Bob Beck [Mon, 11 May 2026 16:30:04 +0000 (10:30 -0600)]
Prepare a now opaque ASN1_STRING for the size_t rapture.
Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.
Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.
We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().
ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.
Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.
Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.
Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)
Jakub Zelenka [Sun, 12 Jul 2026 13:02:35 +0000 (15:02 +0200)]
test: don't depend on DTLS alert delivery in sslrecords test
The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.
Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.
Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sat Jul 18 12:53:26 2026
(Merged from https://github.com/openssl/openssl/pull/31927)
Jakub Zelenka [Tue, 14 Jul 2026 16:38:57 +0000 (18:38 +0200)]
apps: test pkey -encopt option
The -encopt option of the pkey app was not exercised by any test; the
existing ML-DSA codec tests only used genpkey -encopt and pkey with
-provparam. Re-encode the seed-priv key into each supported PKCS#8
output format via 'pkey -encopt output_formats:<form>' and check the
result matches the reference for that form. A control compares against
the default (no -encopt) encoding so the match is attributed to -encopt
rather than the default behaviour.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:51:40 2026
(Merged from https://github.com/openssl/openssl/pull/31951)
Jakub Zelenka [Tue, 14 Jul 2026 17:01:24 +0000 (19:01 +0200)]
apps: test ec and ecparam -text options
The -text option was not exercised for the ec or ecparam apps. Add a
subtest to 15-test_ec.t that prints a private and a public EC key and,
after stripping the colon-separated hex formatting, verifies the printed
private and public values match the committed testec-p256.pem keypair as
well as the curve identification. Add a subtest to 15-test_ecparam.t
that prints named and explicit parameters, checking the named form emits
the expected curve OID and NIST name while the explicit form emits the
field parameters and no OID.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Fri Jul 17 08:47:12 2026
(Merged from https://github.com/openssl/openssl/pull/31952)
Andrew Dinh [Fri, 3 Jul 2026 11:18:17 +0000 (18:18 +0700)]
Introduce OP_BIND() to QUIC RADIX test framework
RADIX framework keeps objects needed by test scripts
in two places:
- hash table bound to radix process (`RP()->objs`), all
objects are stored there
- slot which is an array bound to radix thread (`RT()->slot[]`)
The `slot` is an array which is used to pass arguments
to RADIX ops. The typically script is doing something
like this:
```
OP_SELECT_SSL(0, C); /* places 'C' object to slot 0 in thread */
OP_FUNC(print_ssl); /* calls print_ssl function, which prints object */
```
All objects are managed by RADIX framework, scripts have very
limited options to control object's lifetime. The only way for
scripts to let object go is to use `OP_UNBIND()`. The operation
removes the object from hastable (`RP()->objs`) and frees the
object afterwards. This is good enough as long a all tests
are running in single thread. Currently `OP_UNBIND()` is
required when test needs to accept/create more than one stream.
The test has two options. It can use unique name for each
stream it creates/accepts:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_ACCEPT_STREAM_WAIT(C, C1, 0);
OP_ACCEPT_STREAM_WAIT(C, C2, 0);
```
Or script may re-use the same variable for stream,
in that case `OP_UNBIND()` is needed:
```
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
OP_ACCEPT_STREAM_WAIT(C, C0, 0);
OP_UNBIND(C0);
```
Unfortunately `OP_UNBIND()` can not be used when test
uses more than one thread due to missing locking of `RP()->objs`.
Introducing a locking scheme seems to be bit invasive change,
The OP_BIND() here hopes to be sufficient and good enough for now.
The idea is as follows:
- `OP_BIND()` allows script to insert empty object
into `RP()->objs` OP_BIND() is supposed to run before
script spawns thread(s). No manipulation of `RP()->objs`
is allowed after threads are spawned, operations
OP_BIND()/OP_UNBIND() are not thread safe.
- Introduce `OP_F_REPLACE_STREAM` flag which tells
`OP_ACCEPT_STREAM_WAIT()`/`OP_NEW_STREAM()` to re-use
existing id for stream. This `_REPLACE_` flag requires
read-only access to `RP()->objs` hash table.
- change introduces a per radix object mutex so object can
be updated safely w.r.t. RADIX thread which ticks SSL object
bound in radix object.
The guideline for tests which require more then one thread
is as follows:
- the first thread creates complete set of empty objects
for all threads.
- each test thread gets its own set of variables, so it
can populate them later during test with SSL objects
- objects are not supposed to be shared between threads
This is a snippet of script executed by main thread before
additional threads are spawned:
```
...
OP_BIND(C1); /* stream id for child */
OP_BIND(S1); /* stream id for parent */
OP_SPAWN_THREAD(child);
for (i = 0; i < 10; i++) {
OP_NEW_STREAM(S, S1, OP_F_REPLACE_STREAM);
OP_WRITE_B(S1, "foo");
OP_CONCLUDE(S1);
}
```
This snippet comes from child:
```
for (i = 0; i < 10; i++) {
OP_ACCEPT_STREAM_WAIT(C, C1, OP_F_REPLACE_STREAM);
OP_READ_EXPECT_B(C1, "foo");
OP_EXPECT_FIN(C1);
}
```
As you can see parent and child don't use OP_BIND()/OP_UNBIND()
after child thread is spawned.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Fri Jul 17 08:02:04 2026
(Merged from https://github.com/openssl/openssl/pull/31821)
Jakub Zelenka [Thu, 16 Jul 2026 08:53:53 +0000 (10:53 +0200)]
rand: fix jitter seed macro logic
The seeding macro logic was mixed up and incompletely applied. The
macro logic was also cleaned up.
Co-authored-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 17 04:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31970)
Is failing when attempting to read in a der file converting from a
corresponding PEM file containing DSA parameters.
Interestingly The problem was only occuring when:
1) The input was a DER file
and
2) Blake2 was not configured
Doing some tracing of the decoder operation showed that this is occuring
because the OSSL_STORE lookup used to find the proper decoder uses a
"first successful decode wins" approach, after which the loading code
checks to see if the decoded type matches the expected key type.
When decoding PEM, this isn't a problem, as the PEM armoring gives the
decoder a hint as to why type of data the input file is.
But with DER, there is no such hint, and we're at the mercy of whichever
decoder happens to decode the data correctly first. Normally it works
just fine, but when features are disabled or enabled, the order in which
the decoders are attempted may change, affecting the outcome. In this
particular case, disabling blake2 caused the DHX decoder to be attempted
first, which decodes the input der file without issue. That in turn
caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting
a DSA key), and so the test fails.
Fortunately, the code that the dsaparam applet uses to do this decode
provides a keytype hint, which we can use to guide the decode process.
keep the old store lookup method around in case anyone doesn't pass a
uri that is a file path or provide a keytype, but if we do both those
things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell
the decoder that we want to decode the input data as the expected type
(in this case a DSA key).
Fixes #31944
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Thu Jul 16 15:28:32 2026
(Merged from https://github.com/openssl/openssl/pull/31954)
Jakub Zelenka [Thu, 9 Jul 2026 10:53:29 +0000 (12:53 +0200)]
apps: cover the crl -gendelta, -key and -keyform options
The -gendelta, -key and -keyform options of the crl app were previously
untested. It adds a subtest that generates two CRLs with an incrementing
crlNumber and then uses -gendelta with -key to produce a delta CRL,
checking the result carries a Delta CRL Indicator. It also loads the
signing key from DER via -keyform DER, and checks that a mismatching
-keyform and a missing -key both make -gendelta fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:05:31 2026
(Merged from https://github.com/openssl/openssl/pull/31910)
Jakub Zelenka [Wed, 8 Jul 2026 11:29:24 +0000 (13:29 +0200)]
apps: test genpkey app cipher option
Add coverage for encrypting the generated private key with a cipher,
checking it can only be read back with the correct passphrase, and that
a cipher is rejected together with the -genparam option.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/31893)
Jakub Zelenka [Tue, 28 Apr 2026 17:22:46 +0000 (19:22 +0200)]
Integrate mfail functionality to fuzz tests
Run the fuzz corpora under mfail in addition to the normal path, so the
existing inputs also exercise malloc-failure handling. The fuzz.pl harness
sizes the mfail runs to a time budget and, on a leak, bisects down to the
exact file and injection point. Adds a budgeted asan/ubsan CI job to run it.
Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:01:43 2026
(Merged from https://github.com/openssl/openssl/pull/30944)
Jakub Zelenka [Thu, 11 Jun 2026 17:05:43 +0000 (19:05 +0200)]
test: add Windows unit tests setup and initial dgram test
This adds an initial setup for unit testing on Windows that allows
mocking of system functions using Detour library. This works only for
library functions and not object function like wrap so it is a bit
limited but it is still useful for BIO mocking.
An initial BIO bss_dgram test is added covering the Windows specific
parts.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 15 16:00:35 2026
(Merged from https://github.com/openssl/openssl/pull/31915)
Richard Levitte [Tue, 14 Jul 2026 09:34:56 +0000 (11:34 +0200)]
keccak1600x4-avx512vl: fix undefined symbols on macOS
The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
routines through call_internal(), which on non-Win64 emitted a call to
the public global symbol by its bare name. These calls textually
precede the callees' .globl declarations, so x86_64-xlate.pl never
prepends the platform's leading underscore to the referenced symbol.
On ELF (Linux) that is harmless since symbols carry no leading
underscore, but on Mach-O (macOS) the call references the un-decorated
SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
_SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
breaking the darwin64-x86_64 link of libcrypto:
Call the local .L_<name> entry label instead -- the same address as the
public symbol and the pattern the finalize calls already use -- so the
reference resolves locally and these internal routines cannot be
interposed. The Win64 path is unchanged.
Fixes: https://github.com/openssl/openssl/issues/31941 Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration") Assisted-by: Pi:z-ai/glm-5.2 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 14 12:33:50 2026
(Merged from https://github.com/openssl/openssl/pull/31942)
Neil Horman [Fri, 3 Jul 2026 13:05:58 +0000 (09:05 -0400)]
ugment p_ossltest with encoder/decoder/store algs
Create dummy encoder/decoder and store algs in p_ossltest.
They do nothing, except return algorithms on query. This allows our
unit test 30-test_evp_list_noncache.t to exercise the refcounting of
these objects when the provider requests no caching
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:38 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Neil Horman [Fri, 3 Jul 2026 12:40:06 +0000 (08:40 -0400)]
Fix refcounting for ENCODER/DECODER/STORE methods without caching
https://github.com/openssl/openssl/pull/31782
Fixed method refcounting for EVP objects when the provider they are
fetched from requests no-caching, but I neglected to add simmilar
refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a
different fetch path (these use inner_[decoder|encoder|loader]_fetch
rather than inner_evp_generic_fetch.
They got missed because the p_ossltest provider that we use to test
these paths don't provide these objects, so the path never got
exercised.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 14 05:21:36 2026
(Merged from https://github.com/openssl/openssl/pull/31844)
Marcel Cornu [Tue, 5 May 2026 13:33:04 +0000 (13:33 +0000)]
.github: add AVX512VL workflow using Intel SDE
Add a new CI workflow that runs AVX512 specific tests under Intel SDE
v10.8, since GitHub Actions runners do not currently have AVX512
hardware.
SDE emulates AVX512 instructions and spoofs CPUID so the AVX512 code
paths can be exercised.
Two jobs are included: linux (ubuntu-latest) and windows (windows-2022).
Each job builds OpenSSL with no-shared and enable-fips, then runs the
following tests under `sde64 -icx` (Icelake Server):
- ml_dsa_internal_test: exercises AVX512VL ML-DSA sampling
- sha3_x4_internal_test: exercises AVX512VL SHAKE x4 functions
- openssl fipsinstall: runs the full FIPS KAT suite (including ML-DSA
and SHA3 self-tests) against the FIPS provider under emulation
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:57 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Add a new `sha3_x4_internal_test` target and recipe to validate the
internal SHAKE x4 implementation against scalar SHA3 reference paths.
Cover SHAKE-128 and SHAKE-256 in one-shot and incremental modes, plus
multi-absorb and multi-squeeze cases across varied input and output
sizes. Tests are skipped when AVX512VL extensions are not available.
Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:55 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Changes:
- Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported.
- Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl).
- Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules.
- Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable.
Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns
either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending
on the build and CPU capabilities.
- Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc,
included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined.
Co-authored-by: Tomasz Kantecki <tomasz.kantecki@intel.com> Signed-off-by: Marcel Cornu <marcel.d.cornu@intel.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Mon Jul 13 15:55:54 2026
(Merged from https://github.com/openssl/openssl/pull/31090)
Mounir IDRASSI [Wed, 3 Jun 2026 14:44:22 +0000 (23:44 +0900)]
poly1305: reject no-key update and NULL key params
Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged
initialization. If no key has been installed, update still dispatched
into the uninitialized Poly1305 state, which can crash on POLY1305_ASM
builds.
Guard update with the same key_set check used by final and report no key set.
Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before
calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE.
Fixes #31332
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 13 15:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/31382)
Jakub Zelenka [Thu, 9 Jul 2026 10:18:18 +0000 (12:18 +0200)]
apps: cover the x509 -sigopt and -vfyopt options
The -sigopt and -vfyopt options of the x509 app were previously
untested. It adds a subtest that signs a certificate from a CSR with
-sigopt rsa_padding_mode:pss and verifies the issued certificate uses
the rsassaPss signature algorithm, and that verifies an SM2 CSR whose
self-signature uses a non-default distinguishing id supplied via
-vfyopt. It also checks that an unknown -sigopt or -vfyopt makes the
command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:41:57 2026
(Merged from https://github.com/openssl/openssl/pull/31908)
Billy Brumley [Thu, 9 Jul 2026 09:33:01 +0000 (05:33 -0400)]
[test] check late AAD rejection across AEADs
A late AAD update (AAD supplied after the payload has started) must be
rejected, and reported the same way, for every AEAD. #31673 checked this
for ChaCha20-Poly1305 alone, so this change extends it to all AEADs.
test_evp_aead_late_aad covers both the encrypt and decrypt directions and
asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 13 15:40:39 2026
(Merged from https://github.com/openssl/openssl/pull/31906)
Jakub Zelenka [Thu, 9 Jul 2026 07:27:35 +0000 (09:27 +0200)]
apps: cover the req -pkeyopt option
The -pkeyopt option of the req app was previously untested. It adds a
subtest that generates an EC request with -pkeyopt
ec_paramgen_curve:P-384 and verifies the selected curve is used, and
that an unknown -pkeyopt value makes the command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:36:42 2026
(Merged from https://github.com/openssl/openssl/pull/31905)
Jakub Zelenka [Wed, 8 Jul 2026 10:32:18 +0000 (12:32 +0200)]
apps: test pkeyutl app -rev option
Add coverage for the -rev option of the pkeyutl app, checking that the
input buffer is reversed before the operation and that -rev is rejected
together with raw input.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/31891)
Jakub Zelenka [Tue, 7 Jul 2026 21:11:44 +0000 (23:11 +0200)]
apps: test dsaparam app DER output paths
Add coverage for the DER (ASN.1) output of the dsaparam app, exercising
both the parameter output (i2d_KeyParams_bio) and the -genkey private key
output (i2d_PrivateKey_bio).
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31888)
Jakub Zelenka [Tue, 7 Jul 2026 18:21:27 +0000 (20:21 +0200)]
apps: add test coverage for dgst -list
Exercise the previously uncovered show_digests() path in dgst app by
adding a subtest that runs "openssl dgst -list". It checks the header
and that sha256 and sha512 are listed, without assuming the full set of
digests which depends on the build configuration.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:05:45 2026
(Merged from https://github.com/openssl/openssl/pull/31886)
Jakub Zelenka [Thu, 2 Jul 2026 11:45:16 +0000 (13:45 +0200)]
x509: add ocsptest for the OCSP stapled-response verification path
Add test/ocsptest.c, exercising check_cert_ocsp_resp() in x509_vfy.c
through X509_verify_cert() with X509_V_FLAG_OCSP_RESP_CHECK and
responses attached via X509_STORE_CTX_set_ocsp_resp(). This path was
previously only covered indirectly through the TLS multi-stapling
tests in sslapitest.c.
The test builds signed OCSP responses at run time from a flat
root -> leaf PKI (the root is both the trust anchor and the authorized
responder), and covers the good, grace-period, non-successful status,
expired, no-response, and wrong-certificate cases, plus a mfail run
over the success path. The PKI is generated by the test-tools ocsptest
command.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:04:59 2026
(Merged from https://github.com/openssl/openssl/pull/31828)
Jakub Zelenka [Tue, 30 Jun 2026 17:55:44 +0000 (19:55 +0200)]
apps: test rsa app -RSAPublicKey_in/-RSAPublicKey_out options
Cover the previously untested -RSAPublicKey_in and -RSAPublicKey_out
options of the rsa app, which select the PKCS#1 RSAPublicKey structure
rather than the SubjectPublicKeyInfo used by -pubin/-pubout. The new
subtest checks that the RSA PUBLIC KEY header is written, that the
encoding round-trips, and that it is interchangeable with the
SubjectPublicKeyInfo form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:01:22 2026
(Merged from https://github.com/openssl/openssl/pull/31802)
Jakub Zelenka [Tue, 30 Jun 2026 17:21:26 +0000 (19:21 +0200)]
apps: test ecparam app -param_enc option
Exercise the previously untested -param_enc option of the ecparam app
by round-tripping the secp384r1 fixtures between named_curve and
explicit encodings (compared byte for byte against the reference
files), and check that an invalid value is rejected.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Jakub Zelenka [Tue, 30 Jun 2026 17:14:23 +0000 (19:14 +0200)]
apps: test ec app -param_enc option
Exercise the previously untested -param_enc option of the ec app,
covering named_curve and explicit parameter encodings (compared
against checked-in reference encodings) as well as rejection of an
invalid value.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
Jakub Zelenka [Tue, 30 Jun 2026 16:48:57 +0000 (18:48 +0200)]
apps: test pkey -ec_param_enc option
Exercise the previously untested -ec_param_enc option for pkey,
covering named_curve and explicit parameter encodings as well as
rejection of the option on a non-EC key.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:59:39 2026
(Merged from https://github.com/openssl/openssl/pull/31798)
Jakub Zelenka [Mon, 29 Jun 2026 22:29:23 +0000 (00:29 +0200)]
test: build the fake cipher provider as a loadable module
The fake cipher provider was only available in-process, linked into test
binaries via fake_cipher_start(). To exercise app success paths (e.g.
skeyutl -genkey) the openssl app needs to load it as a provider module the
same way it loads legacy.
Make test/fake_cipherprov.c dual-buildable: drop the testutil dependency so
the source links cleanly into a module, add an OSSL_provider_init entry point
under FAKE_CIPHER_AS_MODULE, and add a fake-cipher MODULES target in
test/build.info. Also implement skeymgmt generate so opaque key generation
works, and cover the skeyutl -genkey success path in 20-test_skeyutl.t.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:58:53 2026
(Merged from https://github.com/openssl/openssl/pull/31781)
slontis [Sun, 28 Jun 2026 23:50:07 +0000 (09:50 +1000)]
FIPS: EC keygen - remove unnecessary self tests.
In FIPS mode EC keygen was doing 3 self tests.
ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and
ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and
comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4.
These tests covered both Keygen PCT for Key Agreement and Signatures.
ossl_ec_key_pairwise_check() was also being called from within ec_gen().
The advice from Atsec (lab) is that the sign/verify test within
ecdsa_keygen_pairwise_test() is sufficient according to the updated
rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of
the generated key is unknown at the time of key generation.
Detected during testing of Jipher by Roshith Alankandy (Oracle).
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:47:00 2026
(Merged from https://github.com/openssl/openssl/pull/31761)
Timo Keller [Fri, 26 Jun 2026 09:29:26 +0000 (11:29 +0200)]
s390x: Fix montgomery_multiplication_vectorized
Introduce `reduce_twice_signed` that reduces from `(-2q,q)` to `[0,q)`.
Fix `montgomery_multiplication_vectorized` in `ml_dsa_ntt_vec128.c`
by calling `reduce_twice_signed` at the end of the computation ensuring
that the result is in `[0,q)` and not only in `(-2q,q)` or `(-q,q)`.
Do not call `reduce_once_signed` in `ossl_poly_ntt_mult_scalar_vec128`
and at the end of `ossl_ml_dsa_poly_ntt_inverse_vec128` anymore as it is
not necessary anymore after `reduce_twice_signed`.
Without this fix, keygen, sign or verify might fail or produce wrong
results.
Signed-off-by: Timo Keller <tkeller@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Mon Jul 13 14:45:11 2026
(Merged from https://github.com/openssl/openssl/pull/31744)
Jakub Zelenka [Tue, 23 Jun 2026 21:45:51 +0000 (23:45 +0200)]
cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AAD
The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.
With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.
RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.
Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.
Closes #31635
Closes #26101
Closes #31629
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 14:41:34 2026
(Merged from https://github.com/openssl/openssl/pull/31695)
Neil Horman [Mon, 6 Jul 2026 15:29:42 +0000 (11:29 -0400)]
Remove the rio_notifier run_once routine
We do this odd thing in rio_notifier. when we initalize it, we call a
run_once routine to call WSAStartup(), create a lock and init a
refcount. The purpose of those last two items is to track the refcount
so that we record how many times we init that rio notifier. when the
refcount reaches zero, we tear down the windows socket api by calling
WSA cleanup, destroy the lock and refcount, and then re-initzlize the
run_once gate.
That last step is sketchy. Even though our implementations of run_once
allow doing so, we should never be re-initing those gates, as its going
to be very prone to races, and they are, well, run_once, so we should
only run them once.
It would be nice to get rid of that behavior, which we can fortunately
do.
Indicates that WSAStartup is internally refcounted, so instead of just
calling it once and tracking when we need to correspondingly call
WSACleanup(), just call it every time we initalize an rio_notifier
object, and call WSACleanup when we tear it down. The Winsock api will
take care of knowing when it actually needs to be cleaned up for us. As
such we can eliminate the run_once routine, the refcount and the lock
entirely.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 13 14:26:58 2026
(Merged from https://github.com/openssl/openssl/pull/31777)
Jakub Zelenka [Mon, 29 Jun 2026 20:46:21 +0000 (22:46 +0200)]
mfail: add sampled and count-only modes to test driver
Sampled tests cap allocation-failure injection at a fixed number of
sampled points, running exhaustively when the allocation count is below
that. Non-sampled tests fall back to counting only on non-cached-fetch
builds, where exhaustive injection is impractical.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 09:43:50 2026
(Merged from https://github.com/openssl/openssl/pull/31780)
Marc Gutman [Thu, 9 Jul 2026 20:23:28 +0000 (15:23 -0500)]
Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers
commonly loop, decoding concatenated DER values until the call fails, and
rely on a failure with no queued error to recognise a clean end of input.
CPython's ssl module does this in _add_ca_certs() when loading the Windows
certificate store via SSLContext.load_verify_locations(cadata=...); it
re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
fatal.
Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
The rewrite in commit 35852da1d9 carried this behaviour forward. As a
result Python 3 on Windows fails to initialise an SSLContext with:
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
middle of an object (some bytes already buffered), or on an EOF while still
inside an indefinite-length value awaiting its end-of-contents octets - all
of which are genuine truncation. A clean EOF at a top-level object boundary
again fails without queuing an error, restoring the long-standing behaviour
that looping callers depend on.
Add regression tests covering the clean-EOF, truncated, indefinite-length
truncation and partial-header cases, and document the read behaviour in
ASN1_item_d2i_bio(3).
Fixes #31807
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 08:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/31818)
An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.
Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.
Fixes #31687
Fixes #31688
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
Jakub Zelenka [Tue, 7 Jul 2026 14:37:49 +0000 (16:37 +0200)]
rand: add mfail tests for generation and seeding
Add memory-failure injection coverage to rand_test for the full
RAND_bytes_ex/RAND_priv_bytes_ex stack on a fresh library context, the
SEED-SRC entropy acquisition and the CTR-DRBG operations with a
TEST-RAND parent. The cipher fetches used by the DRBG setup are warmed
up outside the injection window so that the injection targets the RAND
machinery itself.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Jakub Zelenka [Tue, 7 Jul 2026 14:33:12 +0000 (16:33 +0200)]
test-rng: handle nonce length query in generate mode
The DRBG instantiation probes the parent nonce callback with a NULL
output buffer to obtain the nonce length before requesting the actual
nonce. The generate mode branch of test_rng_nonce() wrote the bytes
without checking the output pointer, crashing when TEST-RAND with
generate=1 is used as a DRBG parent. The entropy-buffer branch already
handles a NULL output correctly.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Bob Beck [Fri, 12 Jun 2026 15:55:42 +0000 (09:55 -0600)]
Change the Doxygen doc requirement for non public functions
To be at the prototype site in the internal header file.
The major reason *Why* we would like to have Doxygen style comments
describing what internals do is so that they work with modern IDE's
since most common ones support them.
It's wonderful to be looking at an internal function, thinking "wtf is this",
and be able to hover over it and - boink - up comes the docs. This
typically only works (or works better) when the Doxygen comment is
at the prototype site, not if it is at the implementation site.
This also reinforces the requirement that "yes you do this for shared
functions but you don't need to for statics".
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:18 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Bob Beck [Fri, 12 Jun 2026 03:55:48 +0000 (21:55 -0600)]
Modernize and update STYLE.MD, add DOCUMENTATION.MD
So this repatriates DOCUMENTATION.MD from the web page to the
code base, and links both STYLE.MD and DOCUMENTATION.MD from
CONTRIBUTING.MD
It does a large rototilling of STYLE.MD to address many of the
outstanding concerns noted when I started this before clang-format
last year, and brings us roughly in line with the things that are
addressed in similar style guides for other projects.
Most of the changed or updated reccomendations reflect what we
currently have been doing, or have expressed as a desire to
move to in the future.
Most larger "OpenSSL-isms" I've tried to explicitly call out
to make this a more cohesive and useful guide for a new contributor
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:16 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Bob Beck [Mon, 1 Dec 2025 22:10:48 +0000 (15:10 -0700)]
Add a STYLE.md file and link it from CONTRIBUTING.md
This is effectively, the current coding style policy web page
changed to accomodate clang-format. This is more or less the
same file I have had in the various clang-format sample PR's since
September.
It does include an additional sections on Integers and on
Return Values that are not in the original coding style
policy
It is changed from the September version in that it does not
have mention of keeping include files self contained. I believe
that is achievable and desirable, but I think should be done
as a separate change from this.
There were a number of issues brought up in discussion of this
file in the clang-format PR's. I recorded those in 818, 819,
820, 821, 822, 823, 824, 825, and 826, which we can
link in there to the appropriate section of the document.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:13 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Jakub Zelenka [Fri, 26 Jun 2026 13:04:27 +0000 (15:04 +0200)]
quic: fix intermittent idle-test failure in tserver test
The thread-assisted idle test advances fake time in 10ms steps while the
connection is kept alive solely by the background assist thread sending
keepalive PINGs. The test stepped fake time without checking that a due
keepalive had actually been sent, so whether it went out before the
server's idle deadline lapsed depended on thread scheduling - hence the
intermittent failure.
Now, before each step, check the event timeout (next_deadline minus
fake-now): while a keepalive is still due to be sent it stays at zero, so we
wake the assist thread and re-check without advancing until it goes positive
(or the existing real-time watchdog fires). Only then do we step fake time.
The negotiated 30s idle timeout and 60s idle duration are unchanged, so the
keepalive is still required and still tested; only the race is removed.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:33:45 2026
(Merged from https://github.com/openssl/openssl/pull/31746)
Mounir IDRASSI [Sun, 17 Jan 2021 01:04:08 +0000 (02:04 +0100)]
Allow MinGW-w64 builds to use BCryptGenRandom
MinGW-w64 has provided bcrypt headers and import libraries since
version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding
path for supported MSVC builds. Enable the existing direct
BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or
newer, and link MinGW builds with bcrypt alongside the other Windows
import libraries.
Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined
by both the 32-bit and 64-bit MinGW-w64 toolchains.
Builds targeting older Windows versions keep the CryptoAPI fallback
because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is
below 0x0600.
Fixes #13878
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 12:05:09 2026
(Merged from https://github.com/openssl/openssl/pull/13882)
Bob Beck [Thu, 18 Jun 2026 17:24:17 +0000 (11:24 -0600)]
Simplify printf-attribute guards in bio.h.in and test/testutil/output.h.
Now that C99 is the base level, and we are no longer supporting old
GCC's, The ossl_bio__printf__ / ossl_test__printf__ indirection only existed
to pick the gnu_printf attribute over the printf attribute for MinGW's MS-CRT printf, but
MinGW is already excluded by the outer guard, so we can use the modern attribute
everywhere this code runs.
Spotted by idrassi on review, thanks!.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:19 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Bob Beck [Wed, 17 Jun 2026 22:58:11 +0000 (16:58 -0600)]
Drop Watcom C compiler support.
The only Watcom-specific code in the tree was a <tchar.h> _vsntprintf
mapping in crypto/cryptlib.c. There is no Watcom entry in Configurations/,
no CI job builds with Watcom, and the tree has had no other Watcom-aware
code in many years. The _vsntprintf symbol is supplied by <tchar.h>
on every supported Windows toolchain (MSVC, MinGW), so the conditional
fallback is dead.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Viktor Dukhovni [Sat, 25 Apr 2026 12:12:59 +0000 (22:12 +1000)]
Improve TLS handling of EC point formats
Decouple the ec_point_formats extension from TLS 1.2 X.509
selection and acceptance. Remove tls1_check_pkey_comp() and its
callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3
disregards the extension already, and we can decode any point form
a peer might send, so refusing a compressed peer cert in TLS 1.2
because we didn't advertise compressed buys nothing.
The RFC 4492/8422 section 5.1.2 requirement that the peer's list
contain "uncompressed" used to be enforced in a final hook on the
client side only. Move it to the two points where the negotiated
ciphersuite is known: the client's ServerHello parse hook, and the
server's ServerHello construct hook. Both sites fire the alert
only when an ECC TLS 1.2 ciphersuite has been negotiated, so a
missing "uncompressed" is ignored under TLS 1.3 or a non-ECC
cipher. The client- and server-side parse hooks now share one
function.
Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL;
our own list is built directly inside the constructors. The
peer's list continues to be stored verbatim, and is also exposed
through the SSL_get0_ec_point_formats() accessor (now documented).
New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS
1.2 vs 1.3) plus that a compressed point form EC cert is usable on
both sides without any opt-in.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
Viktor Dukhovni [Sat, 25 Apr 2026 18:05:02 +0000 (04:05 +1000)]
EC: make the group the single source of the point conversion form
The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.
Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped. Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.
EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.
Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
Jakub Zelenka [Sat, 20 Jun 2026 12:06:09 +0000 (14:06 +0200)]
Add unit testing cmocka based framework
This adds the unit testing framework that extends the build so it can
be enabled and tests are built. It is executed as part of the test
using a recipe which executes all unit tests.
The documentation is added with more info about writing the unit tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Jakub Zelenka [Sun, 12 Apr 2026 13:57:43 +0000 (15:57 +0200)]
Deprecate unit-test configure option and SSL_test_functions
The unit-test configure option exists only to expose the
SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
Instead of renaming it, deprecate the option and the SSL_test_functions()
function so both can be removed in OpenSSL 5.0.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:13 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Nikola Pajkovsky [Tue, 30 Jun 2026 07:01:20 +0000 (09:01 +0200)]
crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()
the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)
Mounir IDRASSI [Sat, 27 Jun 2026 22:50:14 +0000 (07:50 +0900)]
Reject AES-XTS operations without an IV
Commit 774525b38bd4 moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.
Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.
Fixes #31755
Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)
Billy Brumley [Thu, 2 Jul 2026 08:30:13 +0000 (04:30 -0400)]
[test] exercise AEAD tag read rejection when actually present during decryption
Set a verify tag while decrypting (which must succeed) before
attempting the read, so the test asserts that a tag cannot be read
back while decrypting even when one is _actually_ present.
This isolates direction logic from tag present logic.
Follow-up to #31734
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:06:40 2026
(Merged from https://github.com/openssl/openssl/pull/31826)
Jakub Zelenka [Tue, 23 Jun 2026 09:35:42 +0000 (11:35 +0200)]
apps: cover the unencrypted key bag path in the pkcs12 test recipe
The NID_keyBag branch of dump_certs_pkeys_bag() was not exercised.
Export a file with -keypbe NONE and dump it, checking the key bag is
reported and its private key is output.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 18:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/31665)
Matt Caswell [Tue, 16 Jun 2026 10:35:33 +0000 (11:35 +0100)]
Add regression test for remove_session_cb under lock
Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.
The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Matt Caswell [Tue, 16 Jun 2026 10:35:25 +0000 (11:35 +0100)]
Fix remove_session_cb called while holding ctx->lock
SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.
Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.
SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).
SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().
SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Steven WdV [Tue, 7 Jul 2026 12:52:30 +0000 (14:52 +0200)]
Allow `getentropy` for Emscripten
Usually Emscripten emulates `/dev/urandom`, but in some cases,
like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms,
where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed
its PRNG. This fixes that by instead using the POSIX function it
implements, like which was already done for WASI.
See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 17:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31882)
Neil Horman [Thu, 2 Jul 2026 17:28:16 +0000 (13:28 -0400)]
Suppress function pointer type validation in clang ubsan
We've been concerned about ubsan errors comming with more recent
versions of clang. specifically versions of clang later than 17
generate hundreds of function pointer type validation errors, i.e.
assigning a function of type void (*)(TYPE *) to a function pointer of
type void (*)(void *).
Fixing these requires the creation of lots of thunk function that get
littered through the code base, and are generally unpleasant to carry.
A better fix requires siginficant code refactoring, and potentially
large changes to our ABI, which we can't support until the next major
release.
So, for now, just suppress those ubsan errors, so we can more properly
deal with the issue when we are able.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 16:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31837)
Jakub Zelenka [Tue, 7 Jul 2026 11:38:16 +0000 (13:38 +0200)]
property: replace property_memfail with in-tree mfail tests
The standalone property_memfail.c program is superseded by memory-failure
tests added directly to property_test.c using the MFAIL harness. They
cover the same property store API surface under allocation failure
injection: ossl_method_store_new, ossl_method_store_add,
ossl_method_store_cache_set and the providerless ossl_method_store_cache_get
lookup, plus the method == NULL cache_set branch.
Unlike the old NO_CHECK-only program, the new tests run as checked mfail
tests, verifying both clean error propagation and the absence of reference
leaks on every failure path. The old program also relied on a stale,
pre-lockless STORED_ALGORITHMS layout to poke the cache directly, which no
longer matches property.c.
Drop property_memfail.c along with its wiring in test/build.info and the
90-test_memfail.t recipe.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 13:05:16 2026
(Merged from https://github.com/openssl/openssl/pull/31880)
BIO_vprintf: fix off-by-one at 512-byte buffer boundary
BIO_vprintf() first formats into a 512-byte stack buffer. Since
vsnprintf() returns the required length excluding the NUL, a return
value of 512 means truncation. The old strict greater-than check
therefore wrote the truncated buffer for exactly 512-byte output.
Use >= for the realloc path and add boundary coverage for 511-, 512-
and 513-byte outputs.
Fixes: a29d157fdb6d "Replace homebrewed implementation of *printf*() functions with libc" Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31842)
Commit aa4b47483f41 "Fix util/mkinstallvars.pl to treat LIBDIR
and libdir correctly" added more logs while bc44134c32b9 "Configure:
Remove extensive debug output by default" was under review, so those
were missed.
Complements: bc44134c32b9 "Configure: Remove extensive debug output by default"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 11:03:11 2026
(Merged from https://github.com/openssl/openssl/pull/31843)
projects / thirdparty / openssl.git / log
