test: fix flaky -md and -iter mismatch checks in 20-test_enc.t
The subtests added in f26d632a0e assert that "openssl enc -d" exits
non-zero when the key derivation parameters do not match. enc has no
MAC, so a wrong key is not detectable as such; the only signal is
whether the garbage happens to form valid PKCS#7 padding, which
openssl-enc(1) documents as passing better than one time in 256. With
a random salt the tests thus failed about 0.4% of the time.
Assert instead that mismatching parameters do not recover the
plaintext: the decryption must either fail or produce differing output.
Jakub Zelenka [Thu, 16 Jul 2026 08:02:21 +0000 (10:02 +0200)]
apps: drop invalid trust setting in check_cert_might_be_valid()
check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.
The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.
Add a test checking that printing certificate info emits nothing on stderr.
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)
EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
so the "< 0" checks on the cipher-with-MAC path cannot detect any
failure. A return of 0 means a failed or unsupported control, or
for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
usable here.
Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
check fixed by commit 674c23d2656e in this function.
Follow-up to https://github.com/openssl/openssl/pull/30923.
Fixes: ea0add4a8227 "New GOST PKCS12 standard support"
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Mon Jul 27 10:21:13 2026
(Merged from https://github.com/openssl/openssl/pull/31848)
Jakub Zelenka [Tue, 21 Jul 2026 21:06:43 +0000 (23:06 +0200)]
apps: test dgst -r and -c output formats
Add coverage for the coreutils style output of `openssl dgst -r`,
including the newline escaping done by newline_escape_filename() when
the digested file name contains a newline, and for the colon separated
output of `openssl dgst -c`.
The newline in file name part is skipped where such a file cannot be
created.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 10:19:58 2026
(Merged from https://github.com/openssl/openssl/pull/32035)
Jakub Zelenka [Wed, 15 Jul 2026 21:59:08 +0000 (23:59 +0200)]
apps: cover the req -subj modification of an existing request
Add a subtest exercising the code path in the req app that rewrites the
subject of an existing certificate request loaded via -in, i.e. when
-subj is given without -new/-newkey/-x509.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 10:19:06 2026
(Merged from https://github.com/openssl/openssl/pull/31965)
Clarify the bot-only workflow inputs and validate any supplied tuple through
a shared reusable workflow without interpolating input values into shell source.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:56 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
ci: allow run-checker-daily and valgrind-daily to be dispatched against a PR head SHA
Additive: schedule and bare-manual runs unchanged. Adds validated,
fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch each
against an exact commit; run-name echoes them back for correlation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
ci: allow ct-validation-daily to be dispatched against a PR head SHA
Additive: schedule and bare-manual runs unchanged. Adds validated,
fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch against
an exact commit; run-name echoes them back for correlation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:54 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
Jakub Zelenka [Thu, 16 Jul 2026 08:20:04 +0000 (10:20 +0200)]
apps: cover the crl -crlnumber and -issuer print options
Add a subtest exercising the -crlnumber and -issuer print options of the
crl app: with a CRL that carries a CRL Number extension (printed as a hex
value), with a CRL that has none (printed as <NONE>), and checking the
printed issuer DN in both cases.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:15:03 2026
(Merged from https://github.com/openssl/openssl/pull/31969)
Jakub Zelenka [Thu, 16 Jul 2026 07:39:20 +0000 (09:39 +0200)]
apps: cover the x509 -serial, name-hash and -fingerprint print options
Add a subtest exercising the informational print options of the x509 app
that operate on any certificate: -serial, -next_serial, -subject_hash
(and its -hash alias), -issuer_hash, -subject_hash_old, -issuer_hash_old
and -fingerprint (default SHA-1 and -sha256). These branches of the print
loop were previously not exercised.
The expected values are those of the committed test/certs/ca-cert.pem;
the fingerprints are the SHA-1 and SHA-256 digests of its DER encoding.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31967)
Jakub Zelenka [Wed, 8 Jul 2026 22:03:22 +0000 (00:03 +0200)]
x509: replace x509_memfail with in-tree mfail tests
The standalone x509_memfail is superseded by mfail tests. They cover
the certificate parse, self-signature verification and issuer name
hashing paths.
Two new mfail tests still need NO_CHECK because a certificate still
parses with an undecoded public key, and EVP_DigestVerifyFinal falls
back to the original context when its EVP_PKEY_CTX_dup optimisation
fails. The issuer name hashing propagates cleanly and runs checked.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:13:22 2026
(Merged from https://github.com/openssl/openssl/pull/31901)
Jakub Zelenka [Tue, 21 Jul 2026 11:47:30 +0000 (13:47 +0200)]
rand: factor out seed source creation and fix store race
rand_get0_primary() created the seed source ahead of the primary DRBG
and stored both under the write lock at the end. When two threads
raced to create the primary DRBG and one of them failed after having
created and stored the seed source, the other thread overwrote the
stored seed source with its own instance, leaking the previous one.
Factor the get-or-create logic out into rand_get0_seed() which
rechecks the global under the write lock, so exactly one instance is
kept and returned to every racing thread, and the seed source is
stored independently of the primary DRBG creation outcome.
Add a regression test checking that creating the primary DRBG creates
and stores the seed source and that later use keeps returning the same
instance.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 09:13:12 2026
(Merged from https://github.com/openssl/openssl/pull/32029)
Jakub Zelenka [Tue, 14 Jul 2026 15:38:03 +0000 (17:38 +0200)]
apps: test enc -P, -nosalt, -md and -iter options
Several enc options were not exercised by any test. Add subtests
covering -P/-p printing of the derived salt, key and iv (deterministic
with a fixed salt and PBKDF2) together with the -nosalt variant that
omits the salt line, a -nosalt encrypt/decrypt round-trip, -md selecting
the key derivation digest with a mismatching digest that must fail to
decrypt, and -iter setting the PBKDF2 iteration count with a mismatching
count that must fail to decrypt.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:11:47 2026
(Merged from https://github.com/openssl/openssl/pull/31948)
Jakub Zelenka [Tue, 14 Jul 2026 17:20:43 +0000 (19:20 +0200)]
apps: test pkcs8 -nocrypt reading a PKCS#8 PEM
Reading an unencrypted PKCS#8 (PrivateKeyInfo) in PEM form with -nocrypt
was not exercised by any test; the existing round-trip test only read the
DER form via -inform DER, hitting d2i_PKCS8_PRIV_KEY_INFO_bio(). The PEM
branch in apps/pkcs8.c (the informat == FORMAT_PEM || FORMAT_UNDEF case
calling PEM_read_bio_PKCS8_PRIV_KEY_INFO()) was left uncovered.
Add a subtest that writes an unencrypted PKCS#8 PEM and reads it back
with -nocrypt from PEM, exercising PEM_read_bio_PKCS8_PRIV_KEY_INFO(),
and checks the recovered key matches the original.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 09:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31955)
Jakub Zelenka [Tue, 14 Jul 2026 17:08:20 +0000 (19:08 +0200)]
apps: test pkeyutl -peerform option
The -peerform option of the pkeyutl app was not exercised by any test.
Extend the -derive peer key subtest to convert the peer public key to
DER and derive against it with -peerform DER, checking the shared secret
matches the one derived from the PEM peer key, and that reading the DER
peer key as PEM fails.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:10:00 2026
(Merged from https://github.com/openssl/openssl/pull/31953)
Jakub Zelenka [Tue, 14 Jul 2026 17:41:58 +0000 (19:41 +0200)]
apps: test pkcs12 -clcerts/-cacerts and -name options
The -clcerts and -cacerts certificate filtering and the -name friendly
name option of the pkcs12 app were not exercised by any test. Add a
subtest that exports a PKCS#12 holding a client cert (with a localKeyID),
a CA cert and a friendly name, then checks the friendly name is present,
that -clcerts outputs only the client certificate and -cacerts only the
CA certificate.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:09:09 2026
(Merged from https://github.com/openssl/openssl/pull/31956)
Jakub Zelenka [Wed, 22 Jul 2026 16:41:08 +0000 (18:41 +0200)]
apps: test rsa -modulus output
Add a test recipe subtest checking that 'openssl rsa -modulus' prints the
expected modulus for both a private key and a -pubin public key, mirroring
the existing dsa -modulus test.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:08:13 2026
(Merged from https://github.com/openssl/openssl/pull/32048)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:29 +0000 (00:11 +0200)]
apps: test skeyutl -skeyopt handling
Cover the -skeyopt option of skeyutl using the fake cipher provider: a
key name passed as a key option shows up in the reported key id, while
an option unknown to the key management and an option missing the
opt:value separator both make the command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:06 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:24 +0000 (00:11 +0200)]
test: support key options in the fake cipher provider
The fake cipher key management accepted a key name and raw key bytes on
generation and import, but did not advertise them as settable
parameters, so applications converting opt:value strings with
OSSL_PARAM_allocate_from_text() had nothing to look them up in.
Add the settable parameter table for both generation and import, and
report the key name as the key id, so that setting it has an observable
effect.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:18 +0000 (00:11 +0200)]
apps: fail skeyutl -genkey on bad -skeyopt
app_params_new_from_opts() returns NULL when a key option cannot be
converted, either because the key management does not settle the
parameter or because the opt:value separator is missing. skeyutl
ignored that and generated the key without the requested options, only
printing the parameter error to stderr and still exiting successfully.
Bail out instead, the way the mac, kdf and enc applications do. A NULL
return is only an error when key options were actually given, as
app_params_new_from_opts() also returns NULL for an empty option list.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
x509: keep RFC 3779 stacks hole-free after a failed canonize
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL
slots in the live stack when a merge succeeded before a later failure
(overlap, inverted range, or OOM). The NULLs were closed up only on
the success path, so a failed X509v3_asid_canonize() /
X509v3_addr_canonize() left the object poisonable: a retry of either
function dereferences a NULL in the sort comparator during the re-sort,
the i2r extension printers dereference the hole when printing (both in
all builds), and on the asid side is_canonical trips extract_min_max's
ossl_assert(aor != NULL), an abort in debug builds.
This is a regression introduced by e59165a1e3 ("crypto/x509: replace
O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the
previous delete-per-merge loop kept the stack hole-free at every step,
so a failed canonize always left the object sorted, partially merged
and structurally valid.
Run the compaction pass unconditionally, whether the sweep succeeded
or failed, restoring that contract: the stack is always left partially
canonicalized but hole-free, safe to inspect, print, encode, free, or
retry. In v3_addr.c this also routes the bare return-0 error paths
through the done: cleanup label.
New tests cover the crash vectors (is_canonical then retry) on both
the asid and addr sides. The existing *_error_midsweep tests are
strengthened with the same inspect/retry assertions.
Fixes #31856
Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 27 07:59:21 2026
(Merged from https://github.com/openssl/openssl/pull/31857)
Document the missing params argument for OSSL_FUNC_kem_decapsulate_init(),
remove stale name references, and fix the malformed provider-keymgmt(7) link.
Complements: 78c44b05945b Add HPKE DHKEM provider support for EC, X25519 and X448. Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:57:01 2026
(Merged from https://github.com/openssl/openssl/pull/32045)
RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5
and no padding, but the migration guide currently describes their EVP
replacements as using no padding only.
Document direct mappings to EVP_PKEY_sign() and
EVP_PKEY_verify_recover(), and explain that compatibility requires no
signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or
RSA_NO_PADDING.
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:54:00 2026
(Merged from https://github.com/openssl/openssl/pull/31996)
EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured
signature digest rejected a valid signature whose recovered payload is
empty, instead of returning success with a recovered length of zero.
RSA_public_decrypt() returns -1 on error and otherwise the number of
recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5
signature that encodes an empty payload. Pull request #28306 ("Make
error checks on RSA_public_decrypt() consistent") changed the error
check in the raw, no-digest verify-recover path from "ret < 0" to
"ret <= 0", so a valid zero recovered length was mistaken for an error.
Restore the "< 0" check in that branch only, leaving the digest-aware
PKCS#1, X9.31, PSS and ordinary verification paths untouched.
Add test_RSA_verify_recover_empty_payload, which performs a complete
zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and
fails on the unmodified implementation specifically at the
EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same
signature and reports a zero-byte result.
The behavior regressed as a result of #28306.
Fixes #32000
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Fri Jul 24 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32001)
Mounir IDRASSI [Tue, 5 May 2026 10:30:49 +0000 (19:30 +0900)]
Reject unknown TLS 1.3 ServerHello extensions
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.
Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.
Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.
Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)
The LoongArch SHA dispatch shim uses the same deprecated typed
interfaces as the RISC-V shim. Switch its entry points to void *
so it no longer depends on deprecated SHA context types.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:31 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
The RISC-V MD5 and SHA dispatch files use low-level digest context
types that are hidden in no-deprecated builds. Switch their shim
entry points to void * so they no longer depend on deprecated typed
interfaces.
Update the local MD5 declaration to match the untyped shim
interface.
Fixes: openssl/openssl#29357 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:30 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
Fuzz OSSL_ECHSTORE_read_echconfiglist with raw
fuzzer input in stage 1. Then fixup the starting
bytes to reach deeper code withotu relying only on
corpus. Fixup is done for binary encoding only (not base64).
Assisted-by: ChatGPT:gpt-5.5 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 13:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/32021)
docs: clarify EVP_PKEY context workflow and operation descriptions
Document that a generated key is returned separately from its generation
context and that a new key-bound context is needed for subsequent
operations. Correct the encrypt and decrypt initialization descriptions
and examples accordingly.
Correct two copy-and-paste errors in the verify-recover documentation:
describe its initializer as starting a verify-recover operation and refer
to EVP_PKEY_verify_recover() when discussing its input.
Fixes #31989
Assisted-by: Grok:Grok-4.5 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 23 08:29:24 2026
(Merged from https://github.com/openssl/openssl/pull/31995)
Neil Horman [Fri, 17 Jul 2026 18:22:50 +0000 (14:22 -0400)]
use safe_math on do_name_ex
Coverity caught some potential overflows in do_name_ex. Seems unlikely
to occur, but lets just do all the adds under safe_math to ensure we
don't overflow our buffer length.
Todd Short [Fri, 17 Jul 2026 21:34:11 +0000 (17:34 -0400)]
errors: fix stale string overrides in openssl.txt for renamed SSL error codes
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
Viktor Dukhovni [Sat, 11 Jul 2026 14:35:35 +0000 (00:35 +1000)]
Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Nikola Pajkovsky [Thu, 16 Jul 2026 12:15:56 +0000 (14:15 +0200)]
quic: report SRTM entry match status via an output argument
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
Andrew Dinh [Sun, 12 Jul 2026 16:50:05 +0000 (23:50 +0700)]
Wire radix QUIC test framework clock to simulated time
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
Andrew Dinh [Mon, 20 Jul 2026 02:05:59 +0000 (09:05 +0700)]
Fix clean target find/-prune precedence bug
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5 Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
Jakub Zelenka [Tue, 14 Jul 2026 16:26:40 +0000 (18:26 +0200)]
apps: test rsa -text option
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: check return values of SSL_* calls
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: use SSL_set1_ipaddr() instead of SSL_set1_host()
As the latter was deprecated in commit f584ae959cbc "Let's support
multiple names for certificate verification".
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: declare locally used functions as static
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos: add PKCS#12 reading and writing demos to the primary build system
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad31 "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad31 "Convert demos to primary build system" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/README.txt: mention quic-server-block.c and quic-server-non-block.c
Complements: dad45ea769dc "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb01 "Add demo QUIC non-blocking server" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b546 "MVP demo TLS
server", which, while was applied after 2000281dad31 "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b546 "MVP demo TLS server" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/guide/tls-server-block.c: check results of __owur API calls
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Weidong Wang [Sat, 28 Mar 2026 08:33:47 +0000 (03:33 -0500)]
Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
John Claus [Fri, 10 Apr 2026 09:21:30 +0000 (03:21 -0600)]
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type.
Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1.
Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands.
Fixes openssl#30432
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 11:10:47 2026
(Merged from https://github.com/openssl/openssl/pull/30655)
Enji Cooper [Fri, 5 Sep 2025 04:27:29 +0000 (21:27 -0700)]
Add mandoc output support for manpages
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
Fix SM2 RISC-V64 crash from functions emitted into .rodata
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Jakub Zelenka [Thu, 2 Jul 2026 15:37:37 +0000 (17:37 +0200)]
apps: add offline OCSP request/responder/verify round-trip test
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Jakub Zelenka [Sat, 4 Jul 2026 11:58:00 +0000 (13:58 +0200)]
statem: test tls_construct_client_certificate
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
Jakub Zelenka [Fri, 17 Jul 2026 22:09:30 +0000 (00:09 +0200)]
apps: decode DTLSv1.2 records in s_client/s_server -msg output
The msg_cb message callback used by the -msg option only recognised
DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as
"Not TLS data or unknown version" instead of being decoded. Add
DTLS1_2_VERSION to the recognised version check and to the ssl_versions
lookup table, and wrap the now-overlong condition.
Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and
DTLSv1.2, logging the protocol messages via -msg, and checks that every
record is decoded (no "Not TLS data or unknown version" lines).
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Jul 20 09:09:07 2026
(Merged from https://github.com/openssl/openssl/pull/31994)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:23:09 +0000 (11:23 +0200)]
test: update provider Valgrind suppression
The internal provider test intentionally retains its configured provider
when OPENSSL_cleanup() is skipped under OSSL_USE_VALGRIND. The existing
suppression accounts for this state but no longer matches the provider
activation stack because provider_init() appears between
OSSL_provider_init() and provider_activate().
Add the missing frame so the provider context and its diagnostic strings
are correctly suppressed.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:11 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 09:05:35 +0000 (11:05 +0200)]
test: clean up thread-local key in QUIC radix tests
The QUIC radix test creates a new thread-local key for each script but
only clears the associated value during teardown. The key itself
is never deleted.
Delete the thread-local key after all child threads have joined and the
main-thread value has been cleared.
1,536 bytes in 3 blocks are still reachable in loss record 873 of 915
at 0x488D0B0: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
by 0x49561CF: pthread_setspecific@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
by 0x5C0FD7: CRYPTO_THREAD_set_local (threads_pthread.c:1030)
by 0x41132F: radix_thread_init (quic_bindings.c:570)
by 0x4114F7: bindings_process_init (quic_bindings.c:604)
by 0x422563: test_script (main.c:28)
by 0x5152DF: run_tests (driver.c:518)
by 0x517447: main (main.c:52)
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:10 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:41:06 +0000 (09:41 +0200)]
test/p_ossltest: fix uninitialised bytes written in TLS1-AAD GCM mode
The test provider's fake AES-128-GCM cipher works by running the real
sub-cipher for its side effects and then copying the memdup'd input
back over the output buffer, so the "encrypted" record is really the
plaintext.
In a TLS record the buffer handed to the cipher reserves an
uninitialised 8-byte explicit IV at the front and a 16-byte auth tag
at the end for the cipher to fill. OPENSSL_memdup() duplicated those
uninitialised IV/tag regions, and the subsequent memcpy(out, inbuf, inl)
copied them into out. That output was then written to the socket,
triggering valgrind's "Syscall param write(buf) points to uninitialised
byte(s)":
at sock_write (bss_sock.c:155)
by bwrite_conv (bio_meth.c:79)
by BIO_write (bio_lib.c:397)
by statem_flush (statem.c:963)
by ossl_statem_client_post_work (statem_clnt.c:881)
...
Track whether EVP_CTRL_AEAD_TLS1_AAD was set (recorded in
set_ctx_params) and, when encrypting a TLS record, copy only the
plaintext payload back, leaving the explicit IV and tag that the real
sub-cipher actually produced intact.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:08 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Nikola Pajkovsky [Wed, 15 Jul 2026 07:51:51 +0000 (09:51 +0200)]
test: include PID in valgrind log file names
Append the %p (process ID) placeholder to valgrind's --log-file in
both app() and test(). When a test spawns multiple processes sharing
the same result index, they previously wrote to the same log file and
clobbered each other's output. Using %p gives each process its own
log, so no valgrind findings are lost.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Mon Jul 20 09:07:07 2026
(Merged from https://github.com/openssl/openssl/pull/31961)
Jakub Zelenka [Mon, 13 Jul 2026 16:49:29 +0000 (18:49 +0200)]
mkwraps: resolve system (libc) functions via compiler include paths
WRAP[] lists mix OpenSSL functions with libc/POSIX ones such as read()
or socket(), which mkwraps.pl reported as "declaration not found" since
it only searched the project's INCLUDE[] directories.
Fall back to the C compiler's default include search paths for functions
missing from the project headers. They are queried lazily, only on such
a miss, so the all-OpenSSL case still does not walk /usr/include. Parse
the glibc trailing attribute macros (__THROW, __wur, ...) and restrict
qualifier, and add --cc and --no-system.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 20 07:00:57 2026
(Merged from https://github.com/openssl/openssl/pull/31936)
Jakub Zelenka [Tue, 14 Jul 2026 14:59:10 +0000 (16:59 +0200)]
apps: add dgst test coverage for -keyform option
The -keyform (OPT_KEYFORM) option of the dgst app was not exercised by
any test. Add a subtest that converts the RSA test keys to DER and
then signs and verifies with -keyform DER, covering the option for both
the private and public key loading paths.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 06:40:45 2026
(Merged from https://github.com/openssl/openssl/pull/31946)
Jakub Zelenka [Tue, 14 Jul 2026 16:18:26 +0000 (18:18 +0200)]
apps: test dsa -text option
The -text option of the dsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testdsa.pem keypair rather
than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 06:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/31949)
Bob Beck [Wed, 10 Jun 2026 22:44:04 +0000 (16:44 -0600)]
Add a patch disabling the pem_encoder test
This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)
The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Mon, 11 May 2026 17:15:02 +0000 (11:15 -0600)]
Convert internal use of ASN1_STRING_set and ASN1_STRING_length
to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Bob Beck [Thu, 14 May 2026 23:50:49 +0000 (17:50 -0600)]
pass length in cmp_msg stuff
ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
projects / thirdparty / openssl.git / log
