
In the HTTP/3 demo server's :path handler, when the path value does not
begin with '/', the value is copied into the fixed-size url[MAXURL]
buffer with memcpy(h3ssl->url, vvalue.base, len) and no terminator is
written. len is capped at MAXURL, so a :path value of MAXURL or more
bytes fills the entire buffer, overwriting the zeroes from the preceding
memset and leaving url without a NUL terminator. The buffer is later
used as a C string by strcat() and strcmp() when building the file name,
resulting in a heap out-of-bounds read and a possible overflow of the
filename[PATH_MAX] buffer. This is reachable from a client-supplied
:path header.
Cap the length at MAXURL - 1 so that the trailing byte zeroed by the
memset always remains, guaranteeing url is NUL-terminated in every
branch. The '/'-prefixed branches are unaffected as they already write
an explicit terminator within the smaller bound.
Fixes#31516
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 16:19:08 2026
(Merged from https://github.com/openssl/openssl/pull/31520)
This tests currently uncovered setup_peer function and some failure
scenarios in it.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 16:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31518)
On cygwin/msys systems that run on Windows, command line length is limited. using response file instead of putting objects on the command line will avoid this error
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 15:56:08 2026
(Merged from https://github.com/openssl/openssl/pull/23077)
Currently errors from s390x_mod_exp_hw() and s390x_crt() are silently
ignored and the software path is used as fallback.
Change this to only take the software path if s390x_mod_exp_hw() and
s390x_crt() returns 0 to indicate that it does not support the RSA
acceleration. In case of errors, return them to the caller. Errors could
be memory allocation failures or errors during BIGNUM calls. Those should
not be ignored, but reported as failure.
Note that it can happen that the ioctl's fail, but this is not to be
reported as error. Those are situations where for example no suitable
crypto adapter is available, or the file descriptor has been closed
by a sandbox. Those situations disable the RSA acceleration for further
RSA requests, but the current operation should still be performed via the
software fallback. For cases where the RSA key size is too large for
acceleration, the operation must also be performed via the software
fallback, and not reported as an error.
This also fixes failures of the test_rsa_pkcs1_mfail test case that found
the memory allocation failures that got ignored.
Resolves: https://github.com/openssl/openssl/issues/31480
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 21 14:19:54 2026
(Merged from https://github.com/openssl/openssl/pull/31482)
Currently errors from s390x_HMAC_init() are silently ignored and the software
path is used as fallback.
Change this to only take the software path if s390x_HMAC_init() returns -1
to indicate that it does not support the HMAC acceleration. In case of
errors, return them to the caller. Errors could be memory allocation
failures or errors during digest operations. Those should not be ignored,
but reported as failure.
This also fixes failures of the test_rsa_pkcs1_mfail test case that found
the memory allocation failures that got ignored.
References: https://github.com/openssl/openssl/issues/31480
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 21 14:19:53 2026
(Merged from https://github.com/openssl/openssl/pull/31482)
Store in_flight flag in a local variable for later use, as apkt->on_acked()
may free apkt.
Fixes: 427a02ad0a "QUIC ACKM: Don't record non-inflight packets in CC"
Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sun Jun 21 13:55:08 2026
(Merged from https://github.com/openssl/openssl/pull/31447)
It should be included via e_os.h instead.
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jun 20 11:00:42 2026
(Merged from https://github.com/openssl/openssl/pull/31587)
2026-06-20 07:00:32 -04:00
655 changed files with 32730 additions and 8314 deletions
