Todd Short [Fri, 17 Jul 2026 21:34:11 +0000 (17:34 -0400)]
errors: fix stale string overrides in openssl.txt for renamed SSL error codes
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
Viktor Dukhovni [Sat, 11 Jul 2026 14:35:35 +0000 (00:35 +1000)]
Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Nikola Pajkovsky [Thu, 16 Jul 2026 12:15:56 +0000 (14:15 +0200)]
quic: report SRTM entry match status via an output argument
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
Andrew Dinh [Sun, 12 Jul 2026 16:50:05 +0000 (23:50 +0700)]
Wire radix QUIC test framework clock to simulated time
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
Andrew Dinh [Mon, 20 Jul 2026 02:05:59 +0000 (09:05 +0700)]
Fix clean target find/-prune precedence bug
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5 Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
Jakub Zelenka [Tue, 14 Jul 2026 16:26:40 +0000 (18:26 +0200)]
apps: test rsa -text option
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: check return values of SSL_* calls
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: use SSL_set1_ipaddr() instead of SSL_set1_host()
As the latter was deprecated in commit f584ae959cbc "Let's support
multiple names for certificate verification".
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: declare locally used functions as static
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos: add PKCS#12 reading and writing demos to the primary build system
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad31 "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad31 "Convert demos to primary build system" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/README.txt: mention quic-server-block.c and quic-server-non-block.c
Complements: dad45ea769dc "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb01 "Add demo QUIC non-blocking server" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b546 "MVP demo TLS
server", which, while was applied after 2000281dad31 "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b546 "MVP demo TLS server" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/guide/tls-server-block.c: check results of __owur API calls
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Weidong Wang [Sat, 28 Mar 2026 08:33:47 +0000 (03:33 -0500)]
Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
John Claus [Fri, 10 Apr 2026 09:21:30 +0000 (03:21 -0600)]
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type.
Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1.
Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands.
Fixes openssl#30432
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 11:10:47 2026
(Merged from https://github.com/openssl/openssl/pull/30655)
Enji Cooper [Fri, 5 Sep 2025 04:27:29 +0000 (21:27 -0700)]
Add mandoc output support for manpages
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
Fix SM2 RISC-V64 crash from functions emitted into .rodata
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Jakub Zelenka [Thu, 2 Jul 2026 15:37:37 +0000 (17:37 +0200)]
apps: add offline OCSP request/responder/verify round-trip test
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Jakub Zelenka [Sat, 4 Jul 2026 11:58:00 +0000 (13:58 +0200)]
statem: test tls_construct_client_certificate
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Jakub Zelenka [Fri, 17 Jul 2026 22:09:30 +0000 (00:09 +0200)]
apps: decode DTLSv1.2 records in s_client/s_server -msg output
The msg_cb message callback used by the -msg option only recognised
DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as
"Not TLS data or unknown version" instead of being decoded. Add
DTLS1_2_VERSION to the recognised version check and to the ssl_versions
lookup table, and wrap the now-overlong condition.
Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and
DTLSv1.2, logging the protocol messages via -msg, and checks that every
record is decoded (no "Not TLS data or unknown version" lines).
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jul 20 09:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/31994)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:23:09 +0000 (11:23 +0200)]
test: update provider Valgrind suppression
The internal provider test intentionally retains its configured provider
when OPENSSL_cleanup() is skipped under OSSL_USE_VALGRIND. The existing
suppression accounts for this state but no longer matches the provider
activation stack because provider_init() appears between
OSSL_provider_init() and provider_activate().
Add the missing frame so the provider context and its diagnostic strings
are correctly suppressed.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:11 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:05:35 +0000 (11:05 +0200)]
test: clean up thread-local key in QUIC radix tests
The QUIC radix test creates a new thread-local key for each script but
only clears the associated value during teardown. The key itself
is never deleted.
Delete the thread-local key after all child threads have joined and the
main-thread value has been cleared.
1,536 bytes in 3 blocks are still reachable in loss record 873 of 915
at 0x488D0B0: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
by 0x49561CF: pthread_setspecific@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
by 0x5C0FD7: CRYPTO_THREAD_set_local (threads_pthread.c:1030)
by 0x41132F: radix_thread_init (quic_bindings.c:570)
by 0x4114F7: bindings_process_init (quic_bindings.c:604)
by 0x422563: test_script (main.c:28)
by 0x5152DF: run_tests (driver.c:518)
by 0x517447: main (main.c:52)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:10 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:41:06 +0000 (09:41 +0200)]
test/p_ossltest: fix uninitialised bytes written in TLS1-AAD GCM mode
The test provider's fake AES-128-GCM cipher works by running the real
sub-cipher for its side effects and then copying the memdup'd input
back over the output buffer, so the "encrypted" record is really the
plaintext.
In a TLS record the buffer handed to the cipher reserves an
uninitialised 8-byte explicit IV at the front and a 16-byte auth tag
at the end for the cipher to fill. OPENSSL_memdup() duplicated those
uninitialised IV/tag regions, and the subsequent memcpy(out, inbuf, inl)
copied them into out. That output was then written to the socket,
triggering valgrind's "Syscall param write(buf) points to uninitialised
byte(s)":
at sock_write (bss_sock.c:155)
by bwrite_conv (bio_meth.c:79)
by BIO_write (bio_lib.c:397)
by statem_flush (statem.c:963)
by ossl_statem_client_post_work (statem_clnt.c:881)
...
Track whether EVP_CTRL_AEAD_TLS1_AAD was set (recorded in
set_ctx_params) and, when encrypting a TLS record, copy only the
plaintext payload back, leaving the explicit IV and tag that the real
sub-cipher actually produced intact.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:08 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:51:51 +0000 (09:51 +0200)]
test: include PID in valgrind log file names
Append the %p (process ID) placeholder to valgrind's --log-file in
both app() and test(). When a test spawns multiple processes sharing
the same result index, they previously wrote to the same log file and
clobbered each other's output. Using %p gives each process its own
log, so no valgrind findings are lost.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:07 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Jakub Zelenka [Mon, 13 Jul 2026 16:49:29 +0000 (18:49 +0200)]
mkwraps: resolve system (libc) functions via compiler include paths
WRAP[] lists mix OpenSSL functions with libc/POSIX ones such as read()
or socket(), which mkwraps.pl reported as "declaration not found" since
it only searched the project's INCLUDE[] directories.
Fall back to the C compiler's default include search paths for functions
missing from the project headers. They are queried lazily, only on such
a miss, so the all-OpenSSL case still does not walk /usr/include. Parse
the glibc trailing attribute macros (__THROW, __wur, ...) and restrict
qualifier, and add --cc and --no-system.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 20 07:00:57 2026
(Merged from https://github.com/openssl/openssl/pull/31936)
Jakub Zelenka [Tue, 14 Jul 2026 14:59:10 +0000 (16:59 +0200)]
apps: add dgst test coverage for -keyform option
The -keyform (OPT_KEYFORM) option of the dgst app was not exercised by
any test. Add a subtest that converts the RSA test keys to DER and
then signs and verifies with -keyform DER, covering the option for both
the private and public key loading paths.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 06:40:45 2026
(Merged from https://github.com/openssl/openssl/pull/31946)
Jakub Zelenka [Tue, 14 Jul 2026 16:18:26 +0000 (18:18 +0200)]
apps: test dsa -text option
The -text option of the dsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testdsa.pem keypair rather
than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 06:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/31949)
Bob Beck [Wed, 10 Jun 2026 22:44:04 +0000 (16:44 -0600)]
Add a patch disabling the pem_encoder test
This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)
The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Mon, 11 May 2026 17:15:02 +0000 (11:15 -0600)]
Convert internal use of ASN1_STRING_set and ASN1_STRING_length
to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Thu, 14 May 2026 23:50:49 +0000 (17:50 -0600)]
pass length in cmp_msg stuff
ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Mon, 11 May 2026 16:30:04 +0000 (10:30 -0600)]
Prepare a now opaque ASN1_STRING for the size_t rapture.
Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.
Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.
We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().
ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.
Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.
Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.
Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Jakub Zelenka [Sun, 12 Jul 2026 13:02:35 +0000 (15:02 +0200)]
test: don't depend on DTLS alert delivery in sslrecords test
The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.
Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.
Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Jul 18 12:53:26 2026
(Merged from https://github.com/openssl/openssl/pull/31927)
Jakub Zelenka [Tue, 14 Jul 2026 16:38:57 +0000 (18:38 +0200)]
apps: test pkey -encopt option
The -encopt option of the pkey app was not exercised by any test; the
existing ML-DSA codec tests only used genpkey -encopt and pkey with
-provparam. Re-encode the seed-priv key into each supported PKCS#8
output format via 'pkey -encopt output_formats:<form>' and check the
result matches the reference for that form. A control compares against
the default (no -encopt) encoding so the match is attributed to -encopt
rather than the default behaviour.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:51:40 2026
(Merged from https://github.com/openssl/openssl/pull/31951)
Jakub Zelenka [Tue, 14 Jul 2026 17:01:24 +0000 (19:01 +0200)]
apps: test ec and ecparam -text options
The -text option was not exercised for the ec or ecparam apps. Add a
subtest to 15-test_ec.t that prints a private and a public EC key and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testec-p256.pem keypair as
well as the curve identification. Add a subtest to 15-test_ecparam.t
that prints named and explicit parameters, checking the named form emits
the expected curve OID and NIST name while the explicit form emits the
field parameters and no OID.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:47:12 2026
(Merged from https://github.com/openssl/openssl/pull/31952)
Andrew Dinh [Fri, 3 Jul 2026 11:18:17 +0000 (18:18 +0700)]
Introduce OP_BIND() to QUIC RADIX test framework
RADIX framework keeps objects needed by test scripts
in two places:
- hash table bound to radix process (`RP()->objs`), all
objects are stored there
- slot which is an array bound to radix thread (`RT()->slot[]`)
The `slot` is an array which is used to pass arguments
to RADIX ops. The typically script is doing something
like this:
```
OP_SELECT_SSL(0, C); /* places 'C' object to slot 0 in thread */
OP_FUNC(print_ssl); /* calls print_ssl function, which prints object */
```
All objects are managed by RADIX framework, scripts have very
limited options to control object's lifetime. The only way for
scripts to let object go is to use `OP_UNBIND()`. The operation
removes the object from hastable (`RP()->objs`) and frees the
object afterwards. This is good enough as long a all tests
are running in single thread. Currently `OP_UNBIND()` is
required when test needs to accept/create more than one stream.
The test has two options. It can use unique name for each
stream it creates/accepts:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_ACCEPT_STREAM_WAIT(C, C1, 0);
OP_ACCEPT_STREAM_WAIT(C, C2, 0);
```
Or script may re-use the same variable for stream,
in that case `OP_UNBIND()` is needed:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
```
Unfortunately `OP_UNBIND()` can not be used when test
uses more than one thread due to missing locking of `RP()->objs`.
Introducing a locking scheme seems to be bit invasive change,
The OP_BIND() here hopes to be sufficient and good enough for now.
The idea is as follows:
- `OP_BIND()` allows script to insert empty object
into `RP()->objs` OP_BIND() is supposed to run before
script spawns thread(s). No manipulation of `RP()->objs`
is allowed after threads are spawned, operations
OP_BIND()/OP_UNBIND() are not thread safe.
- Introduce `OP_F_REPLACE_STREAM` flag which tells
`OP_ACCEPT_STREAM_WAIT()`/`OP_NEW_STREAM()` to re-use
existing id for stream. This `_REPLACE_` flag requires
read-only access to `RP()->objs` hash table.
- change introduces a per radix object mutex so object can
be updated safely w.r.t. RADIX thread which ticks SSL object
bound in radix object.
The guideline for tests which require more then one thread
is as follows:
- the first thread creates complete set of empty objects
for all threads.
- each test thread gets its own set of variables, so it
can populate them later during test with SSL objects
- objects are not supposed to be shared between threads
This is a snippet of script executed by main thread before
additional threads are spawned:
```
...
OP_BIND(C1); /* stream id for child */
OP_BIND(S1); /* stream id for parent */
OP_SPAWN_THREAD(child);
for (i = 0; i < 10; i++) {
OP_NEW_STREAM(S, S1, OP_F_REPLACE_STREAM);
OP_WRITE_B(S1, "foo");
OP_CONCLUDE(S1);
}
```
This snippet comes from child:
```
for (i = 0; i < 10; i++) {
OP_ACCEPT_STREAM_WAIT(C, C1, OP_F_REPLACE_STREAM);
OP_READ_EXPECT_B(C1, "foo");
OP_EXPECT_FIN(C1);
}
```
As you can see parent and child don't use OP_BIND()/OP_UNBIND()
after child thread is spawned.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri Jul 17 08:02:04 2026
(Merged from https://github.com/openssl/openssl/pull/31821)
Jakub Zelenka [Thu, 16 Jul 2026 08:53:53 +0000 (10:53 +0200)]
rand: fix jitter seed macro logic
The seeding macro logic was mixed up and incompletely applied. The
macro logic was also cleaned up.
Co-authored-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 17 04:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31970)
Is failing when attempting to read in a der file converting from a
corresponding PEM file containing DSA parameters.
Interestingly The problem was only occuring when:
1) The input was a DER file
and
2) Blake2 was not configured
Doing some tracing of the decoder operation showed that this is occuring
because the OSSL_STORE lookup used to find the proper decoder uses a
"first successful decode wins" approach, after which the loading code
checks to see if the decoded type matches the expected key type.
When decoding PEM, this isn't a problem, as the PEM armoring gives the
decoder a hint as to why type of data the input file is.
But with DER, there is no such hint, and we're at the mercy of whichever
decoder happens to decode the data correctly first. Normally it works
just fine, but when features are disabled or enabled, the order in which
the decoders are attempted may change, affecting the outcome. In this
particular case, disabling blake2 caused the DHX decoder to be attempted
first, which decodes the input der file without issue. That in turn
caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting
a DSA key), and so the test fails.
Fortunately, the code that the dsaparam applet uses to do this decode
provides a keytype hint, which we can use to guide the decode process.
keep the old store lookup method around in case anyone doesn't pass a
uri that is a file path or provide a keytype, but if we do both those
things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell
the decoder that we want to decode the input data as the expected type
(in this case a DSA key).
Fixes #31944
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Thu Jul 16 15:28:32 2026
(Merged from https://github.com/openssl/openssl/pull/31954)
Jakub Zelenka [Thu, 9 Jul 2026 10:53:29 +0000 (12:53 +0200)]
apps: cover the crl -gendelta, -key and -keyform options
The -gendelta, -key and -keyform options of the crl app were previously
untested. It adds a subtest that generates two CRLs with an incrementing
crlNumber and then uses -gendelta with -key to produce a delta CRL,
checking the result carries a Delta CRL Indicator. It also loads the
signing key from DER via -keyform DER, and checks that a mismatching
-keyform and a missing -key both make -gendelta fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:05:31 2026
(Merged from https://github.com/openssl/openssl/pull/31910)
Jakub Zelenka [Wed, 8 Jul 2026 11:29:24 +0000 (13:29 +0200)]
apps: test genpkey app cipher option
Add coverage for encrypting the generated private key with a cipher,
checking it can only be read back with the correct passphrase, and that
a cipher is rejected together with the -genparam option.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/31893)
Jakub Zelenka [Tue, 28 Apr 2026 17:22:46 +0000 (19:22 +0200)]
Integrate mfail functionality to fuzz tests
Run the fuzz corpora under mfail in addition to the normal path, so the
existing inputs also exercise malloc-failure handling. The fuzz.pl harness
sizes the mfail runs to a time budget and, on a leak, bisects down to the
exact file and injection point. Adds a budgeted asan/ubsan CI job to run it.
Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:43 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
Jakub Zelenka [Thu, 11 Jun 2026 17:05:43 +0000 (19:05 +0200)]
test: add Windows unit tests setup and initial dgram test
This adds an initial setup for unit testing on Windows that allows
mocking of system functions using Detour library. This works only for
library functions and not object function like wrap so it is a bit
limited but it is still useful for BIO mocking.
An initial BIO bss_dgram test is added covering the Windows specific
parts.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:00:35 2026
(Merged from https://github.com/openssl/openssl/pull/31915)
Richard Levitte [Tue, 14 Jul 2026 09:34:56 +0000 (11:34 +0200)]
keccak1600x4-avx512vl: fix undefined symbols on macOS
The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
routines through call_internal(), which on non-Win64 emitted a call to
the public global symbol by its bare name. These calls textually
precede the callees' .globl declarations, so x86_64-xlate.pl never
prepends the platform's leading underscore to the referenced symbol.
On ELF (Linux) that is harmless since symbols carry no leading
underscore, but on Mach-O (macOS) the call references the un-decorated
SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
_SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
breaking the darwin64-x86_64 link of libcrypto:
Call the local .L_<name> entry label instead -- the same address as the
public symbol and the pattern the finalize calls already use -- so the
reference resolves locally and these internal routines cannot be
interposed. The Win64 path is unchanged.
Fixes: https://github.com/openssl/openssl/issues/31941 Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration") Assisted-by: Pi:z-ai/glm-5.2 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 14 12:33:50 2026
(Merged from https://github.com/openssl/openssl/pull/31942)
Neil Horman [Fri, 3 Jul 2026 13:05:58 +0000 (09:05 -0400)]
ugment p_ossltest with encoder/decoder/store algs
Create dummy encoder/decoder and store algs in p_ossltest.
They do nothing, except return algorithms on query. This allows our
unit test 30-test_evp_list_noncache.t to exercise the refcounting of
these objects when the provider requests no caching
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Neil Horman [Fri, 3 Jul 2026 12:40:06 +0000 (08:40 -0400)]
Fix refcounting for ENCODER/DECODER/STORE methods without caching
https://github.com/openssl/openssl/pull/31782
Fixed method refcounting for EVP objects when the provider they are
fetched from requests no-caching, but I neglected to add simmilar
refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a
different fetch path (these use inner_[decoder|encoder|loader]_fetch
rather than inner_evp_generic_fetch.
They got missed because the p_ossltest provider that we use to test
these paths don't provide these objects, so the path never got
exercised.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:36 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Marcel Cornu [Tue, 5 May 2026 13:33:04 +0000 (13:33 +0000)]
.github: add AVX512VL workflow using Intel SDE
Add a new CI workflow that runs AVX512 specific tests under Intel SDE
v10.8, since GitHub Actions runners do not currently have AVX512
hardware.
SDE emulates AVX512 instructions and spoofs CPUID so the AVX512 code
paths can be exercised.
Two jobs are included: linux (ubuntu-latest) and windows (windows-2022).
Each job builds OpenSSL with no-shared and enable-fips, then runs the
following tests under `sde64 -icx` (Icelake Server):
- ml_dsa_internal_test: exercises AVX512VL ML-DSA sampling
- sha3_x4_internal_test: exercises AVX512VL SHAKE x4 functions
- openssl fipsinstall: runs the full FIPS KAT suite (including ML-DSA
and SHA3 self-tests) against the FIPS provider under emulation
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:57 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Add a new `sha3_x4_internal_test` target and recipe to validate the
internal SHAKE x4 implementation against scalar SHA3 reference paths.
Cover SHAKE-128 and SHAKE-256 in one-shot and incremental modes, plus
multi-absorb and multi-squeeze cases across varied input and output
sizes. Tests are skipped when AVX512VL extensions are not available.
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:55 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Changes:
- Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported.
- Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl).
- Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules.
- Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable.
Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns
either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending
on the build and CPU capabilities.
- Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc,
included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined.
Co-authored-by: Tomasz Kantecki <tomasz.kantecki@intel.com> Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:54 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Mounir IDRASSI [Wed, 3 Jun 2026 14:44:22 +0000 (23:44 +0900)]
poly1305: reject no-key update and NULL key params
Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged
initialization. If no key has been installed, update still dispatched
into the uninitialized Poly1305 state, which can crash on POLY1305_ASM
builds.
Guard update with the same key_set check used by final and report no key set.
Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before
calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE.
Fixes #31332
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 13 15:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/31382)
Jakub Zelenka [Thu, 9 Jul 2026 10:18:18 +0000 (12:18 +0200)]
apps: cover the x509 -sigopt and -vfyopt options
The -sigopt and -vfyopt options of the x509 app were previously
untested. It adds a subtest that signs a certificate from a CSR with
-sigopt rsa_padding_mode:pss and verifies the issued certificate uses
the rsassaPss signature algorithm, and that verifies an SM2 CSR whose
self-signature uses a non-default distinguishing id supplied via
-vfyopt. It also checks that an unknown -sigopt or -vfyopt makes the
command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:41:57 2026
(Merged from https://github.com/openssl/openssl/pull/31908)
Billy Brumley [Thu, 9 Jul 2026 09:33:01 +0000 (05:33 -0400)]
[test] check late AAD rejection across AEADs
A late AAD update (AAD supplied after the payload has started) must be
rejected, and reported the same way, for every AEAD. #31673 checked this
for ChaCha20-Poly1305 alone, so this change extends it to all AEADs.
test_evp_aead_late_aad covers both the encrypt and decrypt directions and
asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 13 15:40:39 2026
(Merged from https://github.com/openssl/openssl/pull/31906)
Jakub Zelenka [Thu, 9 Jul 2026 07:27:35 +0000 (09:27 +0200)]
apps: cover the req -pkeyopt option
The -pkeyopt option of the req app was previously untested. It adds a
subtest that generates an EC request with -pkeyopt
ec_paramgen_curve:P-384 and verifies the selected curve is used, and
that an unknown -pkeyopt value makes the command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:36:42 2026
(Merged from https://github.com/openssl/openssl/pull/31905)
Jakub Zelenka [Wed, 8 Jul 2026 10:32:18 +0000 (12:32 +0200)]
apps: test pkeyutl app -rev option
Add coverage for the -rev option of the pkeyutl app, checking that the
input buffer is reversed before the operation and that -rev is rejected
together with raw input.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/31891)
Jakub Zelenka [Tue, 7 Jul 2026 21:11:44 +0000 (23:11 +0200)]
apps: test dsaparam app DER output paths
Add coverage for the DER (ASN.1) output of the dsaparam app, exercising
both the parameter output (i2d_KeyParams_bio) and the -genkey private key
output (i2d_PrivateKey_bio).
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31888)
Jakub Zelenka [Tue, 7 Jul 2026 18:21:27 +0000 (20:21 +0200)]
apps: add test coverage for dgst -list
Exercise the previously uncovered show_digests() path in dgst app by
adding a subtest that runs "openssl dgst -list". It checks the header
and that sha256 and sha512 are listed, without assuming the full set of
digests which depends on the build configuration.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:05:45 2026
(Merged from https://github.com/openssl/openssl/pull/31886)
Jakub Zelenka [Thu, 2 Jul 2026 11:45:16 +0000 (13:45 +0200)]
x509: add ocsptest for the OCSP stapled-response verification path
Add test/ocsptest.c, exercising check_cert_ocsp_resp() in x509_vfy.c
through X509_verify_cert() with X509_V_FLAG_OCSP_RESP_CHECK and
responses attached via X509_STORE_CTX_set_ocsp_resp(). This path was
previously only covered indirectly through the TLS multi-stapling
tests in sslapitest.c.
The test builds signed OCSP responses at run time from a flat
root -> leaf PKI (the root is both the trust anchor and the authorized
responder), and covers the good, grace-period, non-successful status,
expired, no-response, and wrong-certificate cases, plus a mfail run
over the success path. The PKI is generated by the test-tools ocsptest
command.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31828)
Jakub Zelenka [Tue, 30 Jun 2026 17:55:44 +0000 (19:55 +0200)]
apps: test rsa app -RSAPublicKey_in/-RSAPublicKey_out options
Cover the previously untested -RSAPublicKey_in and -RSAPublicKey_out
options of the rsa app, which select the PKCS#1 RSAPublicKey structure
rather than the SubjectPublicKeyInfo used by -pubin/-pubout. The new
subtest checks that the RSA PUBLIC KEY header is written, that the
encoding round-trips, and that it is interchangeable with the
SubjectPublicKeyInfo form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:01:22 2026
(Merged from https://github.com/openssl/openssl/pull/31802)
Jakub Zelenka [Tue, 30 Jun 2026 17:21:26 +0000 (19:21 +0200)]
apps: test ecparam app -param_enc option
Exercise the previously untested -param_enc option of the ecparam app
by round-tripping the secp384r1 fixtures between named_curve and
explicit encodings (compared byte for byte against the reference
files), and check that an invalid value is rejected.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Jakub Zelenka [Tue, 30 Jun 2026 17:14:23 +0000 (19:14 +0200)]
apps: test ec app -param_enc option
Exercise the previously untested -param_enc option of the ec app,
covering named_curve and explicit parameter encodings (compared
against checked-in reference encodings) as well as rejection of an
invalid value.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Jakub Zelenka [Tue, 30 Jun 2026 16:48:57 +0000 (18:48 +0200)]
apps: test pkey -ec_param_enc option
Exercise the previously untested -ec_param_enc option for pkey,
covering named_curve and explicit parameter encodings as well as
rejection of the option on a non-EC key.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:59:39 2026
(Merged from https://github.com/openssl/openssl/pull/31798)
Jakub Zelenka [Mon, 29 Jun 2026 22:29:23 +0000 (00:29 +0200)]
test: build the fake cipher provider as a loadable module
The fake cipher provider was only available in-process, linked into test
binaries via fake_cipher_start(). To exercise app success paths (e.g.
skeyutl -genkey) the openssl app needs to load it as a provider module the
same way it loads legacy.
Make test/fake_cipherprov.c dual-buildable: drop the testutil dependency so
the source links cleanly into a module, add an OSSL_provider_init entry point
under FAKE_CIPHER_AS_MODULE, and add a fake-cipher MODULES target in
test/build.info. Also implement skeymgmt generate so opaque key generation
works, and cover the skeyutl -genkey success path in 20-test_skeyutl.t.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:58:53 2026
(Merged from https://github.com/openssl/openssl/pull/31781)
slontis [Sun, 28 Jun 2026 23:50:07 +0000 (09:50 +1000)]
FIPS: EC keygen - remove unnecessary self tests.
In FIPS mode EC keygen was doing 3 self tests.
ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and
ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and
comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4.
These tests covered both Keygen PCT for Key Agreement and Signatures.
ossl_ec_key_pairwise_check() was also being called from within ec_gen().
The advice from Atsec (lab) is that the sign/verify test within
ecdsa_keygen_pairwise_test() is sufficient according to the updated
rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of
the generated key is unknown at the time of key generation.
Detected during testing of Jipher by Roshith Alankandy (Oracle).
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:47:00 2026
(Merged from https://github.com/openssl/openssl/pull/31761)
Timo Keller [Fri, 26 Jun 2026 09:29:26 +0000 (11:29 +0200)]
s390x: Fix montgomery_multiplication_vectorized
Introduce `reduce_twice_signed` that reduces from `(-2q,q)` to `[0,q)`.
Fix `montgomery_multiplication_vectorized` in `ml_dsa_ntt_vec128.c`
by calling `reduce_twice_signed` at the end of the computation ensuring
that the result is in `[0,q)` and not only in `(-2q,q)` or `(-q,q)`.
Do not call `reduce_once_signed` in `ossl_poly_ntt_mult_scalar_vec128`
and at the end of `ossl_ml_dsa_poly_ntt_inverse_vec128` anymore as it is
not necessary anymore after `reduce_twice_signed`.
Without this fix, keygen, sign or verify might fail or produce wrong
results.
Signed-off-by: Timo Keller <tkeller@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Mon Jul 13 14:45:11 2026
(Merged from https://github.com/openssl/openssl/pull/31744)
Jakub Zelenka [Tue, 23 Jun 2026 21:45:51 +0000 (23:45 +0200)]
cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AAD
The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.
With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.
RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.
Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.
Closes #31635
Closes #26101
Closes #31629
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:41:34 2026
(Merged from https://github.com/openssl/openssl/pull/31695)
projects / thirdparty / openssl.git / log
