Jakub Zelenka [Tue, 14 Jul 2026 15:38:03 +0000 (17:38 +0200)]
apps: test enc -P, -nosalt, -md and -iter options
Several enc options were not exercised by any test. Add subtests
covering -P/-p printing of the derived salt, key and iv (deterministic
with a fixed salt and PBKDF2) together with the -nosalt variant that
omits the salt line, a -nosalt encrypt/decrypt round-trip, -md selecting
the key derivation digest with a mismatching digest that must fail to
decrypt, and -iter setting the PBKDF2 iteration count with a mismatching
count that must fail to decrypt.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:11:47 2026
(Merged from https://github.com/openssl/openssl/pull/31948)
Jakub Zelenka [Tue, 14 Jul 2026 17:20:43 +0000 (19:20 +0200)]
apps: test pkcs8 -nocrypt reading a PKCS#8 PEM
Reading an unencrypted PKCS#8 (PrivateKeyInfo) in PEM form with -nocrypt
was not exercised by any test; the existing round-trip test only read the
DER form via -inform DER, hitting d2i_PKCS8_PRIV_KEY_INFO_bio(). The PEM
branch in apps/pkcs8.c (the informat == FORMAT_PEM || FORMAT_UNDEF case
calling PEM_read_bio_PKCS8_PRIV_KEY_INFO()) was left uncovered.
Add a subtest that writes an unencrypted PKCS#8 PEM and reads it back
with -nocrypt from PEM, exercising PEM_read_bio_PKCS8_PRIV_KEY_INFO(),
and checks the recovered key matches the original.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 09:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31955)
Jakub Zelenka [Tue, 14 Jul 2026 17:08:20 +0000 (19:08 +0200)]
apps: test pkeyutl -peerform option
The -peerform option of the pkeyutl app was not exercised by any test.
Extend the -derive peer key subtest to convert the peer public key to
DER and derive against it with -peerform DER, checking the shared secret
matches the one derived from the PEM peer key, and that reading the DER
peer key as PEM fails.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:10:00 2026
(Merged from https://github.com/openssl/openssl/pull/31953)
Jakub Zelenka [Tue, 14 Jul 2026 17:41:58 +0000 (19:41 +0200)]
apps: test pkcs12 -clcerts/-cacerts and -name options
The -clcerts and -cacerts certificate filtering and the -name friendly
name option of the pkcs12 app were not exercised by any test. Add a
subtest that exports a PKCS#12 holding a client cert (with a localKeyID),
a CA cert and a friendly name, then checks the friendly name is present,
that -clcerts outputs only the client certificate and -cacerts only the
CA certificate.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:09:09 2026
(Merged from https://github.com/openssl/openssl/pull/31956)
Jakub Zelenka [Wed, 22 Jul 2026 16:41:08 +0000 (18:41 +0200)]
apps: test rsa -modulus output
Add a test recipe subtest checking that 'openssl rsa -modulus' prints the
expected modulus for both a private key and a -pubin public key, mirroring
the existing dsa -modulus test.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:08:13 2026
(Merged from https://github.com/openssl/openssl/pull/32048)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:29 +0000 (00:11 +0200)]
apps: test skeyutl -skeyopt handling
Cover the -skeyopt option of skeyutl using the fake cipher provider: a
key name passed as a key option shows up in the reported key id, while
an option unknown to the key management and an option missing the
opt:value separator both make the command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:06 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:24 +0000 (00:11 +0200)]
test: support key options in the fake cipher provider
The fake cipher key management accepted a key name and raw key bytes on
generation and import, but did not advertise them as settable
parameters, so applications converting opt:value strings with
OSSL_PARAM_allocate_from_text() had nothing to look them up in.
Add the settable parameter table for both generation and import, and
report the key name as the key id, so that setting it has an observable
effect.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:18 +0000 (00:11 +0200)]
apps: fail skeyutl -genkey on bad -skeyopt
app_params_new_from_opts() returns NULL when a key option cannot be
converted, either because the key management does not settle the
parameter or because the opt:value separator is missing. skeyutl
ignored that and generated the key without the requested options, only
printing the parameter error to stderr and still exiting successfully.
Bail out instead, the way the mac, kdf and enc applications do. A NULL
return is only an error when key options were actually given, as
app_params_new_from_opts() also returns NULL for an empty option list.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
x509: keep RFC 3779 stacks hole-free after a failed canonize
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL
slots in the live stack when a merge succeeded before a later failure
(overlap, inverted range, or OOM). The NULLs were closed up only on
the success path, so a failed X509v3_asid_canonize() /
X509v3_addr_canonize() left the object poisonable: a retry of either
function dereferences a NULL in the sort comparator during the re-sort,
the i2r extension printers dereference the hole when printing (both in
all builds), and on the asid side is_canonical trips extract_min_max's
ossl_assert(aor != NULL), an abort in debug builds.
This is a regression introduced by e59165a1e3 ("crypto/x509: replace
O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the
previous delete-per-merge loop kept the stack hole-free at every step,
so a failed canonize always left the object sorted, partially merged
and structurally valid.
Run the compaction pass unconditionally, whether the sweep succeeded
or failed, restoring that contract: the stack is always left partially
canonicalized but hole-free, safe to inspect, print, encode, free, or
retry. In v3_addr.c this also routes the bare return-0 error paths
through the done: cleanup label.
New tests cover the crash vectors (is_canonical then retry) on both
the asid and addr sides. The existing *_error_midsweep tests are
strengthened with the same inspect/retry assertions.
Fixes #31856
Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 27 07:59:21 2026
(Merged from https://github.com/openssl/openssl/pull/31857)
Document the missing params argument for OSSL_FUNC_kem_decapsulate_init(),
remove stale name references, and fix the malformed provider-keymgmt(7) link.
Complements: 78c44b05945b Add HPKE DHKEM provider support for EC, X25519 and X448. Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:57:01 2026
(Merged from https://github.com/openssl/openssl/pull/32045)
RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5
and no padding, but the migration guide currently describes their EVP
replacements as using no padding only.
Document direct mappings to EVP_PKEY_sign() and
EVP_PKEY_verify_recover(), and explain that compatibility requires no
signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or
RSA_NO_PADDING.
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:54:00 2026
(Merged from https://github.com/openssl/openssl/pull/31996)
EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured
signature digest rejected a valid signature whose recovered payload is
empty, instead of returning success with a recovered length of zero.
RSA_public_decrypt() returns -1 on error and otherwise the number of
recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5
signature that encodes an empty payload. Pull request #28306 ("Make
error checks on RSA_public_decrypt() consistent") changed the error
check in the raw, no-digest verify-recover path from "ret < 0" to
"ret <= 0", so a valid zero recovered length was mistaken for an error.
Restore the "< 0" check in that branch only, leaving the digest-aware
PKCS#1, X9.31, PSS and ordinary verification paths untouched.
Add test_RSA_verify_recover_empty_payload, which performs a complete
zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and
fails on the unmodified implementation specifically at the
EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same
signature and reports a zero-byte result.
The behavior regressed as a result of #28306.
Fixes #32000
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Fri Jul 24 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32001)
Mounir IDRASSI [Tue, 5 May 2026 10:30:49 +0000 (19:30 +0900)]
Reject unknown TLS 1.3 ServerHello extensions
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.
Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.
Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.
Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)
The LoongArch SHA dispatch shim uses the same deprecated typed
interfaces as the RISC-V shim. Switch its entry points to void *
so it no longer depends on deprecated SHA context types.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:31 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
The RISC-V MD5 and SHA dispatch files use low-level digest context
types that are hidden in no-deprecated builds. Switch their shim
entry points to void * so they no longer depend on deprecated typed
interfaces.
Update the local MD5 declaration to match the untyped shim
interface.
Fixes: openssl/openssl#29357 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:30 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
Fuzz OSSL_ECHSTORE_read_echconfiglist with raw
fuzzer input in stage 1. Then fixup the starting
bytes to reach deeper code withotu relying only on
corpus. Fixup is done for binary encoding only (not base64).
Assisted-by: ChatGPT:gpt-5.5 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 13:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/32021)
docs: clarify EVP_PKEY context workflow and operation descriptions
Document that a generated key is returned separately from its generation
context and that a new key-bound context is needed for subsequent
operations. Correct the encrypt and decrypt initialization descriptions
and examples accordingly.
Correct two copy-and-paste errors in the verify-recover documentation:
describe its initializer as starting a verify-recover operation and refer
to EVP_PKEY_verify_recover() when discussing its input.
Fixes #31989
Assisted-by: Grok:Grok-4.5 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 23 08:29:24 2026
(Merged from https://github.com/openssl/openssl/pull/31995)
Neil Horman [Fri, 17 Jul 2026 18:22:50 +0000 (14:22 -0400)]
use safe_math on do_name_ex
Coverity caught some potential overflows in do_name_ex. Seems unlikely
to occur, but lets just do all the adds under safe_math to ensure we
don't overflow our buffer length.
Todd Short [Fri, 17 Jul 2026 21:34:11 +0000 (17:34 -0400)]
errors: fix stale string overrides in openssl.txt for renamed SSL error codes
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
Viktor Dukhovni [Sat, 11 Jul 2026 14:35:35 +0000 (00:35 +1000)]
Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Nikola Pajkovsky [Thu, 16 Jul 2026 12:15:56 +0000 (14:15 +0200)]
quic: report SRTM entry match status via an output argument
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
Andrew Dinh [Sun, 12 Jul 2026 16:50:05 +0000 (23:50 +0700)]
Wire radix QUIC test framework clock to simulated time
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
Andrew Dinh [Mon, 20 Jul 2026 02:05:59 +0000 (09:05 +0700)]
Fix clean target find/-prune precedence bug
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5 Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
Jakub Zelenka [Tue, 14 Jul 2026 16:26:40 +0000 (18:26 +0200)]
apps: test rsa -text option
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: check return values of SSL_* calls
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: use SSL_set1_ipaddr() instead of SSL_set1_host()
As the latter was deprecated in commit f584ae959cbc "Let's support
multiple names for certificate verification".
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: declare locally used functions as static
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos: add PKCS#12 reading and writing demos to the primary build system
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad31 "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad31 "Convert demos to primary build system" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/README.txt: mention quic-server-block.c and quic-server-non-block.c
Complements: dad45ea769dc "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb01 "Add demo QUIC non-blocking server" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b546 "MVP demo TLS
server", which, while was applied after 2000281dad31 "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b546 "MVP demo TLS server" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/guide/tls-server-block.c: check results of __owur API calls
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Weidong Wang [Sat, 28 Mar 2026 08:33:47 +0000 (03:33 -0500)]
Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
John Claus [Fri, 10 Apr 2026 09:21:30 +0000 (03:21 -0600)]
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type.
Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1.
Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands.
Fixes openssl#30432
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 11:10:47 2026
(Merged from https://github.com/openssl/openssl/pull/30655)
Enji Cooper [Fri, 5 Sep 2025 04:27:29 +0000 (21:27 -0700)]
Add mandoc output support for manpages
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
Fix SM2 RISC-V64 crash from functions emitted into .rodata
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Jakub Zelenka [Thu, 2 Jul 2026 15:37:37 +0000 (17:37 +0200)]
apps: add offline OCSP request/responder/verify round-trip test
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Jakub Zelenka [Sat, 4 Jul 2026 11:58:00 +0000 (13:58 +0200)]
statem: test tls_construct_client_certificate
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Jakub Zelenka [Fri, 17 Jul 2026 22:09:30 +0000 (00:09 +0200)]
apps: decode DTLSv1.2 records in s_client/s_server -msg output
The msg_cb message callback used by the -msg option only recognised
DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as
"Not TLS data or unknown version" instead of being decoded. Add
DTLS1_2_VERSION to the recognised version check and to the ssl_versions
lookup table, and wrap the now-overlong condition.
Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and
DTLSv1.2, logging the protocol messages via -msg, and checks that every
record is decoded (no "Not TLS data or unknown version" lines).
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jul 20 09:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/31994)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:23:09 +0000 (11:23 +0200)]
test: update provider Valgrind suppression
The internal provider test intentionally retains its configured provider
when OPENSSL_cleanup() is skipped under OSSL_USE_VALGRIND. The existing
suppression accounts for this state but no longer matches the provider
activation stack because provider_init() appears between
OSSL_provider_init() and provider_activate().
Add the missing frame so the provider context and its diagnostic strings
are correctly suppressed.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:11 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:05:35 +0000 (11:05 +0200)]
test: clean up thread-local key in QUIC radix tests
The QUIC radix test creates a new thread-local key for each script but
only clears the associated value during teardown. The key itself
is never deleted.
Delete the thread-local key after all child threads have joined and the
main-thread value has been cleared.
1,536 bytes in 3 blocks are still reachable in loss record 873 of 915
at 0x488D0B0: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
by 0x49561CF: pthread_setspecific@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
by 0x5C0FD7: CRYPTO_THREAD_set_local (threads_pthread.c:1030)
by 0x41132F: radix_thread_init (quic_bindings.c:570)
by 0x4114F7: bindings_process_init (quic_bindings.c:604)
by 0x422563: test_script (main.c:28)
by 0x5152DF: run_tests (driver.c:518)
by 0x517447: main (main.c:52)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:10 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:41:06 +0000 (09:41 +0200)]
test/p_ossltest: fix uninitialised bytes written in TLS1-AAD GCM mode
The test provider's fake AES-128-GCM cipher works by running the real
sub-cipher for its side effects and then copying the memdup'd input
back over the output buffer, so the "encrypted" record is really the
plaintext.
In a TLS record the buffer handed to the cipher reserves an
uninitialised 8-byte explicit IV at the front and a 16-byte auth tag
at the end for the cipher to fill. OPENSSL_memdup() duplicated those
uninitialised IV/tag regions, and the subsequent memcpy(out, inbuf, inl)
copied them into out. That output was then written to the socket,
triggering valgrind's "Syscall param write(buf) points to uninitialised
byte(s)":
at sock_write (bss_sock.c:155)
by bwrite_conv (bio_meth.c:79)
by BIO_write (bio_lib.c:397)
by statem_flush (statem.c:963)
by ossl_statem_client_post_work (statem_clnt.c:881)
...
Track whether EVP_CTRL_AEAD_TLS1_AAD was set (recorded in
set_ctx_params) and, when encrypting a TLS record, copy only the
plaintext payload back, leaving the explicit IV and tag that the real
sub-cipher actually produced intact.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:08 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:51:51 +0000 (09:51 +0200)]
test: include PID in valgrind log file names
Append the %p (process ID) placeholder to valgrind's --log-file in
both app() and test(). When a test spawns multiple processes sharing
the same result index, they previously wrote to the same log file and
clobbered each other's output. Using %p gives each process its own
log, so no valgrind findings are lost.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:07 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Jakub Zelenka [Mon, 13 Jul 2026 16:49:29 +0000 (18:49 +0200)]
mkwraps: resolve system (libc) functions via compiler include paths
WRAP[] lists mix OpenSSL functions with libc/POSIX ones such as read()
or socket(), which mkwraps.pl reported as "declaration not found" since
it only searched the project's INCLUDE[] directories.
Fall back to the C compiler's default include search paths for functions
missing from the project headers. They are queried lazily, only on such
a miss, so the all-OpenSSL case still does not walk /usr/include. Parse
the glibc trailing attribute macros (__THROW, __wur, ...) and restrict
qualifier, and add --cc and --no-system.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 20 07:00:57 2026
(Merged from https://github.com/openssl/openssl/pull/31936)
Jakub Zelenka [Tue, 14 Jul 2026 14:59:10 +0000 (16:59 +0200)]
apps: add dgst test coverage for -keyform option
The -keyform (OPT_KEYFORM) option of the dgst app was not exercised by
any test. Add a subtest that converts the RSA test keys to DER and
then signs and verifies with -keyform DER, covering the option for both
the private and public key loading paths.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 06:40:45 2026
(Merged from https://github.com/openssl/openssl/pull/31946)
Jakub Zelenka [Tue, 14 Jul 2026 16:18:26 +0000 (18:18 +0200)]
apps: test dsa -text option
The -text option of the dsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testdsa.pem keypair rather
than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 06:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/31949)
Bob Beck [Wed, 10 Jun 2026 22:44:04 +0000 (16:44 -0600)]
Add a patch disabling the pem_encoder test
This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)
The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Mon, 11 May 2026 17:15:02 +0000 (11:15 -0600)]
Convert internal use of ASN1_STRING_set and ASN1_STRING_length
to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Thu, 14 May 2026 23:50:49 +0000 (17:50 -0600)]
pass length in cmp_msg stuff
ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Mon, 11 May 2026 16:30:04 +0000 (10:30 -0600)]
Prepare a now opaque ASN1_STRING for the size_t rapture.
Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.
Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.
We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().
ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.
Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.
Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.
Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Jakub Zelenka [Sun, 12 Jul 2026 13:02:35 +0000 (15:02 +0200)]
test: don't depend on DTLS alert delivery in sslrecords test
The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.
Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.
Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Jul 18 12:53:26 2026
(Merged from https://github.com/openssl/openssl/pull/31927)
Jakub Zelenka [Tue, 14 Jul 2026 16:38:57 +0000 (18:38 +0200)]
apps: test pkey -encopt option
The -encopt option of the pkey app was not exercised by any test; the
existing ML-DSA codec tests only used genpkey -encopt and pkey with
-provparam. Re-encode the seed-priv key into each supported PKCS#8
output format via 'pkey -encopt output_formats:<form>' and check the
result matches the reference for that form. A control compares against
the default (no -encopt) encoding so the match is attributed to -encopt
rather than the default behaviour.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:51:40 2026
(Merged from https://github.com/openssl/openssl/pull/31951)
Jakub Zelenka [Tue, 14 Jul 2026 17:01:24 +0000 (19:01 +0200)]
apps: test ec and ecparam -text options
The -text option was not exercised for the ec or ecparam apps. Add a
subtest to 15-test_ec.t that prints a private and a public EC key and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testec-p256.pem keypair as
well as the curve identification. Add a subtest to 15-test_ecparam.t
that prints named and explicit parameters, checking the named form emits
the expected curve OID and NIST name while the explicit form emits the
field parameters and no OID.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:47:12 2026
(Merged from https://github.com/openssl/openssl/pull/31952)
Andrew Dinh [Fri, 3 Jul 2026 11:18:17 +0000 (18:18 +0700)]
Introduce OP_BIND() to QUIC RADIX test framework
RADIX framework keeps objects needed by test scripts
in two places:
- hash table bound to radix process (`RP()->objs`), all
objects are stored there
- slot which is an array bound to radix thread (`RT()->slot[]`)
The `slot` is an array which is used to pass arguments
to RADIX ops. The typically script is doing something
like this:
```
OP_SELECT_SSL(0, C); /* places 'C' object to slot 0 in thread */
OP_FUNC(print_ssl); /* calls print_ssl function, which prints object */
```
All objects are managed by RADIX framework, scripts have very
limited options to control object's lifetime. The only way for
scripts to let object go is to use `OP_UNBIND()`. The operation
removes the object from hastable (`RP()->objs`) and frees the
object afterwards. This is good enough as long a all tests
are running in single thread. Currently `OP_UNBIND()` is
required when test needs to accept/create more than one stream.
The test has two options. It can use unique name for each
stream it creates/accepts:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_ACCEPT_STREAM_WAIT(C, C1, 0);
OP_ACCEPT_STREAM_WAIT(C, C2, 0);
```
Or script may re-use the same variable for stream,
in that case `OP_UNBIND()` is needed:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
```
Unfortunately `OP_UNBIND()` can not be used when test
uses more than one thread due to missing locking of `RP()->objs`.
Introducing a locking scheme seems to be bit invasive change,
The OP_BIND() here hopes to be sufficient and good enough for now.
The idea is as follows:
- `OP_BIND()` allows script to insert empty object
into `RP()->objs` OP_BIND() is supposed to run before
script spawns thread(s). No manipulation of `RP()->objs`
is allowed after threads are spawned, operations
OP_BIND()/OP_UNBIND() are not thread safe.
- Introduce `OP_F_REPLACE_STREAM` flag which tells
`OP_ACCEPT_STREAM_WAIT()`/`OP_NEW_STREAM()` to re-use
existing id for stream. This `_REPLACE_` flag requires
read-only access to `RP()->objs` hash table.
- change introduces a per radix object mutex so object can
be updated safely w.r.t. RADIX thread which ticks SSL object
bound in radix object.
The guideline for tests which require more then one thread
is as follows:
- the first thread creates complete set of empty objects
for all threads.
- each test thread gets its own set of variables, so it
can populate them later during test with SSL objects
- objects are not supposed to be shared between threads
This is a snippet of script executed by main thread before
additional threads are spawned:
```
...
OP_BIND(C1); /* stream id for child */
OP_BIND(S1); /* stream id for parent */
OP_SPAWN_THREAD(child);
for (i = 0; i < 10; i++) {
OP_NEW_STREAM(S, S1, OP_F_REPLACE_STREAM);
OP_WRITE_B(S1, "foo");
OP_CONCLUDE(S1);
}
```
This snippet comes from child:
```
for (i = 0; i < 10; i++) {
OP_ACCEPT_STREAM_WAIT(C, C1, OP_F_REPLACE_STREAM);
OP_READ_EXPECT_B(C1, "foo");
OP_EXPECT_FIN(C1);
}
```
As you can see parent and child don't use OP_BIND()/OP_UNBIND()
after child thread is spawned.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri Jul 17 08:02:04 2026
(Merged from https://github.com/openssl/openssl/pull/31821)
Jakub Zelenka [Thu, 16 Jul 2026 08:53:53 +0000 (10:53 +0200)]
rand: fix jitter seed macro logic
The seeding macro logic was mixed up and incompletely applied. The
macro logic was also cleaned up.
Co-authored-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 17 04:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31970)
Is failing when attempting to read in a der file converting from a
corresponding PEM file containing DSA parameters.
Interestingly The problem was only occuring when:
1) The input was a DER file
and
2) Blake2 was not configured
Doing some tracing of the decoder operation showed that this is occuring
because the OSSL_STORE lookup used to find the proper decoder uses a
"first successful decode wins" approach, after which the loading code
checks to see if the decoded type matches the expected key type.
When decoding PEM, this isn't a problem, as the PEM armoring gives the
decoder a hint as to why type of data the input file is.
But with DER, there is no such hint, and we're at the mercy of whichever
decoder happens to decode the data correctly first. Normally it works
just fine, but when features are disabled or enabled, the order in which
the decoders are attempted may change, affecting the outcome. In this
particular case, disabling blake2 caused the DHX decoder to be attempted
first, which decodes the input der file without issue. That in turn
caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting
a DSA key), and so the test fails.
Fortunately, the code that the dsaparam applet uses to do this decode
provides a keytype hint, which we can use to guide the decode process.
keep the old store lookup method around in case anyone doesn't pass a
uri that is a file path or provide a keytype, but if we do both those
things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell
the decoder that we want to decode the input data as the expected type
(in this case a DSA key).
Fixes #31944
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Thu Jul 16 15:28:32 2026
(Merged from https://github.com/openssl/openssl/pull/31954)
Jakub Zelenka [Thu, 9 Jul 2026 10:53:29 +0000 (12:53 +0200)]
apps: cover the crl -gendelta, -key and -keyform options
The -gendelta, -key and -keyform options of the crl app were previously
untested. It adds a subtest that generates two CRLs with an incrementing
crlNumber and then uses -gendelta with -key to produce a delta CRL,
checking the result carries a Delta CRL Indicator. It also loads the
signing key from DER via -keyform DER, and checks that a mismatching
-keyform and a missing -key both make -gendelta fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:05:31 2026
(Merged from https://github.com/openssl/openssl/pull/31910)
Jakub Zelenka [Wed, 8 Jul 2026 11:29:24 +0000 (13:29 +0200)]
apps: test genpkey app cipher option
Add coverage for encrypting the generated private key with a cipher,
checking it can only be read back with the correct passphrase, and that
a cipher is rejected together with the -genparam option.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/31893)
Jakub Zelenka [Tue, 28 Apr 2026 17:22:46 +0000 (19:22 +0200)]
Integrate mfail functionality to fuzz tests
Run the fuzz corpora under mfail in addition to the normal path, so the
existing inputs also exercise malloc-failure handling. The fuzz.pl harness
sizes the mfail runs to a time budget and, on a leak, bisects down to the
exact file and injection point. Adds a budgeted asan/ubsan CI job to run it.
Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:43 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
Jakub Zelenka [Thu, 11 Jun 2026 17:05:43 +0000 (19:05 +0200)]
test: add Windows unit tests setup and initial dgram test
This adds an initial setup for unit testing on Windows that allows
mocking of system functions using Detour library. This works only for
library functions and not object function like wrap so it is a bit
limited but it is still useful for BIO mocking.
An initial BIO bss_dgram test is added covering the Windows specific
parts.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:00:35 2026
(Merged from https://github.com/openssl/openssl/pull/31915)
Richard Levitte [Tue, 14 Jul 2026 09:34:56 +0000 (11:34 +0200)]
keccak1600x4-avx512vl: fix undefined symbols on macOS
The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
routines through call_internal(), which on non-Win64 emitted a call to
the public global symbol by its bare name. These calls textually
precede the callees' .globl declarations, so x86_64-xlate.pl never
prepends the platform's leading underscore to the referenced symbol.
On ELF (Linux) that is harmless since symbols carry no leading
underscore, but on Mach-O (macOS) the call references the un-decorated
SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
_SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
breaking the darwin64-x86_64 link of libcrypto:
Call the local .L_<name> entry label instead -- the same address as the
public symbol and the pattern the finalize calls already use -- so the
reference resolves locally and these internal routines cannot be
interposed. The Win64 path is unchanged.
Fixes: https://github.com/openssl/openssl/issues/31941 Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration") Assisted-by: Pi:z-ai/glm-5.2 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 14 12:33:50 2026
(Merged from https://github.com/openssl/openssl/pull/31942)
projects / thirdparty / openssl.git / log
