Mounir IDRASSI [Tue, 30 Jun 2026 10:12:18 +0000 (19:12 +0900)]
apps/s_server.c: fix SSL object leak on rpk_enable() failure
In www_body() and rev_body(), con = SSL_new(ctx) is called before
rpk_enable(con), but ownership of con is transferred to ssl_bio only
later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code
jumps to err: before that transfer without freeing con, leaking the SSL
object.
Add SSL_free(con) before goto err in both rpk_enable() failure paths,
matching the adjacent SSL_set_session_id_context() and BIO_new_socket()
error paths. sv_body() is unaffected because its err: block already
frees con.
The global rpk_files is not leaked. Its lifetime is managed
by s_server_main(), which frees it in the end cleanup block.
Mounir IDRASSI [Mon, 29 Jun 2026 07:46:29 +0000 (16:46 +0900)]
Suppress MSVC C4996 in applink.c
applink.c deliberately stores legacy CRT function pointers because
ms/uplink.h expects the old fopen and _open signatures. Keep the
table entries unchanged and suppress MSVC warning C4996 locally
around OPENSSL_Applink() instead of switching to fopen_s or
_sopen_s.
Fixes #8241
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 09:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/31765)
Milan Broz [Mon, 29 Jun 2026 11:59:16 +0000 (13:59 +0200)]
Use more recent default for _WIN32_WINNT
After the windows.h include optimization introduced in
commit 1eaf29ef6c, the _WIN32_WINNT default was changed, causing
performance regressions.
Currently, _WIN32_WINNT is defined as 0x0501, which means WinXP.
This causes the code to be compiled with WinXP-compatible code, notably
- without USE_RWLOCK
- using legacy thread implementation
- legacy RNG seeding (no BCryptGenRandom)
This patch increases the requirement to 0x600 (Windows Vista).
Note that code running on WinXP cannot currently be compiled with
any default configuration, as supported compilers generate executables
for Windows Vista and above.
If we provide some way to support WinXP, it can be done by
redefining _WIN32_WINNT.
Resolves: https://github.com/openssl/project/issues/2010 Fixes: 1eaf29ef6c "Remove direct includes of windows.h where possible" Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
Ingo Franzki [Mon, 29 Jun 2026 11:04:32 +0000 (13:04 +0200)]
s390x: Fix AES-XTS hardware acceleration in IBM z17
For the re-init case where only the IV is specified, but no key, the 'nap'
field must also be initialized.
Instead of setting the s390 specific fields in a special case block, call
ctx->hw->init() also in this case. It performs the necessary setup already
(when the KM function code was once set already).
Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also
be called with a NULL key. It then only performs the IV setup as well as
setting up the 'nap'.
Closes: https://github.com/openssl/openssl/issues/31766 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Jul 1 09:12:26 2026
(Merged from https://github.com/openssl/openssl/pull/31775)
Ingo Franzki [Thu, 25 Jun 2026 09:06:30 +0000 (11:06 +0200)]
s390x: Fix return code handling in HMAC_Init_ex()
When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.
The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).
The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.
Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.
Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.
Fixes: 0499de5adda2 "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)
Jakub Zelenka [Thu, 25 Jun 2026 15:57:37 +0000 (17:57 +0200)]
property: add cache provider-order regression test
When two providers cache the same nid and property query, the first one
to do so must own the providerless cache entry, so that a NULL-provider
lookup keeps resolving to that provider. This covers commit 9d476175d7.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 11:01:57 2026
(Merged from https://github.com/openssl/openssl/pull/31738)
Daniel Kubec [Fri, 5 Jun 2026 11:44:47 +0000 (13:44 +0200)]
TEST: Add DTLS 1.2 coverage for Session ID verification
The DTLS 1.2 tests exercise the same verification logic and confirm that the
behavior matches the TLS 1.2 implementation. The tests pass as expected and
provide additional coverage for DTLS 1.2 without requiring any functional
changes.
Fixes #31250
Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 30 11:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/31389)
Bob Beck [Fri, 22 May 2026 10:10:37 +0000 (04:10 -0600)]
Don't attempt to check the security level on what signed our own certificate.
What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)
Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.
Fixes: https://github.com/openssl/openssl/issues/31195 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
Jakub Zelenka [Tue, 23 Jun 2026 14:21:27 +0000 (16:21 +0200)]
apps: cover the smime multiple -signer parsing path
The signerfile != NULL block in smime_main(), reached when more than one
-signer is given (including the case where a preceding -inkey leaves
keyfile != NULL), was not exercised: the existing multi-signer tests run
through the cms command, and the smime app was only ever run with a
single signer. Add a two-signer test, with an explicit -inkey, to the
pkcs7 test set so it runs through smime when signing.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jun 30 08:57:47 2026
(Merged from https://github.com/openssl/openssl/pull/31675)
Jakub Zelenka [Thu, 18 Jun 2026 18:45:06 +0000 (20:45 +0200)]
quic: add mfail test for RCIDM
This tests memory failures in remote connection ID manager code.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:45 2026
(Merged from https://github.com/openssl/openssl/pull/31602)
Jakub Zelenka [Thu, 25 Jun 2026 20:49:07 +0000 (22:49 +0200)]
quic: add mfail test for multi-packet RXE
Add a record layer test that executes qrx_process_pkt() under mfail
on a freshly created qrx whose rx_free freelist is empty. This
deterministically lands the qrx_ensure_free_rxe() call for the first
packet of a multi-packet datagram among the enumerated injection points
which is the precondition for triggering assert failure in
qrx_validate_hdr_early(). The test reuses rx_script_5's coalesced
Initial+Handshake+1-RTT datagram and only provides the Initial secret,
since the bug fires before any decryption is attempted.
Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:00 2026
(Merged from https://github.com/openssl/openssl/pull/31331)
Jakub Zelenka [Fri, 19 Jun 2026 16:52:37 +0000 (18:52 +0200)]
statem: add direct tests for tls_construct_client_hello
Add a new test which calls tls_construct_client_hello() directly,
creating an SSL_CONNECTION enough to invoke the construct function
without making a full handshake, then verifies the produced
ClientHello structurally and by round-tripping it through the
server-side tls_process_client_hello().
The covered branches include TLS 1.3 (with and without middlebox
compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS
cookie and client_random reuse paths, the deterministic error branches
(WPACKET overflow and no usable ciphers), and the ECH wrapper path
(happy path with server-side decryption, the TLS 1.2 version error, and
OOM). Out-of-memory branches are exercised with the mfail tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Jakub Zelenka [Fri, 19 Jun 2026 13:58:59 +0000 (15:58 +0200)]
statem: fail handshake if there is memory failure in negotiate_dhe
Previously this just resulted in the skip of the group but such failure
should result in a proper error. This is not a big issue but it impacts
mfail tests so it would be good to fail.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:47 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Neil Horman [Wed, 24 Jun 2026 19:55:48 +0000 (15:55 -0400)]
ensure writes are syncronized on windows in CRYPTO_THREAD_run_once
We've tried to fix this properly using InitOnceExecuteOnce, but it
results in an ABI breakage, so we're doing it this way.
on windows, CRYPTO_THREAD_run_once, on weakly memory ordered systems,
may complete the write of the run once variable lock before some of the
writes made by the init callback routine complete. The result is that
on a heavily multithreaded application, other therads may see the data
that was meant to be in an initalized state, as in some erroneous
in-between state, leading to errors.
Fix it by inserting a full memory barrier after we return from the init
callback, and prior to setting the run once variable to ONCE_DONE.
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 08:51:16 2026
(Merged from https://github.com/openssl/openssl/pull/31713)
Mounir IDRASSI [Sun, 14 Jun 2026 07:12:01 +0000 (16:12 +0900)]
test: run RIO notifier smoke test everywhere
The RIO notifier smoke test is currently limited to
Windows targets in both the build metadata and the
test recipe.
The test exercises the notifier abstraction and can
run on other platforms as well, so this removes the
Windows-only guards.
The test remains conditional on QUIC being enabled.
Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jun 30 08:49:54 2026
(Merged from https://github.com/openssl/openssl/pull/31494)
Billy Brumley [Thu, 25 Jun 2026 11:20:25 +0000 (07:20 -0400)]
[test] check tag abuse for AEAD ciphers
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
Pauli [Mon, 22 Jun 2026 23:01:17 +0000 (09:01 +1000)]
demo: add program that shows how to query the FIPS provider version
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/31654)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:32:35 +0000 (08:32 +0200)]
providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:11:32 +0000 (08:11 +0200)]
providers/baseprov.c: remove static globals
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Matt Van Horn [Fri, 1 May 2026 04:46:43 +0000 (21:46 -0700)]
providers/defltprov.c: remove static globals from provider_init
The default provider stored two function pointers from the core
dispatch table (c_gettable_params, c_get_params) in file-scope statics,
written by ossl_default_provider_init() without any synchronization.
When OSSL_PROVIDER_load() is invoked from multiple threads concurrently,
TSAN reports a data race on both writes[1].
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the default provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Jakub Zelenka [Mon, 15 Jun 2026 16:24:28 +0000 (18:24 +0200)]
test/recipes/15-test_pkey.t: extend tests for openssl pkey -text and -text_pub
This slightly improves openssl pkey text coverage.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Jun 28 17:42:46 2026
(Merged from https://github.com/openssl/openssl/pull/31521)
test/asn1_string_test.c: allocate tmpstring properly in asn1_string_new_not_owned_test
Since tmpstring's ownership is transferred to tmp in ASN1_STRING_set0(),
it should be allocated using OPENSSL_strdup() and not strdup()
(as it will be freed with OPENSSL_free() in ASN1_STRING_clear_free()).
Also, don't try to free tmpstring on error, as at no point there is a jump
to err when tmpstring is allocated and not owned by tmp.
Simo Sorce [Mon, 15 Jun 2026 13:59:47 +0000 (09:59 -0400)]
Expand AES mode macro into explicit functions
This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly
written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1,
OFB128, CTR).
Expanding macro-generated functions improves overall code readability, allows
code navigation tools to properly index the function signatures, and provides
clearer stack traces during debugging.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 15 Jun 2026 13:51:16 +0000 (09:51 -0400)]
Prefix internal AES-GCM functions with ossl_
The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are
shared across multiple hardware-specific provider implementations but lacked
the internal `ossl_` prefix. They have been renamed to
`ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update`
respectively to follow OpenSSL naming conventions and prevent potential
namespace collisions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:19:19 +0000 (19:19 -0400)]
Consolidate SPARC T4 AES implementations
Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from
individual mode-specific files into a single unified file
(cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to
improve code organization and maintainability.
Additionally, this change removes the unused `keybits` parameter from several
SPARC T4 hardware initialization routines to clean up the internal API.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:02:27 +0000 (19:02 -0400)]
Consolidate s390x AES hardware implementations
Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and
XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file.
Centralizing the platform-specific logic simplifies the code structure and
improves maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:58 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:51:14 +0000 (18:51 -0400)]
Extract Zvkned key length check to helper
A new helper function, zvkned_key_schedule_supported, is introduced to
centralize the verification of 128-bit and 256-bit key lengths.
This replaces multiple duplicated, hardcoded checks across the RISC-V AES
implementations to improve code readability and maintainability. It also
ensures consistent check handling for XTS mode by correctly evaluating half
the key length.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:56 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:32:37 +0000 (18:32 -0400)]
Consolidate RISC-V 64 AES hardware code
Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM,
and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need
for separate files for GCM and CCM, and extracts RV64-specific XTS code from
the generic XTS hardware file, improving code organization.
Additionally, remove the unused `keybits` parameter from the RV64 AES hardware
retrieval functions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:54 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:03:16 +0000 (18:03 -0400)]
Consolidate RV32I AES hardware implementations
Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM,
and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the
need for separate files (`cipher_aes_gcm_hw_rv32i.c` and
`cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally,
unused `keybits` parameters are removed from the provider hardware
initialization functions to clean up the code.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:52 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 21:22:17 +0000 (17:22 -0400)]
Consolidate ARMv8 AES hardware implementations
Move the ARMv8-specific hardware implementations for AES GCM into a single
consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific
optimizations together to improve code organization and maintainability.
Additionally, remove the unused `keybits` parameter from the ARMv8 provider
functions to simplify the function signatures.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:50 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 20:44:12 +0000 (16:44 -0400)]
Consolidate AESNI hardware implementations
Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes
from individual mode files into a single consolidated file
(`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations
together, improving code organization and maintainability.
As part of this refactoring, the unused `keybits` parameter was removed from
several AES-NI provider functions, and necessary XTS initialization and
context copy functions were exported for shared use.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 17:38:05 +0000 (13:38 -0400)]
Migrate s390x AES-XTS to standard HW interface
Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc`
to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW`
dispatch structure.
This refactoring removes standalone initialization wrappers and integrates the
s390x hardware backend more cleanly with the generic AES-XTS provider code. It
also reduces code duplication by relying on the generic layer for common
validations (such as the maximum blocks per data unit limit) before invoking
the hardware-specific stream cipher.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:46 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 14:40:16 +0000 (10:40 -0400)]
Refactor AES XTS hardware key initialization
Replace complex AES XTS initialization and hardware selection macros
(`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and
`PROV_CIPHER_HW_select_xts`) with standard C functions.
Architecture-specific initializers, particularly for RISC-V, are consolidated
to evaluate CPU capabilities within dedicated initialization functions rather
than relying on macro expansion. This refactoring improves overall code
readability, maintainability, and simplifies debugging by eliminating opaque
multi-statement macros.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:44 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Wed, 10 Jun 2026 21:55:57 +0000 (17:55 -0400)]
Convert AES CCM .inc files to separate .c files
The hardware-specific AES CCM implementations were previously included
directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them
to standalone `.c` files and updates the build configuration, improving
modularity by treating them as separate compilation units.
Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new
`ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code
duplication, removes unsafe macro logic, and introduces proper error handling
during provider key initialization.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:42 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Tue, 9 Jun 2026 22:46:10 +0000 (18:46 -0400)]
Refactor AES hardware cipher implementations
Replace architecture-specific `.inc` files with standalone `.c` files for AES
ciphers and consolidate CFB mode logic into these new modules.
This eliminates the direct inclusion of source files and compiles each
hardware implementation as a separate translation unit.
This refactoring simplifies code organization and remove macro
complexity that makes it hard to understand what is implemented and
where enhancing maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:40 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 8 Jun 2026 22:23:00 +0000 (18:23 -0400)]
Replace GCM_HW_SET_KEY_CTR_FN with a function
The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper
function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA
GCM, the macro expansion was manually inlined.
This refactoring eliminates a multi-line macro to improve debuggability and
type safety. Crucially, the new function checks the return value of the
underlying key setup routines, ensuring that key initialization failures are
now correctly caught and propagated instead of being ignored.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Document the SNMPKDF "pass" parameter with OSSL_KDF_PARAM_PASSWORD,
matching the implementation and other KDF documentation. Also, fix
the nearby grammar.
007bsd [Tue, 23 Jun 2026 18:42:33 +0000 (21:42 +0300)]
crypto/x509/v3_ncons.c: fix scheme buffer leak in nc_uri() for schemeless URIs
OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme. The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed. Add OPENSSL_free(scheme) before the goto.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: e599893a9fec "x509: allow SAN URIs to contain userinfo" Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
007bsd [Tue, 23 Jun 2026 18:42:29 +0000 (21:42 +0300)]
crypto/x509/pcy_cache.c: fix ext_pcons leak in policy_cache_new()
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: 4acc3e907d29 "Initial support for certificate policy checking and evaluation." Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Neil Horman [Sat, 9 May 2026 14:26:57 +0000 (10:26 -0400)]
Fix up property test
Because the duplicate test expects the cache get operation to take
a reference count (which we no longer do), we need to not count it down
before checking the resulting ref count
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:17 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 23:16:28 +0000 (19:16 -0400)]
delay method store free in context_deinit_objs
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:47:16 +0000 (10:47 -0400)]
Makle STORE_LOADER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:13 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:46:54 +0000 (10:46 -0400)]
make OSSL_DECODER no do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:40:33 +0000 (10:40 -0400)]
Make OSSL_ENCODER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:33:49 +0000 (10:33 -0400)]
make EVP_RAND not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:30:16 +0000 (10:30 -0400)]
Make EVP_KEYEXCH not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:05 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:23:00 +0000 (10:23 -0400)]
Make EVP_KEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:18:52 +0000 (10:18 -0400)]
Make EVP_ASYM_CIPHER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:02 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:13:59 +0000 (10:13 -0400)]
Make EVP_SIGNATURE not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:00 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:10:05 +0000 (10:10 -0400)]
make EVP_KEM not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:04:37 +0000 (10:04 -0400)]
Make EVP_KDF not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:29:37 +0000 (17:29 -0400)]
Make EVP_MAC not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:16:40 +0000 (17:16 -0400)]
Make SKEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:51 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:05:11 +0000 (17:05 -0400)]
Make EVP_CIPHERS not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:04:41 +0000 (17:04 -0400)]
Make EVP_MD's not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:06:03 +0000 (17:06 -0400)]
Don't take reference counts on cache lookups
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Jakub Zelenka [Mon, 22 Jun 2026 21:15:15 +0000 (23:15 +0200)]
apps: cover the kdf -cipher option in the test recipe
The -cipher option was not covered. Add KRB5KDF test cases that
exercise it, both via -cipher and the equivalent -kdfopt cipher: form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:01:33 2026
(Merged from https://github.com/openssl/openssl/pull/31651)
Jakub Zelenka [Tue, 23 Jun 2026 13:10:33 +0000 (15:10 +0200)]
apps: fix Ed25519 typo in pkeyutl recipe subtest names
Two subtest descriptions read "Ed2559" instead of "Ed25519".
Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:37 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
Jakub Zelenka [Mon, 22 Jun 2026 17:47:23 +0000 (19:47 +0200)]
apps: cover pkeyutl oneshot buffer path with empty file input
The non-mmap buffer fallback in do_raw_keyop() for oneshot (only_nomd)
keys was never exercised on Unix, since any file with non-zero size
takes the mmap path and returns before reaching it. Signing and
verifying an empty file gives filesize 0, which skips the mmap block
(guarded by filesize > 0) and falls through to the buffer switch,
covering both the SIGN and VERIFY arms.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:36 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
rootvector2 [Sun, 31 May 2026 17:22:26 +0000 (22:52 +0530)]
lms: free previous encoded public key in ossl_lms_pubkey_decode
ossl_lms_pubkey_decode() only freed pkey->encoded when the new public key
had a different length, so re-decoding a same-length key on the documented
repeated-call path overwrote the old buffer without freeing it. Always free
the existing buffer first.
Also clear pkey->encodedlen on the error path so a failed decode leaves the
key in a consistent state instead of keeping a stale length.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:58:46 2026
(Merged from https://github.com/openssl/openssl/pull/31345)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 16:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/31700)
dannyward630 [Thu, 18 Jun 2026 17:42:34 +0000 (19:42 +0200)]
Mention removed ERR macros in changelog
Update the existing 4.0.0 changelog entry for the ERR state cleanup to list the removed ERR_FLAG_MARK, ERR_FLAG_CLEAR, and ERR_NUM_ERRORS macros.
Fixes #31056
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:37:57 2026
(Merged from https://github.com/openssl/openssl/pull/31598)
Nikola Pajkovsky [Wed, 20 May 2026 06:20:33 +0000 (08:20 +0200)]
x_all.c: avoid mismatched d2i/i2d function pointer casts
the d2i_*/i2d_* fp and bio wrappers for RSA_PUBKEY, the DSA and EC key
types, and the EVP_PKEY Private/PUBKEY converters passed their
type-specific functions to ASN1_{d2i,i2d}_{fp,bio}, which invoke them
through the generic d2i_of_void / i2d_of_void / void *(*)(void) pointer
types.
Add file-local thunks with the exact generic signatures that forward to
the concrete functions, and pass those instead of cast pointers. This
removes the mismatched calls while keeping the public API unchanged.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:13:01 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Wed, 20 May 2026 06:19:46 +0000 (08:19 +0200)]
avoid d2i_of_void asn1 callbacks in GENERAL_NAME_dup
use IMPLEMENT_ASN1_DUP_FUNCTION(GENERAL_NAME) so duplication goes
through ASN1_item_dup() instead of calling ASN1_dup() with cast
i2d/d2i function pointers. This avoids UBSan function type errors
while preserving the public GENERAL_NAME_dup() API.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:59 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 09:39:41 +0000 (11:39 +0200)]
avoid mismatched d2i callbacks in PEM readers
decode PEM payloads through the generated typed d2i_* functions in the
PEM read macros instead of routing them through the d2i_of_void
callback path. This avoids UBSan function type mismatch reports while
preserving the public PEM reader APIs.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:57 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Thu, 21 May 2026 05:14:07 +0000 (07:14 +0200)]
decode_der2key: wrap key-free callbacks to avoid function pointer casts
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:55 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 08:50:02 +0000 (10:50 +0200)]
fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex
PEM_X509_INFO_read_bio_ex stored d2i_X509, d2i_X509_AUX, d2i_X509_CRL
or d2i_AutoPrivateKey -- each with a distinct, type-specific signature
returning X509*, X509_CRL* or EVP_PKEY* -- in a single d2i_of_void*
variable and dispatched through it:
Replace the function-pointer dispatch with an enum tag
(pem_info_type) and a switch that calls each typed d2i_* directly
with the correctly type.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 07:36:49 +0000 (09:36 +0200)]
fix function pointer type mismatch in OCSP_REQUEST/RESPONSE bio macros
d2i_OCSP_REQUEST/d2i_OCSP_RESPONSE are declared with type-specific
signatures returning OCSP_REQUEST*/OCSP_RESPONSE*, but the
d2i_OCSP_{REQUEST,RESPONSE}_bio macros routed them through
ASN1_d2i_bio_of -> ASN1_d2i_bio, which calls them via a
d2i_of_void* pointer:
void *(*)(void **, const unsigned char **, long)
The analogous i2d_OCSP_{REQUEST,RESPONSE}_bio macros did the same
through ASN1_i2d_bio_of -> ASN1_i2d_bio with i2d_of_void*.
Rewrite the macros to dispatch through
ASN1_item_d2i_bio/ASN1_item_i2d_bio with ASN1_ITEM_rptr(OCSP_*)
directly. This eliminates the function-pointer cast entirely; both old
and new paths bottom out in the same ASN1_item_d2i_ex / ASN1_item_i2d
call, so behavior is identical.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:50 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Wed, 20 May 2026 06:51:07 +0000 (08:51 +0200)]
preserve stack thunks across sk_TYPE_dup
ensure typed stack duplicates keep their compare, copy, and free thunks so
later operations do not call typed callbacks through erased void * function
pointer signatures.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:48 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 13:42:47 +0000 (15:42 +0200)]
util: set thunks for sk_${nametype}_new(_reserve)
call OPENSSL_sk_set_thunks for sk_${nametype}_new and
sk_${nametype}_new_reserve, and wrap the long generated stack
constructor and deep-copy macros across multiple lines so the nested
thunk setup is easier to read and maintain.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:46 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Bob Beck [Thu, 18 Jun 2026 17:50:37 +0000 (11:50 -0600)]
Drop Windows CE support.
Windows CE has been out of mainstream support since 2018
and will not have a modern toolchain capable of compiling
a modern OpenSSL.
The vc_wince_info Perl helper, the crypto/LPdir_wince.c
directory backend, and a long tail of _WIN32_WCE
/ OPENSSL_SYS_WINCE guards across the Windows code paths
get removed.
Spotted by idrassi.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:27:18 2026
(Merged from https://github.com/openssl/openssl/pull/31601)
crypto/ctype.c: fix off-by-one OOB in ossl_toascii()/ossl_fromascii()
Incorrect check for the upper bound allowed the value of 256 to slip
through, which could lead to OOB read one element beyound the end
of the os_toascii/os_toebcdic arrays. Fix that by changing
the comparison with 256 from strictly great to great-or-equal.
Found by cppcheck.
Fixes: a1df06b36347 "This has been added to avoid the situation where some host ctype.h functions return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:19:30 2026
(Merged from https://github.com/openssl/openssl/pull/31661)
rec_layer_s3.c: prevent max_early_data overflow in ossl_early_data_count_ok()
Apply change similar to the one made in d41a9225196b "tls_common.c: prevent
max_early_data overflow in rlayer_early_data_count_ok()"
to ossl_early_data_count_ok(), that has similar logic in it
(as rlayer_early_data_count_ok() has been copied
from ossl_early_data_count_ok() in 9dd90232d537 "Move early data counting
out of the SSL object and into the record layer").
Complements: d41a9225196b "tls_common.c: prevent max_early_data overflow in rlayer_early_data_count_ok()" Fixes: 70ef40a05e06 "Check max_early_data against the amount of early data we actually receive" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:13:07 2026
(Merged from https://github.com/openssl/openssl/pull/31628)
Jakub Zelenka [Mon, 22 Jun 2026 19:33:12 +0000 (21:33 +0200)]
apps: add error-path test recipe for skeyutl
Cover the help, option-parsing and error paths of the skeyutl command.
The successful -genkey path is not exercised as no built-in provider
implements opaque symmetric key generation yet.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:10:05 2026
(Merged from https://github.com/openssl/openssl/pull/31648)
Jakub Zelenka [Thu, 18 Jun 2026 17:26:47 +0000 (19:26 +0200)]
quic: add mfail tests for QUIC SRTM
This cover various function for SRTM.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:06:31 2026
(Merged from https://github.com/openssl/openssl/pull/31593)
Daniel Kubec [Tue, 23 Jun 2026 12:10:45 +0000 (14:10 +0200)]
AEAD: reject late AAD in ChaCha20-Poly1305 after plaintext update
Align behavior with AES GCM, which already rejects this misuse with a hard
error, by tracking whether plaintext processing has started and returning an
error if AAD is supplied afterwards.
Fixes #31188
Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 07:01:44 2026
(Merged from https://github.com/openssl/openssl/pull/31673)
Nikola Pajkovsky [Tue, 23 Jun 2026 09:05:18 +0000 (11:05 +0200)]
crypto/armcap.c: reformat MIDR CPU-model conditionals for readability
break long chain of MIDR_IS_CPU_MODEL() alternatives packed onto a
single line, which was effectively unreadable and impossible to review
or diff one model at a time.
move the OPENSSL_armcap_P feature-flag test to the front of the
expression so the guard is obvious before the model list. This is a
formatting-only change.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 06:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31664)
Jakub Zelenka [Mon, 22 Jun 2026 21:30:49 +0000 (23:30 +0200)]
apps: cover the ec -conv_form option in the test recipe
The -conv_form option was not covered. Add a subtest that checks a
valid form changes the public key encoding and that an invalid form
is rejected. The DER encodings are also compared against committed
reference files, as they are deterministic for testec-p256.pem.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 06:08:38 2026
(Merged from https://github.com/openssl/openssl/pull/31652)
Viktor Dukhovni [Sat, 14 Mar 2026 09:47:06 +0000 (20:47 +1100)]
Once initialised, ML-DSA keys should be immutable
ML-DSA keys should become immutable once key material has been added.
This is already the case for at least ML-KEM keys, and should generally
be the case across all key types.
- Added the requisite check in the key management provider ml_dsa_import()
function.
- Also, consolidated the ML-KEM checks in ml_kem_import(). These were
previously partly in ml_kem_key_fromdata().
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jun 25 02:03:35 2026
(Merged from https://github.com/openssl/openssl/pull/30421)
Kirill Ermoshin [Mon, 22 Jun 2026 09:52:39 +0000 (12:52 +0300)]
Remove aliases for IANA-GOST2012-GOST8912-GOST8912
"gost2012_256/512" sigalgs aliases of IANA-GOST2012-GOST8912-GOST8912 equals
to sigalgs of LEAGACY-GOST2012-GOST8912-GOST8912 so we can't distinguish
between them for the legacy algorithm
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:04 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:02 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
projects / thirdparty / openssl.git / log
