Mounir IDRASSI [Sat, 27 Jun 2026 02:39:18 +0000 (11:39 +0900)]
test/strtoultest: add coverage for ossl_strtol, ossl_strtoint and test_strtoint
Add direct unit tests for the three conversion helpers introduced to
replace atoi()/atol():
- ossl_strtol: signed parse, including negative values, LONG_MIN/MAX
boundaries, ERANGE on overflow, no-consumption and NULL-endptr
full-consumption rules, NULL result/str, and the internal errno reset;
- ossl_strtoint: narrowing to int (INT_MIN/MAX pass, +/-1 fail), long
overflow, plus a NULL result;
- test_strtoint: the test-util helper wrapping OPENSSL_strtoul(),
covering negative rejection, trailing-garbage rejection, empty input,
int and unsigned overflow, and the INT_MAX boundary.
Link strtoultest against the static libcrypto.a instead of the shared
library, since the internal ossl_* symbols are not exported (the version
script hides them with local: *).
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:02:19 2026
(Merged from https://github.com/openssl/openssl/pull/31731)
Mounir IDRASSI [Thu, 25 Jun 2026 13:09:30 +0000 (22:09 +0900)]
Remove remaining atoi()/atol() calls
Remove the remaining direct atoi()/atol() uses across apps, libcrypto,
libssl, providers, demos and tests, and route the replacements through
checked helpers instead of open-coding the conversion at each call site:
- apps use the existing opt_int()/opt_long()/opt_int_arg() parsers;
- libcrypto and provider code use the new internal ossl_strtol()/
ossl_strtoint() helpers, a checked (and, for ossl_strtoint(),
narrowing) signed counterpart to the public OPENSSL_strtoul();
- libssl, demos and tests use OPENSSL_strtoul(); the test code shares
a single test_strtoint() helper rather than repeating the bound check
and cast per file;
- unsigned values use OPENSSL_strtoul(), with call-site-specific range
checks before narrowing where the destination type requires it.
Reject conversion failures and narrow through the helpers rather than
acting on garbage, and preserve the signed RSA-PSS saltlen sentinels
while rejecting invalid numeric strings. Add regression coverage for the
invalid RSA-PSS saltlen string path.
Fixes #8216
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:02:18 2026
(Merged from https://github.com/openssl/openssl/pull/31731)
The internal provider test can retain provider-init allocations
when the Valgrind suppression workflow intentionally skips OPENSSL_cleanup().
Its stack calls OSSL_provider_init directly from provider_activate, without
the provider_init frame covered by the existing suppression.
Add a second exact suppression for that stack shape instead of broadening the
existing block with an ellipsis.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 16:58:17 2026
(Merged from https://github.com/openssl/openssl/pull/32094)
Jakub Zelenka [Thu, 23 Jul 2026 22:02:53 +0000 (00:02 +0200)]
apps: test ecparam -inform, -outform and -conv_form handling
Add test recipe subtests for the ecparam format options: the PEM/DER
parameter roundtrip, rejection of DER input without -inform as the input
format defaults to PEM, the restriction of -outform to PEM and DER, and
the -conv_form selection of the generator point encoding in explicit
parameters including that it has no effect on named curve parameters.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 16:55:11 2026
(Merged from https://github.com/openssl/openssl/pull/32061)
Abel Thomas [Wed, 8 Jul 2026 08:19:40 +0000 (10:19 +0200)]
pkcs7_test: disable time checks in pkcs7_verify_test
The test certificate has a hardcoded validity period, making
`pkcs7_verify_test` fail when run under a faketime outside that
window. Set `X509_V_FLAG_NO_CHECK_TIME` on the store so verification
no longer depends on the system clock.
Fixes #31788
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 16:54:09 2026
(Merged from https://github.com/openssl/openssl/pull/31890)
Abel Thomas [Thu, 9 Jul 2026 12:22:50 +0000 (14:22 +0200)]
pkcs7: null-guard enveloped and signedAndEnveloped arms in PKCS7_stream
Dereferences of `p7->d.enveloped->enc_data` and
`p7->d.signed_and_enveloped->enc_data` crash with UBSan when the union
member is NULL after parsing a minimal/malformed input. Mirror the guard
added for the signed arm in PR #30351.
Added unit-tests to validate the change.
Fixes: #31682 Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Wed Jul 29 16:51:46 2026
(Merged from https://github.com/openssl/openssl/pull/31716)
Mounir IDRASSI [Sun, 7 Jun 2026 06:33:43 +0000 (15:33 +0900)]
Fix CMS Ed448 signer NULL digest handling
Reject ossl_cms_adjust_md() failures unconditionally in
CMS_add1_signer(), so unsupported Ed448 signing with signed attributes
fails cleanly instead of passing a NULL digest to X509_ALGOR_set_md().
Add a defensive NULL digest check to X509_ALGOR_set_md(), and cover
the CMS Ed448 signed-attributes/no-attributes cases plus the low-level
NULL digest path in regression tests.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 16:49:57 2026
(Merged from https://github.com/openssl/openssl/pull/31409)
Andrew Dinh [Fri, 24 Jul 2026 06:37:46 +0000 (13:37 +0700)]
Fix mutcbk_inject_frames after mutation
mutcbk_inject_frames returned 0 once its one-time mutation was applied, which
tells the QTX the packet send failed and tears down the connection instead of
continuing the test with unmutated packets. Now it passes subsequent packets
through unmodified by returning the input header, iovec, and count unchanged.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 14:00:23 2026
(Merged from https://github.com/openssl/openssl/pull/32065)
Jakub Zelenka [Wed, 15 Jul 2026 10:20:03 +0000 (12:20 +0200)]
cms: fix AuthenticatedData authAttrs and unauthAttrs element type
The CMS_AuthenticatedData ASN.1 template declared the authAttrs and
unauthAttrs fields as X509_ALGOR, whereas per RFC 5652 section 9.1 they
are [2] and [3] IMPLICIT SET OF Attribute and the CMS_AuthenticatedData
structure already declares them as STACK_OF(X509_ATTRIBUTE). The implicit
tags [2] and [3] were already correct, so only the element type was wrong.
An Attribute (SEQUENCE { type, SET OF value }) is structurally accepted as
an AlgorithmIdentifier (SEQUENCE { algorithm, ANY OPTIONAL }), so parsing
did not fail; the attributes were merely misinterpreted, e.g. cms -cmsout
-print rendered them as algorithm/parameter instead of decoding them as
attributes. Use X509_ATTRIBUTE with the existing tags so the template
matches the structure.
Add a parse test using a BouncyCastle-generated AuthenticatedData message
carrying an authenticated and an unauthenticated attribute, asserting both
are decoded as SET OF Attribute.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 10:02:08 2026
(Merged from https://github.com/openssl/openssl/pull/31960)
SSL_set_bio() transfers ownership of cbio to the client SSL object.
Clear the local pointer after the handoff so the error path does not
release an SSL-owned reference before SSL_free().
Fixes #32084
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jul 29 09:55:13 2026
(Merged from https://github.com/openssl/openssl/pull/32086)
Matt Caswell [Fri, 26 Jun 2026 08:36:25 +0000 (09:36 +0100)]
test: add regression test for SSL_poll() abort_blocking handling
The race fixed by the previous commit (an item becoming ready in the
window between poll_translate() registering it for cross-thread
notification and the OS-level poll) is normally vanishingly narrow and
not practical to hit by timing alone in a test.
Add ossl_quic_poll_translate_test_step_cb, a test-only instrumentation
hook (always NULL in production use) that poll_translate() calls between
translating consecutive items. This lets a test deterministically make
one item ready while an earlier item's blocking section is still
entered, exercising the abort_blocking path on demand.
Add the poll_abort_blocking RADIX script/test, which uses the hook to
trigger this on two independent QUIC connections (so the second item's
reactor is provably distinct from the first's) and checks that
SSL_poll() reports success and that the first item's blocking-section
entry is correctly balanced afterwards.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jul 29 07:20:33 2026
(Merged from https://github.com/openssl/openssl/pull/31743)
Matt Caswell [Thu, 25 Jun 2026 16:15:16 +0000 (17:15 +0100)]
SSL_poll: fix abort_blocking mishandling in poll_translate()/poll_block()
When SSL_poll() has to block, poll_translate() registers each item's QUIC
connection for cross-thread notification one item at a time. If an item
turns out to already be ready right as it is being registered, translation
sets abort_blocking and is meant to bail out so the caller retries the
readout instead of actually blocking.
Two bugs in that abort path:
- poll_translate() returned immediately on abort_blocking without calling
postpoll_translation_cleanup() for any earlier items that had already
had their blocking section entered. Those items' enter/leave calls were
left unbalanced, leaking into the QUIC reactor's blocking-waiter count.
Fixed by routing through the existing "out" cleanup label, mirroring
what the FAIL_ITEM()/error path already does for items 0..i-1.
- poll_block() initializes ok = 0 and only ever sets it on the actual
poll() success path. The abort_blocking branch jumped straight to "out"
without setting ok, so SSL_poll() reported failure even though nothing
actually went wrong; the caller's retry loop never got a chance to pick
up the now-ready item.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jul 29 07:20:31 2026
(Merged from https://github.com/openssl/openssl/pull/31743)
dannyward630 [Mon, 15 Jun 2026 17:46:57 +0000 (19:46 +0200)]
Document trailing data handling for DER input
Commands that read a single DER object may stop after decoding that object and leave trailing input unchecked. Document that successful decoding is therefore not a full-input validity check.
Fixes #31495
CLA: trivial
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31524)
test: fix flaky -md and -iter mismatch checks in 20-test_enc.t
The subtests added in f26d632a0e assert that "openssl enc -d" exits
non-zero when the key derivation parameters do not match. enc has no
MAC, so a wrong key is not detectable as such; the only signal is
whether the garbage happens to form valid PKCS#7 padding, which
openssl-enc(1) documents as passing better than one time in 256. With
a random salt the tests thus failed about 0.4% of the time.
Assert instead that mismatching parameters do not recover the
plaintext: the decryption must either fail or produce differing output.
Jakub Zelenka [Thu, 16 Jul 2026 08:02:21 +0000 (10:02 +0200)]
apps: drop invalid trust setting in check_cert_might_be_valid()
check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.
The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.
Add a test checking that printing certificate info emits nothing on stderr.
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)
EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
so the "< 0" checks on the cipher-with-MAC path cannot detect any
failure. A return of 0 means a failed or unsupported control, or
for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
usable here.
Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
check fixed by commit 674c23d2656e in this function.
Follow-up to https://github.com/openssl/openssl/pull/30923.
Fixes: ea0add4a8227 "New GOST PKCS12 standard support"
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Mon Jul 27 10:21:13 2026
(Merged from https://github.com/openssl/openssl/pull/31848)
Jakub Zelenka [Tue, 21 Jul 2026 21:06:43 +0000 (23:06 +0200)]
apps: test dgst -r and -c output formats
Add coverage for the coreutils style output of `openssl dgst -r`,
including the newline escaping done by newline_escape_filename() when
the digested file name contains a newline, and for the colon separated
output of `openssl dgst -c`.
The newline in file name part is skipped where such a file cannot be
created.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 10:19:58 2026
(Merged from https://github.com/openssl/openssl/pull/32035)
Jakub Zelenka [Wed, 15 Jul 2026 21:59:08 +0000 (23:59 +0200)]
apps: cover the req -subj modification of an existing request
Add a subtest exercising the code path in the req app that rewrites the
subject of an existing certificate request loaded via -in, i.e. when
-subj is given without -new/-newkey/-x509.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 10:19:06 2026
(Merged from https://github.com/openssl/openssl/pull/31965)
Clarify the bot-only workflow inputs and validate any supplied tuple through
a shared reusable workflow without interpolating input values into shell source.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:56 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
ci: allow run-checker-daily and valgrind-daily to be dispatched against a PR head SHA
Additive: schedule and bare-manual runs unchanged. Adds validated,
fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch each
against an exact commit; run-name echoes them back for correlation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
ci: allow ct-validation-daily to be dispatched against a PR head SHA
Additive: schedule and bare-manual runs unchanged. Adds validated,
fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch against
an exact commit; run-name echoes them back for correlation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Jul 27 10:16:54 2026
(Merged from https://github.com/openssl/openssl/pull/32053)
Jakub Zelenka [Thu, 16 Jul 2026 08:20:04 +0000 (10:20 +0200)]
apps: cover the crl -crlnumber and -issuer print options
Add a subtest exercising the -crlnumber and -issuer print options of the
crl app: with a CRL that carries a CRL Number extension (printed as a hex
value), with a CRL that has none (printed as <NONE>), and checking the
printed issuer DN in both cases.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:15:03 2026
(Merged from https://github.com/openssl/openssl/pull/31969)
Jakub Zelenka [Thu, 16 Jul 2026 07:39:20 +0000 (09:39 +0200)]
apps: cover the x509 -serial, name-hash and -fingerprint print options
Add a subtest exercising the informational print options of the x509 app
that operate on any certificate: -serial, -next_serial, -subject_hash
(and its -hash alias), -issuer_hash, -subject_hash_old, -issuer_hash_old
and -fingerprint (default SHA-1 and -sha256). These branches of the print
loop were previously not exercised.
The expected values are those of the committed test/certs/ca-cert.pem;
the fingerprints are the SHA-1 and SHA-256 digests of its DER encoding.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31967)
Jakub Zelenka [Wed, 8 Jul 2026 22:03:22 +0000 (00:03 +0200)]
x509: replace x509_memfail with in-tree mfail tests
The standalone x509_memfail is superseded by mfail tests. They cover
the certificate parse, self-signature verification and issuer name
hashing paths.
Two new mfail tests still need NO_CHECK because a certificate still
parses with an undecoded public key, and EVP_DigestVerifyFinal falls
back to the original context when its EVP_PKEY_CTX_dup optimisation
fails. The issuer name hashing propagates cleanly and runs checked.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 10:13:22 2026
(Merged from https://github.com/openssl/openssl/pull/31901)
Jakub Zelenka [Tue, 21 Jul 2026 11:47:30 +0000 (13:47 +0200)]
rand: factor out seed source creation and fix store race
rand_get0_primary() created the seed source ahead of the primary DRBG
and stored both under the write lock at the end. When two threads
raced to create the primary DRBG and one of them failed after having
created and stored the seed source, the other thread overwrote the
stored seed source with its own instance, leaking the previous one.
Factor the get-or-create logic out into rand_get0_seed() which
rechecks the global under the write lock, so exactly one instance is
kept and returned to every racing thread, and the seed source is
stored independently of the primary DRBG creation outcome.
Add a regression test checking that creating the primary DRBG creates
and stores the seed source and that later use keeps returning the same
instance.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 09:13:12 2026
(Merged from https://github.com/openssl/openssl/pull/32029)
Jakub Zelenka [Tue, 14 Jul 2026 15:38:03 +0000 (17:38 +0200)]
apps: test enc -P, -nosalt, -md and -iter options
Several enc options were not exercised by any test. Add subtests
covering -P/-p printing of the derived salt, key and iv (deterministic
with a fixed salt and PBKDF2) together with the -nosalt variant that
omits the salt line, a -nosalt encrypt/decrypt round-trip, -md selecting
the key derivation digest with a mismatching digest that must fail to
decrypt, and -iter setting the PBKDF2 iteration count with a mismatching
count that must fail to decrypt.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:11:47 2026
(Merged from https://github.com/openssl/openssl/pull/31948)
Jakub Zelenka [Tue, 14 Jul 2026 17:20:43 +0000 (19:20 +0200)]
apps: test pkcs8 -nocrypt reading a PKCS#8 PEM
Reading an unencrypted PKCS#8 (PrivateKeyInfo) in PEM form with -nocrypt
was not exercised by any test; the existing round-trip test only read the
DER form via -inform DER, hitting d2i_PKCS8_PRIV_KEY_INFO_bio(). The PEM
branch in apps/pkcs8.c (the informat == FORMAT_PEM || FORMAT_UNDEF case
calling PEM_read_bio_PKCS8_PRIV_KEY_INFO()) was left uncovered.
Add a subtest that writes an unencrypted PKCS#8 PEM and reads it back
with -nocrypt from PEM, exercising PEM_read_bio_PKCS8_PRIV_KEY_INFO(),
and checks the recovered key matches the original.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 27 09:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31955)
Jakub Zelenka [Tue, 14 Jul 2026 17:08:20 +0000 (19:08 +0200)]
apps: test pkeyutl -peerform option
The -peerform option of the pkeyutl app was not exercised by any test.
Extend the -derive peer key subtest to convert the peer public key to
DER and derive against it with -peerform DER, checking the shared secret
matches the one derived from the PEM peer key, and that reading the DER
peer key as PEM fails.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:10:00 2026
(Merged from https://github.com/openssl/openssl/pull/31953)
Jakub Zelenka [Tue, 14 Jul 2026 17:41:58 +0000 (19:41 +0200)]
apps: test pkcs12 -clcerts/-cacerts and -name options
The -clcerts and -cacerts certificate filtering and the -name friendly
name option of the pkcs12 app were not exercised by any test. Add a
subtest that exports a PKCS#12 holding a client cert (with a localKeyID),
a CA cert and a friendly name, then checks the friendly name is present,
that -clcerts outputs only the client certificate and -cacerts only the
CA certificate.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:09:09 2026
(Merged from https://github.com/openssl/openssl/pull/31956)
Jakub Zelenka [Wed, 22 Jul 2026 16:41:08 +0000 (18:41 +0200)]
apps: test rsa -modulus output
Add a test recipe subtest checking that 'openssl rsa -modulus' prints the
expected modulus for both a private key and a -pubin public key, mirroring
the existing dsa -modulus test.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:08:13 2026
(Merged from https://github.com/openssl/openssl/pull/32048)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:29 +0000 (00:11 +0200)]
apps: test skeyutl -skeyopt handling
Cover the -skeyopt option of skeyutl using the fake cipher provider: a
key name passed as a key option shows up in the reported key id, while
an option unknown to the key management and an option missing the
opt:value separator both make the command fail.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:06 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:24 +0000 (00:11 +0200)]
test: support key options in the fake cipher provider
The fake cipher key management accepted a key name and raw key bytes on
generation and import, but did not advertise them as settable
parameters, so applications converting opt:value strings with
OSSL_PARAM_allocate_from_text() had nothing to look them up in.
Add the settable parameter table for both generation and import, and
report the key name as the key id, so that setting it has an observable
effect.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
Jakub Zelenka [Tue, 21 Jul 2026 22:11:18 +0000 (00:11 +0200)]
apps: fail skeyutl -genkey on bad -skeyopt
app_params_new_from_opts() returns NULL when a key option cannot be
converted, either because the key management does not settle the
parameter or because the opt:value separator is missing. skeyutl
ignored that and generated the key without the requested options, only
printing the parameter error to stderr and still exiting successfully.
Bail out instead, the way the mac, kdf and enc applications do. A NULL
return is only an error when key options were actually given, as
app_params_new_from_opts() also returns NULL for an empty option list.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/32036)
x509: keep RFC 3779 stacks hole-free after a failed canonize
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL
slots in the live stack when a merge succeeded before a later failure
(overlap, inverted range, or OOM). The NULLs were closed up only on
the success path, so a failed X509v3_asid_canonize() /
X509v3_addr_canonize() left the object poisonable: a retry of either
function dereferences a NULL in the sort comparator during the re-sort,
the i2r extension printers dereference the hole when printing (both in
all builds), and on the asid side is_canonical trips extract_min_max's
ossl_assert(aor != NULL), an abort in debug builds.
This is a regression introduced by e59165a1e3 ("crypto/x509: replace
O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the
previous delete-per-merge loop kept the stack hole-free at every step,
so a failed canonize always left the object sorted, partially merged
and structurally valid.
Run the compaction pass unconditionally, whether the sweep succeeded
or failed, restoring that contract: the stack is always left partially
canonicalized but hole-free, safe to inspect, print, encode, free, or
retry. In v3_addr.c this also routes the bare return-0 error paths
through the done: cleanup label.
New tests cover the crash vectors (is_canonical then retry) on both
the asid and addr sides. The existing *_error_midsweep tests are
strengthened with the same inspect/retry assertions.
Fixes #31856
Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 27 07:59:21 2026
(Merged from https://github.com/openssl/openssl/pull/31857)
Document the missing params argument for OSSL_FUNC_kem_decapsulate_init(),
remove stale name references, and fix the malformed provider-keymgmt(7) link.
Complements: 78c44b05945b Add HPKE DHKEM provider support for EC, X25519 and X448. Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:57:01 2026
(Merged from https://github.com/openssl/openssl/pull/32045)
RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5
and no padding, but the migration guide currently describes their EVP
replacements as using no padding only.
Document direct mappings to EVP_PKEY_sign() and
EVP_PKEY_verify_recover(), and explain that compatibility requires no
signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or
RSA_NO_PADDING.
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:54:00 2026
(Merged from https://github.com/openssl/openssl/pull/31996)
EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured
signature digest rejected a valid signature whose recovered payload is
empty, instead of returning success with a recovered length of zero.
RSA_public_decrypt() returns -1 on error and otherwise the number of
recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5
signature that encodes an empty payload. Pull request #28306 ("Make
error checks on RSA_public_decrypt() consistent") changed the error
check in the raw, no-digest verify-recover path from "ret < 0" to
"ret <= 0", so a valid zero recovered length was mistaken for an error.
Restore the "< 0" check in that branch only, leaving the digest-aware
PKCS#1, X9.31, PSS and ordinary verification paths untouched.
Add test_RSA_verify_recover_empty_payload, which performs a complete
zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and
fails on the unmodified implementation specifically at the
EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same
signature and reports a zero-byte result.
The behavior regressed as a result of #28306.
Fixes #32000
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Fri Jul 24 13:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32001)
Mounir IDRASSI [Tue, 5 May 2026 10:30:49 +0000 (19:30 +0900)]
Reject unknown TLS 1.3 ServerHello extensions
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.
Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.
Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.
Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)
The LoongArch SHA dispatch shim uses the same deprecated typed
interfaces as the RISC-V shim. Switch its entry points to void *
so it no longer depends on deprecated SHA context types.
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:31 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
The RISC-V MD5 and SHA dispatch files use low-level digest context
types that are hidden in no-deprecated builds. Switch their shim
entry points to void * so they no longer depend on deprecated typed
interfaces.
Update the local MD5 declaration to match the untyped shim
interface.
Fixes: openssl/openssl#29357 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 23 15:43:30 2026
(Merged from https://github.com/openssl/openssl/pull/30763)
Fuzz OSSL_ECHSTORE_read_echconfiglist with raw
fuzzer input in stage 1. Then fixup the starting
bytes to reach deeper code withotu relying only on
corpus. Fixup is done for binary encoding only (not base64).
Assisted-by: ChatGPT:gpt-5.5 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 23 13:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/32021)
docs: clarify EVP_PKEY context workflow and operation descriptions
Document that a generated key is returned separately from its generation
context and that a new key-bound context is needed for subsequent
operations. Correct the encrypt and decrypt initialization descriptions
and examples accordingly.
Correct two copy-and-paste errors in the verify-recover documentation:
describe its initializer as starting a verify-recover operation and refer
to EVP_PKEY_verify_recover() when discussing its input.
Fixes #31989
Assisted-by: Grok:Grok-4.5 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 23 08:29:24 2026
(Merged from https://github.com/openssl/openssl/pull/31995)
Neil Horman [Fri, 17 Jul 2026 18:22:50 +0000 (14:22 -0400)]
use safe_math on do_name_ex
Coverity caught some potential overflows in do_name_ex. Seems unlikely
to occur, but lets just do all the adds under safe_math to ensure we
don't overflow our buffer length.
Todd Short [Fri, 17 Jul 2026 21:34:11 +0000 (17:34 -0400)]
errors: fix stale string overrides in openssl.txt for renamed SSL error codes
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
Viktor Dukhovni [Sat, 11 Jul 2026 14:35:35 +0000 (00:35 +1000)]
Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.
A server with client certificate verification requested, but no
session ID context configured, wrongly rejected every TLS 1.3
PSK-based connection, whether a resumption ticket, or an external
PSK. After a full non-PSK handshake the same server issued a
poison resumption PSK (session ticket) that led to handshake
failure if/when used.
The session ID context check exists to stop SSL acceptors with
distinct authentication policies that share a session cache from
resuming each other's sessions and trusting their authentication
results; it doesn't apply to a just-validated external PSK, so
the corresponding sessions are now exempted. Ticket issuance is
also suppressed when it's already known that the ticket would lead
to a handshake failure with the same server's configuration.
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jul 21 14:12:04 2026
(Merged from https://github.com/openssl/openssl/pull/31964)
Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:
- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce
The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.
Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)
Nikola Pajkovsky [Thu, 16 Jul 2026 12:15:56 +0000 (14:15 +0200)]
quic: report SRTM entry match status via an output argument
Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).
Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.
Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <nikola@pajkovsky.cz> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)
Andrew Dinh [Sun, 12 Jul 2026 16:50:05 +0000 (23:50 +0700)]
Wire radix QUIC test framework clock to simulated time
script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".
Fix this by:
- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
channel actually uses the framework's simulated clock, matching what
the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
it gets ticked (SSL_handle_events()) like every other object, driving
its internal key-update/timer processing forward.
Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:
- The clock handed to QUIC channels must be purely virtual (a fixed
base time plus an explicit slip that only advances via
radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
protocol-timing-sensitive assertions become flaky depending on how
long real cryptographic work takes on a given machine (e.g. much
slower on ASAN+UBSAN debug builds), occasionally triggering a
spurious second TXKU before the first is confirmed. radix_process is
a single static struct reused across every script in the suite, so
time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
script would inherit the previous script's accumulated slip and see
time jump forward all at once for a brand new connection. The
virtual clock also needs a small, fixed per-tick advance
(do_per_op(), mirroring the old harness's qtest_add_time(1) in its
own connect-wait loop), since QUIC's internal timers need to
observe time actually passing to make progress during a busy-wait
such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
protected by the existing global mutex (gm): get_time() is now
called by libssl/QUIC's internals (e.g. from within the reactor tick
while holding QUIC's own locks), whereas gm is held by test code
across calls into libssl (e.g. hf_clear() holds gm while calling
SSL_free()). Sharing gm would take gm and QUIC's internal lock in
opposite orders across those two paths, risking a real deadlock
(confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
its own now_cb (terp_now) based on real wall-clock time, so that
OP_SKIP_TIME doesn't eat into its execution budget, and so it can
still catch a genuinely stuck script independent of the virtual
protocol clock. Some scripts also legitimately need a larger budget
than the terp default on slow or heavily instrumented CI machines.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)
Andrew Dinh [Mon, 20 Jul 2026 02:05:59 +0000 (09:05 +0700)]
Fix clean target find/-prune precedence bug
The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.
Assisted-by: Claude:claude-sonnet-5 Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)
Jakub Zelenka [Tue, 14 Jul 2026 16:26:40 +0000 (18:26 +0200)]
apps: test rsa -text option
The -text option of the rsa app was not exercised by any test. Add a
subtest that prints both a private and a public key in text form and,
after stripping the colon-separated hex formatting, verifies the printed
modulus and private exponent match the committed testrsa.pem keypair
rather than merely checking that the labels are present.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31950)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Similar to the ones present in demos/sslecho/main.c.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:03 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: check return values of SSL_* calls
As otherwise it triggers -Werror=unused-result when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:01 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: use SSL_set1_ipaddr() instead of SSL_set1_host()
As the latter was deprecated in commit f584ae959cbc "Let's support
multiple names for certificate verification".
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:19:00 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/sslecho/echecho.c: declare locally used functions as static
Otherwise it triggers -Werror=missing-prototypes when built
with --strict-warnings.
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:59 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:58 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:57 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos: add PKCS#12 reading and writing demos to the primary build system
For some reason, demos in the pkcs12 directory were omitted during
the initial conversion done in commit 2000281dad31 "Convert demos
to primary build system". Rescind this omission.
Complements: 2000281dad31 "Convert demos to primary build system" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:55 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/README.txt: mention quic-server-block.c and quic-server-non-block.c
Complements: dad45ea769dc "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients"
Complements: d9d4d84ceb01 "Add demo QUIC non-blocking server" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:53 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
The blocking TLS server demo code was added f4b4a185b546 "MVP demo TLS
server", which, while was applied after 2000281dad31 "Convert demos
to primary build system", was authored before, and hasn't been updated
accordingly. Rescind that omission by add the relevant introes
to build.info.
Also, while at it, mention tls-server-block in demos/README.txt.
Complements: f4b4a185b546 "MVP demo TLS server" Reported-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk> Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:52 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
demos/guide/tls-server-block.c: check results of __owur API calls
Check results of SSL_CTX_set_session_id_context()
and SSL_CTX_set_timeout() calls, as these functions are marked
with __owur, leading to compilation error when compiled
with -Werror=unused-result.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Mon Jul 20 11:18:51 2026
(Merged from https://github.com/openssl/openssl/pull/31751)
Weidong Wang [Sat, 28 Mar 2026 08:33:47 +0000 (03:33 -0500)]
Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt
A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.
The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.
test for #30510
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)
John Claus [Fri, 10 Apr 2026 09:21:30 +0000 (03:21 -0600)]
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type.
Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1.
Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands.
Fixes openssl#30432
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 11:10:47 2026
(Merged from https://github.com/openssl/openssl/pull/30655)
Enji Cooper [Fri, 5 Sep 2025 04:27:29 +0000 (21:27 -0700)]
Add mandoc output support for manpages
This change modifies the Makefile generator to support mandoc format
manpages, in lieu of \*roff format manpages.
After this commit the user has the ability of specifying the manpage
format to the `--manpage-format` flag. The 2 supported manpage formats
as of writing are "mdoc" and "roff" and the default remains the "roff"
format for legacy and portability reasons.
The mandoc format requires pod2mdoc to be installed, whereas the roff
output format requires pod2man to be installed. The former requires an
additional utility be installed, whereas the latter uses pod2man, a
utility that has been present with perl distributions for well over a
decade.
mandoc format support is being added as it is an easier/arguably more
structured manpage format to parse, making it easier for downstream
consumers like FreeBSD to implement OS-specific build support, as the
minimum dependencies for the OpenSSL build process are more involved
than the tools available for the FreeBSD OS bootstrapping process.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 20 09:52:29 2026
(Merged from https://github.com/openssl/openssl/pull/28450)
Fix SM2 RISC-V64 crash from functions emitted into .rodata
The ecp_sm2p256-riscv64.pl generator switches to .section .rodata
to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but
never switches back before emitting function code.
As a result, the function symbols defined by this file are assembled
into .rodata instead of executable .text. On systems enforcing NX for
.rodata, calling the RISC-V64 SM2 assembly faults immediately.
Fix this by adding .previous after the constant block, restoring the
initial .text section before function emission.
Verified with readelf: before the fix, .text is empty and the function
symbols are in .rodata; after the fix, constants remain in .rodata and
the function symbols are in executable .text.
Jakub Zelenka [Thu, 2 Jul 2026 15:37:37 +0000 (17:37 +0200)]
apps: add offline OCSP request/responder/verify round-trip test
Exercise the request-generation and built-in responder halves of the
ocsp app without any sockets: build a request, have the responder
answer it against the static index, then verify the self-generated
response.
This covers make_ocsp_response, lookup_serial, add_ocsp_cert,
add_ocsp_serial and the status-printing body of print_ocsp_summary
(GOOD and UNKNOWN), none of which were reached by the existing
-respin-only app tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 09:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31834)
Jakub Zelenka [Sat, 4 Jul 2026 11:58:00 +0000 (13:58 +0200)]
statem: test tls_construct_client_certificate
Exercise the certificate output functions under mfail with real key
material embedded in the test: an x509 chain over TLS 1.3 and an RPK over
TLS 1.2. Add deterministic tests for the error branches mfail cannot
reach: an unknown certificate type, a failed write-key change, and
WPACKET failures writing the TLS 1.3 context.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 09:11:48 2026
(Merged from https://github.com/openssl/openssl/pull/31861)
projects / thirdparty / openssl.git / log
