Jakub Zelenka [Sat, 20 Jun 2026 12:06:09 +0000 (14:06 +0200)]
Add unit testing cmocka based framework
This adds the unit testing framework that extends the build so it can
be enabled and tests are built. It is executed as part of the test
using a recipe which executes all unit tests.
The documentation is added with more info about writing the unit tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Jakub Zelenka [Sun, 12 Apr 2026 13:57:43 +0000 (15:57 +0200)]
Deprecate unit-test configure option and SSL_test_functions
The unit-test configure option exists only to expose the
SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
Instead of renaming it, deprecate the option and the SSL_test_functions()
function so both can be removed in OpenSSL 5.0.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:13 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Nikola Pajkovsky [Tue, 30 Jun 2026 07:01:20 +0000 (09:01 +0200)]
crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()
the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)
Mounir IDRASSI [Sat, 27 Jun 2026 22:50:14 +0000 (07:50 +0900)]
Reject AES-XTS operations without an IV
Commit 774525b38bd4 moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.
Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.
Fixes #31755
Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)
Billy Brumley [Thu, 2 Jul 2026 08:30:13 +0000 (04:30 -0400)]
[test] exercise AEAD tag read rejection when actually present during decryption
Set a verify tag while decrypting (which must succeed) before
attempting the read, so the test asserts that a tag cannot be read
back while decrypting even when one is _actually_ present.
This isolates direction logic from tag present logic.
Follow-up to #31734
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:06:40 2026
(Merged from https://github.com/openssl/openssl/pull/31826)
Jakub Zelenka [Tue, 23 Jun 2026 09:35:42 +0000 (11:35 +0200)]
apps: cover the unencrypted key bag path in the pkcs12 test recipe
The NID_keyBag branch of dump_certs_pkeys_bag() was not exercised.
Export a file with -keypbe NONE and dump it, checking the key bag is
reported and its private key is output.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 18:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/31665)
Matt Caswell [Tue, 16 Jun 2026 10:35:33 +0000 (11:35 +0100)]
Add regression test for remove_session_cb under lock
Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.
The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Matt Caswell [Tue, 16 Jun 2026 10:35:25 +0000 (11:35 +0100)]
Fix remove_session_cb called while holding ctx->lock
SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.
Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.
SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).
SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().
SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Steven WdV [Tue, 7 Jul 2026 12:52:30 +0000 (14:52 +0200)]
Allow `getentropy` for Emscripten
Usually Emscripten emulates `/dev/urandom`, but in some cases,
like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms,
where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed
its PRNG. This fixes that by instead using the POSIX function it
implements, like which was already done for WASI.
See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 17:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31882)
Neil Horman [Thu, 2 Jul 2026 17:28:16 +0000 (13:28 -0400)]
Suppress function pointer type validation in clang ubsan
We've been concerned about ubsan errors comming with more recent
versions of clang. specifically versions of clang later than 17
generate hundreds of function pointer type validation errors, i.e.
assigning a function of type void (*)(TYPE *) to a function pointer of
type void (*)(void *).
Fixing these requires the creation of lots of thunk function that get
littered through the code base, and are generally unpleasant to carry.
A better fix requires siginficant code refactoring, and potentially
large changes to our ABI, which we can't support until the next major
release.
So, for now, just suppress those ubsan errors, so we can more properly
deal with the issue when we are able.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 16:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31837)
Jakub Zelenka [Tue, 7 Jul 2026 11:38:16 +0000 (13:38 +0200)]
property: replace property_memfail with in-tree mfail tests
The standalone property_memfail.c program is superseded by memory-failure
tests added directly to property_test.c using the MFAIL harness. They
cover the same property store API surface under allocation failure
injection: ossl_method_store_new, ossl_method_store_add,
ossl_method_store_cache_set and the providerless ossl_method_store_cache_get
lookup, plus the method == NULL cache_set branch.
Unlike the old NO_CHECK-only program, the new tests run as checked mfail
tests, verifying both clean error propagation and the absence of reference
leaks on every failure path. The old program also relied on a stale,
pre-lockless STORED_ALGORITHMS layout to poke the cache directly, which no
longer matches property.c.
Drop property_memfail.c along with its wiring in test/build.info and the
90-test_memfail.t recipe.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 13:05:16 2026
(Merged from https://github.com/openssl/openssl/pull/31880)
BIO_vprintf: fix off-by-one at 512-byte buffer boundary
BIO_vprintf() first formats into a 512-byte stack buffer. Since
vsnprintf() returns the required length excluding the NUL, a return
value of 512 means truncation. The old strict greater-than check
therefore wrote the truncated buffer for exactly 512-byte output.
Use >= for the realloc path and add boundary coverage for 511-, 512-
and 513-byte outputs.
Fixes: a29d157fdb6d "Replace homebrewed implementation of *printf*() functions with libc" Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31842)
Commit aa4b47483f41 "Fix util/mkinstallvars.pl to treat LIBDIR
and libdir correctly" added more logs while bc44134c32b9 "Configure:
Remove extensive debug output by default" was under review, so those
were missed.
Complements: bc44134c32b9 "Configure: Remove extensive debug output by default"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 11:03:11 2026
(Merged from https://github.com/openssl/openssl/pull/31843)
olszomal [Tue, 5 Aug 2025 10:00:03 +0000 (12:00 +0200)]
BIO: avoid returning internal FILE * with UPLINK-enabled builds on Windows
On Windows with UPLINK enabled, BIO_get_fp() may return a FILE * pointer
incompatible with the C runtime. Ensure that it returns NULL instead,
preventing undefined behavior in applications. Update the documentation
to include the missing return type for BIO_[gs]et_fp() and remove
the mention that BIO_get_fp() never returns 0, as it does so now
when NULL fp is returned.
Fix crash in EVP_MD_CTX_copy_ex on inconsistent context
EVP_MD_CTX_copy_ex() might crash on an NULL pointer access when an
inconsistent context is copied. This happens when a context is copied
where digest is set but algctx is NULL, i.e. due to an incomplete
initialization.
The copyctx shortcut for cases where the in and out contexts use the
exact same digest call the copyctx function attempting to copy
the algctx, but it does not check if algctx is NULL on the in or out
contexts.
Fix this by only taking the copyctx shortcut if algctx is non-NULL on
both, in and out. Otherwise use the full copy path which will only
duplicate the algctx if it is non-NULL.
Closes: https://github.com/openssl/openssl/issues/31831 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31867)
Nikola Pajkovsky [Tue, 30 Jun 2026 06:55:09 +0000 (08:55 +0200)]
crypto/x509/x509_lu.c: fix memory leak in obj_ht_foreach_object()
when sk_X509_OBJECT_push() fails after x509_object_dup() has already
allocated the duplicate, the dup is neither stored on the destination
stack nor freed: the error path only pop_free()s the stack the dup was
never pushed onto, so it is leaked.
Set env ASAN_OPTIONS in test explicitly to detect_leaks=1 to force
ASAN to fail the test. Otherwise, the test reports ok even with valid
leak.
Fixes: 08cecb4448e9 "Add X509_STORE_get1_objects" Fixes: https://github.com/openssl/openssl/issues/31771 Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 7 07:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/31784)
Neil Horman [Fri, 3 Jul 2026 20:19:57 +0000 (16:19 -0400)]
Fix new statem_clnt_test when dtls is disabled
The new statem client tests added in comimt c36a9b4 assume that if
OPENSSL_NO_DTLS is not defined, that we have DTLS support, but we have
this odd setup in which we can have DTLS enabled, but DTLS1_2 disabled,
in which case the needed support isn't present, and the test fails.
why we have it setup that way, I'm not sure, but we should only run the
dtls tests if both DTLS and DTLS1_2 support is available.
Fixes #31851
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 6 09:42:44 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
Jakub Zelenka [Tue, 23 Jun 2026 14:32:12 +0000 (16:32 +0200)]
quic: add mfail test for handshake multi-packet processing
This tests handshake level phase using mfail covering SSL_do_handshake.
It is a test for #31323.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:57:38 2026
(Merged from https://github.com/openssl/openssl/pull/31324)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:53:24 2026
(Merged from https://github.com/openssl/openssl/pull/30857)
Neil Horman [Fri, 26 Jun 2026 17:18:49 +0000 (13:18 -0400)]
Remove CRYPTO_GET_REF
This function should never have existed. Its a TOCTOU waiting to
happen. Now that we've eliminated all internal uses, and given that its
an internal function, send it to a nice farm upstate, where it can run
and play with all the other functions that shouldn't have been.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Neil Horman [Fri, 26 Jun 2026 17:06:20 +0000 (13:06 -0400)]
Replace use of CRYPTO_GET_REF in bio_lib
BIO_free_all makes use of CRYPTO_GET_REF to determine if there is
another user of a BIO chain at some artibrary point within the chain.
But CRYPTO_GET_REF is begging for a TOCTOU error, and so we're
deprecating it.
replace the use of GET_REF with an internal version of BIO_free that
returns the value of the resultant ref count, and use that instead, so
we are TOCTOU free
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:13 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Neil Horman [Thu, 25 Jun 2026 21:42:05 +0000 (17:42 -0400)]
eliminate use of CRYPTO_GET_REF in sslapitest
CRYPTO_GET_REF is almost by definition a TOCTOU race, and we shouldn't
use it.
As part of the effort to deprecate it, eliminate its use from
sslapitest.
Avoid the use-after-free possibility by getting a session with
SSL_get1_session (which increments the refcount) and freeing it after
we're done with it.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:10 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Jakub Zelenka [Thu, 25 Jun 2026 10:51:49 +0000 (12:51 +0200)]
apps: cover x509 DER key/cert input formats
The -keyform, -CAform and -CAkeyform options were not covered. Add a
test that self-signs a CSR with a DER-encoded key and signs a CSR with
a DER-encoded CA cert and CA key.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/31733)
Jakub Zelenka [Tue, 30 Jun 2026 17:44:15 +0000 (19:44 +0200)]
apps: test dsa app PVK output
Cover the previously untested PVK code paths of the dsa app: round-trip
the test key through the PVK encoding (mirroring the existing rsa PVK
test, and skipped unless rc4, legacy and pvkkdf are enabled), and check
that requesting PVK output for a public key input is rejected.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:30:48 2026
(Merged from https://github.com/openssl/openssl/pull/31801)
Jakub Zelenka [Thu, 25 Jun 2026 12:44:06 +0000 (14:44 +0200)]
apps: cover crl signature verification
The CRL signature verification path was not exercised. Add a test that
verifies a CRL signature against its issuer certificate supplied via
-CAfile, -CAstore and -CApath.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31736)
Jakub Zelenka [Thu, 25 Jun 2026 10:40:59 +0000 (12:40 +0200)]
apps: cover the req -set_serial option
The OPT_SET_SERIAL case in req_main() was not covered. Add a test that
generates a self-signed certificate with an explicit -set_serial value
and checks it, plus the error path when -set_serial is given twice.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:25:05 2026
(Merged from https://github.com/openssl/openssl/pull/31730)
Jakub Zelenka [Wed, 24 Jun 2026 21:13:02 +0000 (23:13 +0200)]
x509: add delta CRL success test
Exercise the previously uncovered X509_V_FLAG_USE_DELTAS path in
get_delta_sk(): a current delta CRL revoking kLeaf must be honored.
The base and delta CRLs are generated by `ossl-test-tools crltest delta`.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jul 3 19:22:29 2026
(Merged from https://github.com/openssl/openssl/pull/31714)
Jakub Zelenka [Tue, 23 Jun 2026 09:44:51 +0000 (11:44 +0200)]
apps: cover the CRL printing path in the pkcs7 test recipe
The crls != NULL block of pkcs7 -print_certs was not exercised. Build
a PKCS#7 structure containing a CRL with crl2pkcs7 and check the CRL is
both printed and output in PEM form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 3 19:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/31666)
Niels Provos [Tue, 12 May 2026 16:44:12 +0000 (09:44 -0700)]
crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously
merged adjacent entries with an in-place loop that called
sk_..._delete() after each merge, making the merge O(N^2) due to the
per-merge stack shift.
Replace the merge with a single linear sweep using a write index
distinct from the read cursor: mergeable entries fold into the
previous output's upper bound in O(1), non-mergeable entries are slid
forward into the write slot, and the source slot is set to NULL so the
ASN.1 free machinery cannot double-free on a subsequent abort.
Canonicalisation is now O(N log N) overall, bounded by the existing
sort.
Mixed-state-on-error safety is provided by the caller's normal
teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set
replaces without freeing the displaced value, and
ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on
an inner failure leaves the stack in a state that the choice's normal
free path handles cleanly.
New regression tests in test/v3ext.c at N=8192 cover the all-merge,
no-merge, interleaved (slide-forward), range-merge,
overlap-mid-sweep, and inverted-range-mid-sweep paths; the
mixed-state teardown invariant is exercised under ASan + UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Jul 3 19:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/31147)
Jakub Zelenka [Wed, 24 Jun 2026 14:12:37 +0000 (16:12 +0200)]
ci: run full cross-compile tests on PRs with 'extended tests' label
Previously the cross-compile workflow only ran the EVP tests on pull
requests, with the full test suite done only for push events. Allow the
full suite to run on a pull request when it has the 'extended tests'
label which is already used for extended tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 3 14:39:38 2026
(Merged from https://github.com/openssl/openssl/pull/31705)
Neil Horman [Tue, 30 Jun 2026 17:06:52 +0000 (13:06 -0400)]
Add test to exercise non-caching code paths
Use openssl list, which uses EVP_*_do_all_provided on non-caching
algorithms. The do_all_provided path callbacks expect the algorithms
that are looked up to be saveable via up_ref, so this, when run under
asan, makes for a good test to ensure we don't trigger any use after
free situations when not caching algs.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Neil Horman [Mon, 29 Jun 2026 21:27:53 +0000 (17:27 -0400)]
Extend refcounting on evp objects to provider requesed no-caching
We recently removed reference counting for EVP objects, but kept the
refcounting when we build with no-cached-fetch.
There is a corner case in which providers in builds that do caching may
still request non-caching by setting *no_cache = 1 in their query
operations.
OQS tripped over this here:
https://github.com/open-quantum-safe/oqs-provider/pull/787
When a provider requests no caching, we need to treat those algorithms
as though we are running in a no-cached-fetch build and still do ref
counting on them.
Teach our algorithms implementation to understand when a provider is
requesting non-caching, mark them as such and ref count only those.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:13 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
crypto/pem/pem_info.c: avoid switching on PEM_INFO_NONE
Coverity complains that the switch statements in PEM_X509_INFO_read_bio_ex()
switches on PEM_INFO_NONE, while the enclosing condition
(itype != PEM_INFO_NONE) explicitly rules it out. Pacify it by changing
the switch case to default (not removing it to avoid triggering
-Werror=switch).
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695453
Complements: 0e8f2844ed3e "fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
fuzz/provider.c: check evp##_up_ref return value in collect_##evp
Coverity has reported an unchecked result of an evp##_up_ref call
that is checked elsewhere. Rewrite the collect routine to try to do
the up_ref first, and then call free if push doesn't succeed.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695451
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695454 Fixes: f3b988dc2951 "Add provider fuzzer" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:22 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_asym_cipher_free in evp_asym_cipher_from_algorithm
evp_asym_cipher_from_algorithm, in its error path frees the allocated
cipher with EVP_ASM_CIPHER_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_asym_cipher_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_signature_free in evp_signature_from_algorithm
evp_signature_from_algorithm, in its error path frees the allocated sig
with EVP_SIGNATURE_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_signature_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keymgmt_free in keymgmt_from_algorithm
keymgmt_from_algorithm, in its error path frees the allocated keymgmt
with EVP_KEYMGMT_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keymgmt_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keyexch_free in evp_keyexch_from_algorithm
evp_keyexch_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keyexch_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:13:21 +0000 (11:13 -0400)]
use evp_kem_free in evp_kem_from_algorithm
evp_kem_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_kem_free (the internal
function that acutally does free the alg) instead.
Michał Trojnara [Sat, 27 Jun 2026 20:39:44 +0000 (22:39 +0200)]
s_client: skip TCP shutdown drain for datagram protocols
The shutdown-side drain uses a TCP half-close and a fixed 500 ms
select() timeout to let peers consume buffered alerts before close.
Running it for DTLS/QUIC datagram connections causes an unnecessary
delay after the connection has otherwise completed.
Limit this workaround to non-DTLS, non-QUIC connections.
Mounir IDRASSI [Tue, 30 Jun 2026 10:12:18 +0000 (19:12 +0900)]
apps/s_server.c: fix SSL object leak on rpk_enable() failure
In www_body() and rev_body(), con = SSL_new(ctx) is called before
rpk_enable(con), but ownership of con is transferred to ssl_bio only
later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code
jumps to err: before that transfer without freeing con, leaking the SSL
object.
Add SSL_free(con) before goto err in both rpk_enable() failure paths,
matching the adjacent SSL_set_session_id_context() and BIO_new_socket()
error paths. sv_body() is unaffected because its err: block already
frees con.
The global rpk_files is not leaked. Its lifetime is managed
by s_server_main(), which frees it in the end cleanup block.
Mounir IDRASSI [Mon, 29 Jun 2026 07:46:29 +0000 (16:46 +0900)]
Suppress MSVC C4996 in applink.c
applink.c deliberately stores legacy CRT function pointers because
ms/uplink.h expects the old fopen and _open signatures. Keep the
table entries unchanged and suppress MSVC warning C4996 locally
around OPENSSL_Applink() instead of switching to fopen_s or
_sopen_s.
Fixes #8241
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 09:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/31765)
Milan Broz [Mon, 29 Jun 2026 11:59:16 +0000 (13:59 +0200)]
Use more recent default for _WIN32_WINNT
After the windows.h include optimization introduced in
commit 1eaf29ef6c, the _WIN32_WINNT default was changed, causing
performance regressions.
Currently, _WIN32_WINNT is defined as 0x0501, which means WinXP.
This causes the code to be compiled with WinXP-compatible code, notably
- without USE_RWLOCK
- using legacy thread implementation
- legacy RNG seeding (no BCryptGenRandom)
This patch increases the requirement to 0x600 (Windows Vista).
Note that code running on WinXP cannot currently be compiled with
any default configuration, as supported compilers generate executables
for Windows Vista and above.
If we provide some way to support WinXP, it can be done by
redefining _WIN32_WINNT.
Resolves: https://github.com/openssl/project/issues/2010 Fixes: 1eaf29ef6c "Remove direct includes of windows.h where possible" Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
Ingo Franzki [Mon, 29 Jun 2026 11:04:32 +0000 (13:04 +0200)]
s390x: Fix AES-XTS hardware acceleration in IBM z17
For the re-init case where only the IV is specified, but no key, the 'nap'
field must also be initialized.
Instead of setting the s390 specific fields in a special case block, call
ctx->hw->init() also in this case. It performs the necessary setup already
(when the KM function code was once set already).
Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also
be called with a NULL key. It then only performs the IV setup as well as
setting up the 'nap'.
Closes: https://github.com/openssl/openssl/issues/31766 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Jul 1 09:12:26 2026
(Merged from https://github.com/openssl/openssl/pull/31775)
Ingo Franzki [Thu, 25 Jun 2026 09:06:30 +0000 (11:06 +0200)]
s390x: Fix return code handling in HMAC_Init_ex()
When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.
The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).
The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.
Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.
Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.
Fixes: 0499de5adda2 "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)
Jakub Zelenka [Thu, 25 Jun 2026 15:57:37 +0000 (17:57 +0200)]
property: add cache provider-order regression test
When two providers cache the same nid and property query, the first one
to do so must own the providerless cache entry, so that a NULL-provider
lookup keeps resolving to that provider. This covers commit 9d476175d7.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 11:01:57 2026
(Merged from https://github.com/openssl/openssl/pull/31738)
Daniel Kubec [Fri, 5 Jun 2026 11:44:47 +0000 (13:44 +0200)]
TEST: Add DTLS 1.2 coverage for Session ID verification
The DTLS 1.2 tests exercise the same verification logic and confirm that the
behavior matches the TLS 1.2 implementation. The tests pass as expected and
provide additional coverage for DTLS 1.2 without requiring any functional
changes.
Fixes #31250
Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 30 11:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/31389)
Bob Beck [Fri, 22 May 2026 10:10:37 +0000 (04:10 -0600)]
Don't attempt to check the security level on what signed our own certificate.
What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)
Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.
Fixes: https://github.com/openssl/openssl/issues/31195 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
Jakub Zelenka [Tue, 23 Jun 2026 14:21:27 +0000 (16:21 +0200)]
apps: cover the smime multiple -signer parsing path
The signerfile != NULL block in smime_main(), reached when more than one
-signer is given (including the case where a preceding -inkey leaves
keyfile != NULL), was not exercised: the existing multi-signer tests run
through the cms command, and the smime app was only ever run with a
single signer. Add a two-signer test, with an explicit -inkey, to the
pkcs7 test set so it runs through smime when signing.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jun 30 08:57:47 2026
(Merged from https://github.com/openssl/openssl/pull/31675)
Jakub Zelenka [Thu, 18 Jun 2026 18:45:06 +0000 (20:45 +0200)]
quic: add mfail test for RCIDM
This tests memory failures in remote connection ID manager code.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:45 2026
(Merged from https://github.com/openssl/openssl/pull/31602)
Jakub Zelenka [Thu, 25 Jun 2026 20:49:07 +0000 (22:49 +0200)]
quic: add mfail test for multi-packet RXE
Add a record layer test that executes qrx_process_pkt() under mfail
on a freshly created qrx whose rx_free freelist is empty. This
deterministically lands the qrx_ensure_free_rxe() call for the first
packet of a multi-packet datagram among the enumerated injection points
which is the precondition for triggering assert failure in
qrx_validate_hdr_early(). The test reuses rx_script_5's coalesced
Initial+Handshake+1-RTT datagram and only provides the Initial secret,
since the bug fires before any decryption is attempted.
Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:00 2026
(Merged from https://github.com/openssl/openssl/pull/31331)
Jakub Zelenka [Fri, 19 Jun 2026 16:52:37 +0000 (18:52 +0200)]
statem: add direct tests for tls_construct_client_hello
Add a new test which calls tls_construct_client_hello() directly,
creating an SSL_CONNECTION enough to invoke the construct function
without making a full handshake, then verifies the produced
ClientHello structurally and by round-tripping it through the
server-side tls_process_client_hello().
The covered branches include TLS 1.3 (with and without middlebox
compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS
cookie and client_random reuse paths, the deterministic error branches
(WPACKET overflow and no usable ciphers), and the ECH wrapper path
(happy path with server-side decryption, the TLS 1.2 version error, and
OOM). Out-of-memory branches are exercised with the mfail tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Jakub Zelenka [Fri, 19 Jun 2026 13:58:59 +0000 (15:58 +0200)]
statem: fail handshake if there is memory failure in negotiate_dhe
Previously this just resulted in the skip of the group but such failure
should result in a proper error. This is not a big issue but it impacts
mfail tests so it would be good to fail.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:47 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Neil Horman [Wed, 24 Jun 2026 19:55:48 +0000 (15:55 -0400)]
ensure writes are syncronized on windows in CRYPTO_THREAD_run_once
We've tried to fix this properly using InitOnceExecuteOnce, but it
results in an ABI breakage, so we're doing it this way.
on windows, CRYPTO_THREAD_run_once, on weakly memory ordered systems,
may complete the write of the run once variable lock before some of the
writes made by the init callback routine complete. The result is that
on a heavily multithreaded application, other therads may see the data
that was meant to be in an initalized state, as in some erroneous
in-between state, leading to errors.
Fix it by inserting a full memory barrier after we return from the init
callback, and prior to setting the run once variable to ONCE_DONE.
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 08:51:16 2026
(Merged from https://github.com/openssl/openssl/pull/31713)
Mounir IDRASSI [Sun, 14 Jun 2026 07:12:01 +0000 (16:12 +0900)]
test: run RIO notifier smoke test everywhere
The RIO notifier smoke test is currently limited to
Windows targets in both the build metadata and the
test recipe.
The test exercises the notifier abstraction and can
run on other platforms as well, so this removes the
Windows-only guards.
The test remains conditional on QUIC being enabled.
Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jun 30 08:49:54 2026
(Merged from https://github.com/openssl/openssl/pull/31494)
Billy Brumley [Thu, 25 Jun 2026 11:20:25 +0000 (07:20 -0400)]
[test] check tag abuse for AEAD ciphers
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
Pauli [Mon, 22 Jun 2026 23:01:17 +0000 (09:01 +1000)]
demo: add program that shows how to query the FIPS provider version
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/31654)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:32:35 +0000 (08:32 +0200)]
providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:11:32 +0000 (08:11 +0200)]
providers/baseprov.c: remove static globals
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
projects / thirdparty / openssl.git / log
