Billy Brumley [Thu, 25 Jun 2026 11:20:25 +0000 (07:20 -0400)]
[test] check tag abuse for AEAD ciphers
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
Pauli [Mon, 22 Jun 2026 23:01:17 +0000 (09:01 +1000)]
demo: add program that shows how to query the FIPS provider version
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/31654)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:32:35 +0000 (08:32 +0200)]
providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:11:32 +0000 (08:11 +0200)]
providers/baseprov.c: remove static globals
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Matt Van Horn [Fri, 1 May 2026 04:46:43 +0000 (21:46 -0700)]
providers/defltprov.c: remove static globals from provider_init
The default provider stored two function pointers from the core
dispatch table (c_gettable_params, c_get_params) in file-scope statics,
written by ossl_default_provider_init() without any synchronization.
When OSSL_PROVIDER_load() is invoked from multiple threads concurrently,
TSAN reports a data race on both writes[1].
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the default provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Jakub Zelenka [Mon, 15 Jun 2026 16:24:28 +0000 (18:24 +0200)]
test/recipes/15-test_pkey.t: extend tests for openssl pkey -text and -text_pub
This slightly improves openssl pkey text coverage.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Jun 28 17:42:46 2026
(Merged from https://github.com/openssl/openssl/pull/31521)
test/asn1_string_test.c: allocate tmpstring properly in asn1_string_new_not_owned_test
Since tmpstring's ownership is transferred to tmp in ASN1_STRING_set0(),
it should be allocated using OPENSSL_strdup() and not strdup()
(as it will be freed with OPENSSL_free() in ASN1_STRING_clear_free()).
Also, don't try to free tmpstring on error, as at no point there is a jump
to err when tmpstring is allocated and not owned by tmp.
Simo Sorce [Mon, 15 Jun 2026 13:59:47 +0000 (09:59 -0400)]
Expand AES mode macro into explicit functions
This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly
written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1,
OFB128, CTR).
Expanding macro-generated functions improves overall code readability, allows
code navigation tools to properly index the function signatures, and provides
clearer stack traces during debugging.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 15 Jun 2026 13:51:16 +0000 (09:51 -0400)]
Prefix internal AES-GCM functions with ossl_
The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are
shared across multiple hardware-specific provider implementations but lacked
the internal `ossl_` prefix. They have been renamed to
`ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update`
respectively to follow OpenSSL naming conventions and prevent potential
namespace collisions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:19:19 +0000 (19:19 -0400)]
Consolidate SPARC T4 AES implementations
Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from
individual mode-specific files into a single unified file
(cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to
improve code organization and maintainability.
Additionally, this change removes the unused `keybits` parameter from several
SPARC T4 hardware initialization routines to clean up the internal API.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:02:27 +0000 (19:02 -0400)]
Consolidate s390x AES hardware implementations
Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and
XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file.
Centralizing the platform-specific logic simplifies the code structure and
improves maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:58 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:51:14 +0000 (18:51 -0400)]
Extract Zvkned key length check to helper
A new helper function, zvkned_key_schedule_supported, is introduced to
centralize the verification of 128-bit and 256-bit key lengths.
This replaces multiple duplicated, hardcoded checks across the RISC-V AES
implementations to improve code readability and maintainability. It also
ensures consistent check handling for XTS mode by correctly evaluating half
the key length.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:56 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:32:37 +0000 (18:32 -0400)]
Consolidate RISC-V 64 AES hardware code
Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM,
and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need
for separate files for GCM and CCM, and extracts RV64-specific XTS code from
the generic XTS hardware file, improving code organization.
Additionally, remove the unused `keybits` parameter from the RV64 AES hardware
retrieval functions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:54 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:03:16 +0000 (18:03 -0400)]
Consolidate RV32I AES hardware implementations
Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM,
and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the
need for separate files (`cipher_aes_gcm_hw_rv32i.c` and
`cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally,
unused `keybits` parameters are removed from the provider hardware
initialization functions to clean up the code.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:52 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 21:22:17 +0000 (17:22 -0400)]
Consolidate ARMv8 AES hardware implementations
Move the ARMv8-specific hardware implementations for AES GCM into a single
consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific
optimizations together to improve code organization and maintainability.
Additionally, remove the unused `keybits` parameter from the ARMv8 provider
functions to simplify the function signatures.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:50 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 20:44:12 +0000 (16:44 -0400)]
Consolidate AESNI hardware implementations
Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes
from individual mode files into a single consolidated file
(`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations
together, improving code organization and maintainability.
As part of this refactoring, the unused `keybits` parameter was removed from
several AES-NI provider functions, and necessary XTS initialization and
context copy functions were exported for shared use.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 17:38:05 +0000 (13:38 -0400)]
Migrate s390x AES-XTS to standard HW interface
Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc`
to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW`
dispatch structure.
This refactoring removes standalone initialization wrappers and integrates the
s390x hardware backend more cleanly with the generic AES-XTS provider code. It
also reduces code duplication by relying on the generic layer for common
validations (such as the maximum blocks per data unit limit) before invoking
the hardware-specific stream cipher.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:46 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 14:40:16 +0000 (10:40 -0400)]
Refactor AES XTS hardware key initialization
Replace complex AES XTS initialization and hardware selection macros
(`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and
`PROV_CIPHER_HW_select_xts`) with standard C functions.
Architecture-specific initializers, particularly for RISC-V, are consolidated
to evaluate CPU capabilities within dedicated initialization functions rather
than relying on macro expansion. This refactoring improves overall code
readability, maintainability, and simplifies debugging by eliminating opaque
multi-statement macros.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:44 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Wed, 10 Jun 2026 21:55:57 +0000 (17:55 -0400)]
Convert AES CCM .inc files to separate .c files
The hardware-specific AES CCM implementations were previously included
directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them
to standalone `.c` files and updates the build configuration, improving
modularity by treating them as separate compilation units.
Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new
`ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code
duplication, removes unsafe macro logic, and introduces proper error handling
during provider key initialization.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:42 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Tue, 9 Jun 2026 22:46:10 +0000 (18:46 -0400)]
Refactor AES hardware cipher implementations
Replace architecture-specific `.inc` files with standalone `.c` files for AES
ciphers and consolidate CFB mode logic into these new modules.
This eliminates the direct inclusion of source files and compiles each
hardware implementation as a separate translation unit.
This refactoring simplifies code organization and remove macro
complexity that makes it hard to understand what is implemented and
where enhancing maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:40 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 8 Jun 2026 22:23:00 +0000 (18:23 -0400)]
Replace GCM_HW_SET_KEY_CTR_FN with a function
The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper
function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA
GCM, the macro expansion was manually inlined.
This refactoring eliminates a multi-line macro to improve debuggability and
type safety. Crucially, the new function checks the return value of the
underlying key setup routines, ensuring that key initialization failures are
now correctly caught and propagated instead of being ignored.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Document the SNMPKDF "pass" parameter with OSSL_KDF_PARAM_PASSWORD,
matching the implementation and other KDF documentation. Also, fix
the nearby grammar.
007bsd [Tue, 23 Jun 2026 18:42:33 +0000 (21:42 +0300)]
crypto/x509/v3_ncons.c: fix scheme buffer leak in nc_uri() for schemeless URIs
OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme. The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed. Add OPENSSL_free(scheme) before the goto.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: e599893a9fec "x509: allow SAN URIs to contain userinfo" Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
007bsd [Tue, 23 Jun 2026 18:42:29 +0000 (21:42 +0300)]
crypto/x509/pcy_cache.c: fix ext_pcons leak in policy_cache_new()
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: 4acc3e907d29 "Initial support for certificate policy checking and evaluation." Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Neil Horman [Sat, 9 May 2026 14:26:57 +0000 (10:26 -0400)]
Fix up property test
Because the duplicate test expects the cache get operation to take
a reference count (which we no longer do), we need to not count it down
before checking the resulting ref count
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:17 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 23:16:28 +0000 (19:16 -0400)]
delay method store free in context_deinit_objs
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:47:16 +0000 (10:47 -0400)]
Makle STORE_LOADER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:13 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:46:54 +0000 (10:46 -0400)]
make OSSL_DECODER no do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:40:33 +0000 (10:40 -0400)]
Make OSSL_ENCODER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:33:49 +0000 (10:33 -0400)]
make EVP_RAND not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:30:16 +0000 (10:30 -0400)]
Make EVP_KEYEXCH not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:05 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:23:00 +0000 (10:23 -0400)]
Make EVP_KEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:18:52 +0000 (10:18 -0400)]
Make EVP_ASYM_CIPHER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:02 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:13:59 +0000 (10:13 -0400)]
Make EVP_SIGNATURE not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:00 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:10:05 +0000 (10:10 -0400)]
make EVP_KEM not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:04:37 +0000 (10:04 -0400)]
Make EVP_KDF not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:29:37 +0000 (17:29 -0400)]
Make EVP_MAC not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:16:40 +0000 (17:16 -0400)]
Make SKEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:51 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:05:11 +0000 (17:05 -0400)]
Make EVP_CIPHERS not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:04:41 +0000 (17:04 -0400)]
Make EVP_MD's not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:06:03 +0000 (17:06 -0400)]
Don't take reference counts on cache lookups
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Jakub Zelenka [Mon, 22 Jun 2026 21:15:15 +0000 (23:15 +0200)]
apps: cover the kdf -cipher option in the test recipe
The -cipher option was not covered. Add KRB5KDF test cases that
exercise it, both via -cipher and the equivalent -kdfopt cipher: form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:01:33 2026
(Merged from https://github.com/openssl/openssl/pull/31651)
Jakub Zelenka [Tue, 23 Jun 2026 13:10:33 +0000 (15:10 +0200)]
apps: fix Ed25519 typo in pkeyutl recipe subtest names
Two subtest descriptions read "Ed2559" instead of "Ed25519".
Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:37 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
Jakub Zelenka [Mon, 22 Jun 2026 17:47:23 +0000 (19:47 +0200)]
apps: cover pkeyutl oneshot buffer path with empty file input
The non-mmap buffer fallback in do_raw_keyop() for oneshot (only_nomd)
keys was never exercised on Unix, since any file with non-zero size
takes the mmap path and returns before reaching it. Signing and
verifying an empty file gives filesize 0, which skips the mmap block
(guarded by filesize > 0) and falls through to the buffer switch,
covering both the SIGN and VERIFY arms.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:36 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
rootvector2 [Sun, 31 May 2026 17:22:26 +0000 (22:52 +0530)]
lms: free previous encoded public key in ossl_lms_pubkey_decode
ossl_lms_pubkey_decode() only freed pkey->encoded when the new public key
had a different length, so re-decoding a same-length key on the documented
repeated-call path overwrote the old buffer without freeing it. Always free
the existing buffer first.
Also clear pkey->encodedlen on the error path so a failed decode leaves the
key in a consistent state instead of keeping a stale length.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:58:46 2026
(Merged from https://github.com/openssl/openssl/pull/31345)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 16:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/31700)
dannyward630 [Thu, 18 Jun 2026 17:42:34 +0000 (19:42 +0200)]
Mention removed ERR macros in changelog
Update the existing 4.0.0 changelog entry for the ERR state cleanup to list the removed ERR_FLAG_MARK, ERR_FLAG_CLEAR, and ERR_NUM_ERRORS macros.
Fixes #31056
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:37:57 2026
(Merged from https://github.com/openssl/openssl/pull/31598)
Nikola Pajkovsky [Wed, 20 May 2026 06:20:33 +0000 (08:20 +0200)]
x_all.c: avoid mismatched d2i/i2d function pointer casts
the d2i_*/i2d_* fp and bio wrappers for RSA_PUBKEY, the DSA and EC key
types, and the EVP_PKEY Private/PUBKEY converters passed their
type-specific functions to ASN1_{d2i,i2d}_{fp,bio}, which invoke them
through the generic d2i_of_void / i2d_of_void / void *(*)(void) pointer
types.
Add file-local thunks with the exact generic signatures that forward to
the concrete functions, and pass those instead of cast pointers. This
removes the mismatched calls while keeping the public API unchanged.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:13:01 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Wed, 20 May 2026 06:19:46 +0000 (08:19 +0200)]
avoid d2i_of_void asn1 callbacks in GENERAL_NAME_dup
use IMPLEMENT_ASN1_DUP_FUNCTION(GENERAL_NAME) so duplication goes
through ASN1_item_dup() instead of calling ASN1_dup() with cast
i2d/d2i function pointers. This avoids UBSan function type errors
while preserving the public GENERAL_NAME_dup() API.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:59 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 09:39:41 +0000 (11:39 +0200)]
avoid mismatched d2i callbacks in PEM readers
decode PEM payloads through the generated typed d2i_* functions in the
PEM read macros instead of routing them through the d2i_of_void
callback path. This avoids UBSan function type mismatch reports while
preserving the public PEM reader APIs.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:57 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Thu, 21 May 2026 05:14:07 +0000 (07:14 +0200)]
decode_der2key: wrap key-free callbacks to avoid function pointer casts
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:55 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 08:50:02 +0000 (10:50 +0200)]
fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex
PEM_X509_INFO_read_bio_ex stored d2i_X509, d2i_X509_AUX, d2i_X509_CRL
or d2i_AutoPrivateKey -- each with a distinct, type-specific signature
returning X509*, X509_CRL* or EVP_PKEY* -- in a single d2i_of_void*
variable and dispatched through it:
Replace the function-pointer dispatch with an enum tag
(pem_info_type) and a switch that calls each typed d2i_* directly
with the correctly type.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 07:36:49 +0000 (09:36 +0200)]
fix function pointer type mismatch in OCSP_REQUEST/RESPONSE bio macros
d2i_OCSP_REQUEST/d2i_OCSP_RESPONSE are declared with type-specific
signatures returning OCSP_REQUEST*/OCSP_RESPONSE*, but the
d2i_OCSP_{REQUEST,RESPONSE}_bio macros routed them through
ASN1_d2i_bio_of -> ASN1_d2i_bio, which calls them via a
d2i_of_void* pointer:
void *(*)(void **, const unsigned char **, long)
The analogous i2d_OCSP_{REQUEST,RESPONSE}_bio macros did the same
through ASN1_i2d_bio_of -> ASN1_i2d_bio with i2d_of_void*.
Rewrite the macros to dispatch through
ASN1_item_d2i_bio/ASN1_item_i2d_bio with ASN1_ITEM_rptr(OCSP_*)
directly. This eliminates the function-pointer cast entirely; both old
and new paths bottom out in the same ASN1_item_d2i_ex / ASN1_item_i2d
call, so behavior is identical.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:50 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Wed, 20 May 2026 06:51:07 +0000 (08:51 +0200)]
preserve stack thunks across sk_TYPE_dup
ensure typed stack duplicates keep their compare, copy, and free thunks so
later operations do not call typed callbacks through erased void * function
pointer signatures.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:48 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 13:42:47 +0000 (15:42 +0200)]
util: set thunks for sk_${nametype}_new(_reserve)
call OPENSSL_sk_set_thunks for sk_${nametype}_new and
sk_${nametype}_new_reserve, and wrap the long generated stack
constructor and deep-copy macros across multiple lines so the nested
thunk setup is easier to read and maintain.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:46 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Bob Beck [Thu, 18 Jun 2026 17:50:37 +0000 (11:50 -0600)]
Drop Windows CE support.
Windows CE has been out of mainstream support since 2018
and will not have a modern toolchain capable of compiling
a modern OpenSSL.
The vc_wince_info Perl helper, the crypto/LPdir_wince.c
directory backend, and a long tail of _WIN32_WCE
/ OPENSSL_SYS_WINCE guards across the Windows code paths
get removed.
Spotted by idrassi.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:27:18 2026
(Merged from https://github.com/openssl/openssl/pull/31601)
crypto/ctype.c: fix off-by-one OOB in ossl_toascii()/ossl_fromascii()
Incorrect check for the upper bound allowed the value of 256 to slip
through, which could lead to OOB read one element beyound the end
of the os_toascii/os_toebcdic arrays. Fix that by changing
the comparison with 256 from strictly great to great-or-equal.
Found by cppcheck.
Fixes: a1df06b36347 "This has been added to avoid the situation where some host ctype.h functions return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:19:30 2026
(Merged from https://github.com/openssl/openssl/pull/31661)
rec_layer_s3.c: prevent max_early_data overflow in ossl_early_data_count_ok()
Apply change similar to the one made in d41a9225196b "tls_common.c: prevent
max_early_data overflow in rlayer_early_data_count_ok()"
to ossl_early_data_count_ok(), that has similar logic in it
(as rlayer_early_data_count_ok() has been copied
from ossl_early_data_count_ok() in 9dd90232d537 "Move early data counting
out of the SSL object and into the record layer").
Complements: d41a9225196b "tls_common.c: prevent max_early_data overflow in rlayer_early_data_count_ok()" Fixes: 70ef40a05e06 "Check max_early_data against the amount of early data we actually receive" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Thu Jun 25 07:13:07 2026
(Merged from https://github.com/openssl/openssl/pull/31628)
Jakub Zelenka [Mon, 22 Jun 2026 19:33:12 +0000 (21:33 +0200)]
apps: add error-path test recipe for skeyutl
Cover the help, option-parsing and error paths of the skeyutl command.
The successful -genkey path is not exercised as no built-in provider
implements opaque symmetric key generation yet.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jun 25 07:10:05 2026
(Merged from https://github.com/openssl/openssl/pull/31648)
Jakub Zelenka [Thu, 18 Jun 2026 17:26:47 +0000 (19:26 +0200)]
quic: add mfail tests for QUIC SRTM
This cover various function for SRTM.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 07:06:31 2026
(Merged from https://github.com/openssl/openssl/pull/31593)
Daniel Kubec [Tue, 23 Jun 2026 12:10:45 +0000 (14:10 +0200)]
AEAD: reject late AAD in ChaCha20-Poly1305 after plaintext update
Align behavior with AES GCM, which already rejects this misuse with a hard
error, by tracking whether plaintext processing has started and returning an
error if AAD is supplied afterwards.
Fixes #31188
Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 07:01:44 2026
(Merged from https://github.com/openssl/openssl/pull/31673)
Nikola Pajkovsky [Tue, 23 Jun 2026 09:05:18 +0000 (11:05 +0200)]
crypto/armcap.c: reformat MIDR CPU-model conditionals for readability
break long chain of MIDR_IS_CPU_MODEL() alternatives packed onto a
single line, which was effectively unreadable and impossible to review
or diff one model at a time.
move the OPENSSL_armcap_P feature-flag test to the front of the
expression so the guard is obvious before the model list. This is a
formatting-only change.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 06:10:45 2026
(Merged from https://github.com/openssl/openssl/pull/31664)
Jakub Zelenka [Mon, 22 Jun 2026 21:30:49 +0000 (23:30 +0200)]
apps: cover the ec -conv_form option in the test recipe
The -conv_form option was not covered. Add a subtest that checks a
valid form changes the public key encoding and that an invalid form
is rejected. The DER encodings are also compared against committed
reference files, as they are deterministic for testec-p256.pem.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 06:08:38 2026
(Merged from https://github.com/openssl/openssl/pull/31652)
Viktor Dukhovni [Sat, 14 Mar 2026 09:47:06 +0000 (20:47 +1100)]
Once initialised, ML-DSA keys should be immutable
ML-DSA keys should become immutable once key material has been added.
This is already the case for at least ML-KEM keys, and should generally
be the case across all key types.
- Added the requisite check in the key management provider ml_dsa_import()
function.
- Also, consolidated the ML-KEM checks in ml_kem_import(). These were
previously partly in ml_kem_key_fromdata().
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jun 25 02:03:35 2026
(Merged from https://github.com/openssl/openssl/pull/30421)
Kirill Ermoshin [Mon, 22 Jun 2026 09:52:39 +0000 (12:52 +0300)]
Remove aliases for IANA-GOST2012-GOST8912-GOST8912
"gost2012_256/512" sigalgs aliases of IANA-GOST2012-GOST8912-GOST8912 equals
to sigalgs of LEAGACY-GOST2012-GOST8912-GOST8912 so we can't distinguish
between them for the legacy algorithm
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:04 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 15:07:02 2026
(Merged from https://github.com/openssl/openssl/pull/31562)
Tomas Mraz [Tue, 23 Jun 2026 07:57:32 +0000 (09:57 +0200)]
Always ignore the contents of the legacy record version
As per RFC8446 this value must be ignored.
Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jun 24 13:06:55 2026
(Merged from https://github.com/openssl/openssl/pull/31662)
Bob Beck [Fri, 29 May 2026 11:39:40 +0000 (05:39 -0600)]
Add documentation for NAME_CONSTRAINTS_check
We document which names and name constraints will be evaluated
as well as the limits that will be placed on the evauluation on
a per certificate basis.
We call out in the BUGS section that the RFC 5280 requires a byte
per byte match of name constraints unless the higher level protocol
has defines a different matching method for wildcards. This
"deferall of specification" and corresponding lack of specification
by upper level protocols means that across implementations encountering
the default behaviour is to be expected, and that therefore relying
on excluded names to constrain signers in a PKI from signing wildcards
is ill advised.
This is then cross referenced in the documentation for X509_verify_cert
and the maximum possible comparisons which can be forces in a certificate
validtion noted in the BUGS section of X509_verify_cert.
Fixes: https://github.com/openssl/openssl/issues/30706 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun 24 13:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/31334)
Mounir IDRASSI [Wed, 17 Jun 2026 11:35:05 +0000 (20:35 +0900)]
Reject HelloRequest in TLS 1.3
TLS 1.3 reserves handshake message type 0 and must not silently
ignore HelloRequest records. The legacy client-side HelloRequest skip
path in tls_get_message_header() could run before the TLS 1.3 state
machine had a chance to reject the message, so a zero-length
HelloRequest injected after ClientHello was discarded instead of
triggering unexpected_message.
Restrict the skip to cases where TLS 1.3 is no longer possible.
Before ServerHello selects a version, s->version is the configured
maximum; after ServerHello or during renegotiation, it is the
negotiated version. Skip only when that value is below TLS 1.3,
preserving the existing TLS 1.2-and-below behavior.
Add TLSProxy regression tests covering rejection while TLS 1.3 is
possible and the preserved TLS 1.2 skip after ServerHello.
Fixes #31531
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 13:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31577)
Bernd Edlinger [Mon, 15 Jun 2026 18:10:07 +0000 (20:10 +0200)]
Prevent integer overflow in ASN1_mbstring_ncopy
This prevents a theoretically possible integer overflow
in OPENSSL_malloc(outlen + 1) at the end of ASN1_mbstring_ncopy,
when outlen is exactly INT_MAX.
That affects conversions from MBSTRING_ASC to MBSTRING_UTF8
and MBSTRING_UTF8 to MBSTRING_ASC,
because a terminating zero has to be added to the result.
And also conversions MBSTRING_BMP to MBSTRING_UTF8
in cases when UTF8 characters 0x800..0xFFFF are encoded
as 3-byte UTF8-characters and the resulting UTF8-string
is exactly INT_MAX in size.
Fixes: 97f6b621f7af ("Reject oversized inputs in ASN1_mbstring_ncopy()") Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 24 12:49:08 2026
(Merged from https://github.com/openssl/openssl/pull/31527)
Billy Brumley [Wed, 17 Jun 2026 06:17:45 +0000 (02:17 -0400)]
[test] various zero-length message positive and negative tests for AEAD ciphers
A zero-length AEAD message driven through the one-shot EVP_Cipher() interface
must agree with the streaming EVP_CipherFinal_ex() path. This checks:
- an empty message yields the same tag via both interfaces
- the true tag passes verification on decrypt
- the modified tag fails verification on decrypt
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 24 12:47:11 2026
(Merged from https://github.com/openssl/openssl/pull/31555)
pkcs7: Fix negative index handling in PKCS7_get_issuer_and_serial()
Reject negative indices before looking up the recipient info stack
entry. This makes negative out-of-range indices match the existing
behavior for too-large positive indices and avoids dereferencing
a NULL recipient info.
Add a regression test for the negative index case.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed Jun 24 09:10:22 2026
(Merged from https://github.com/openssl/openssl/pull/30914)
Fix unqualified reference to openssl in 25-test_verify_store.t
This problem resulted in the wrong location of openssl being used
for one step in subtest 7. The error condition is hidden if openssl
appears in the PATH.
Resolves: https://github.com/openssl/openssl/issues/31496 Fixes: 3638ffc38015 "Refactor cache_objects() loop and object type handling" Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Wed Jun 24 08:47:58 2026
(Merged from https://github.com/openssl/openssl/pull/31647)
Haiyang Huang [Thu, 18 Jun 2026 01:19:42 +0000 (09:19 +0800)]
quic: reject ACK of an unsent packet number
ossl_ackm_on_rx_ack_frame() stored ack_ranges[0].end into
largest_acked_pkt[pkt_space] without checking it against the highest
packet number actually sent in that space. Because largest_acked_pkt
only ever increases and drives loss detection, an ACK acknowledging a
packet number that was never sent (up to 2**62 - 1) pins the value and
causes every in-flight and subsequently-sent packet to be declared lost,
permanently corrupting loss detection for the connection.
RFC 9000 s. 13.1 recommends treating an acknowledgment for a packet the
endpoint did not send as a connection error of type PROTOCOL_VIOLATION,
where it can be detected.
Reject any ACK whose largest acknowledged packet number exceeds the
highest packet number sent in that space; the bound, highest_sent, is
already tracked. The depacketiser raises PROTOCOL_VIOLATION when the ACK
manager rejects the frame.
Update the QUIC tests for the new behaviour: cases 7 and 8 now assert
rejection, case 14 covers the 2**62 - 1 boundary, two pre-existing
fixtures that acknowledged one packet past the highest sent are
corrected, and the "fictional PN" script now expects a PROTOCOL_VIOLATION
close.
Fixes: fa4e92a70a5f "QUIC ACK Manager, Statistics Manager and Congestion Control API" Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:36:27 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
Avoid NULL dereference if RSA_PSS_PARAMS_dup() fails in ossl_rsa_dup()
RSA_PSS_PARAMS_dup() can return NULL on failure (e.g. memory
allocation failure). The subsequent code dereferenced dupkey->pss
unconditionally when checking dupkey->pss->maskGenAlgorithm, which
would result in a NULL pointer dereference.
Check the return value and jump to the error handling instead, which
properly frees the partially constructed key.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 16:32:24 2026
(Merged from https://github.com/openssl/openssl/pull/31619)
Update signature_tls13_scheme_list array in accordance with the current
state of the "TLS SignatureScheme" table at [1]; leave TLS 1.2 GOST
definitions be for now.
Note: these are used only for debugging output when -security_debug
option is provided to s_client/s_server commands.
ssl/t1_trce.c: use macros from tlssigalgs.h, reorder accordingly
The macro definitions for the SignatureScheme values and names
are available "include/internal/tlssigalgs.h" (contrary to what comment
says), use them and also order the items in the order they are present
in the header file.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Jun 23 16:29:59 2026
(Merged from https://github.com/openssl/openssl/pull/31248)
007bsd [Fri, 15 May 2026 09:04:58 +0000 (12:04 +0300)]
Fix key2ms_newctx() pointer type mismatch in MSBLOB/PVK key encoder
key2ms_newctx() returned struct key2ms_ctx_st *, but is registered
as OSSL_FUNC_ENCODER_NEWCTX and called through OSSL_FUNC_encoder_newctx_fn
(void *(*)(void *)), which is a case of undefined behavior, flagged
by -fsanitize=function. Same class as [1], missed there.
Give it the correct signature and add the self-check forward
declaration, as key2ms_freectx() already has.
[1] https://github.com/openssl/openssl/pull/31078
CLA: trivial Fixes: 0cc0164d193f "PROV: Add MSBLOB and PVK encoders" Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jun 23 14:45:54 2026
(Merged from https://github.com/openssl/openssl/pull/31189)
Jakub Zelenka [Thu, 18 Jun 2026 16:02:05 +0000 (18:02 +0200)]
quic: add mfail test for QUIC SRT generator
This slightly improves its coverage.
Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 14:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31589)
Jakub Zelenka [Thu, 7 May 2026 17:22:49 +0000 (19:22 +0200)]
Add mfail test for SSL_new() with ctx QUIC client method
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 23 13:16:52 2026
(Merged from https://github.com/openssl/openssl/pull/31249)
This change should allow us to move QUIC test scripts from
quic_multistream test to radix without dealing with conflict+rebase.
the idea is there will be one PR for each script, so more people
will be able to submit those PRs without rsiking a conflicts around
the scripts array. This should allow for smoot reciew/git push
flow.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 23 12:21:25 2026
(Merged from https://github.com/openssl/openssl/pull/31547)
Bob Beck [Tue, 16 Jun 2026 18:49:52 +0000 (12:49 -0600)]
doc/man3/ASN1_aux_cb.pod: correct return code documentation for the callbacks
Attempt to make the documentation match the code.
Not attempting to change what the code does at this point, it's
all very random, and since it's been there, it is effectively established
public API now.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 11:56:58 2026
(Merged from https://github.com/openssl/openssl/pull/31549)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 10:36:52 2026
(Merged from https://github.com/openssl/openssl/pull/31604)
Bob Beck [Thu, 18 Jun 2026 18:02:06 +0000 (12:02 -0600)]
Fix OSSL_ATOMICS_LOCKLESS detection for Windows toolchains
The check referenced USE_INTERLOCKEDOR64, but the macro defined above
for MSVC (with the right architecture/version) and 64-bit MinGW is
OSSL_USE_INTERLOCKEDOR64. As a result, OSSL_ATOMICS_LOCKLESS was
never defined on Windows, even though those toolchains do provide
lockless atomics.
Reported-by: Mounir IDRASSI <mounir.idrassi@idrix.fr> Fixes: 26c57423933c "Use the actually correct define for solaris and gcc" Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun 22 07:22:31 2026
(Merged from https://github.com/openssl/openssl/pull/31600)
Abel Tom [Thu, 18 Jun 2026 11:58:35 +0000 (13:58 +0200)]
tls_common.c: prevent max_early_data overflow in rlayer_early_data_count_ok()
Make the local max_early_data variable uint64_t so an overflow
cannot occur if the max_early_data field in the record layer struct
has the maximum value: UNT32_MAX (0xFFFFFFFF).
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Sun Jun 21 23:50:02 2026
(Merged from https://github.com/openssl/openssl/pull/31538)
Nikola Pajkovsky [Tue, 16 Jun 2026 10:58:45 +0000 (12:58 +0200)]
asn1: centralize aux const-callback dispatch to avoid function pointer cast
Replace the per-call-site `(ASN1_aux_const_cb *)aux->asn1_cb` cast in
ASN1_item_ex_i2d() and asn1_item_print_ctx() with a shared helper,
ossl_asn1_aux_const_cb(), which invokes the legacy non-const callback
through its real type. This avoids the UBSAN function-pointer-type
mismatch while preserving backward compatibility.
Fixes: https://github.com/openssl/project/issues/1970 Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sun Jun 21 23:38:12 2026
(Merged from https://github.com/openssl/openssl/pull/31541)
Correct a number of typos found in the man pages:
* doc/man3/SSL_CTX_set1_curves.pod: attenion -> attention
* doc/man3/CMS_EncryptedData_decrypt.pod: decypted -> decrypted
* doc/man3/X509_get_default_cert_file.pod: delimeter -> delimiter
* doc/man3/SSL_CTX_set_msg_callback.pod: diagostic -> diagnostic
* doc/man7/openssl-core_dispatch.h.pod: dipatch -> dispatch
* doc/man3/BIO_s_datagram.pod: hecause -> because
* doc/man3/ASN1_aux_cb.pod: auxiliarly -> auxiliary
CLA: trivial Fixes: 3d9d1ce52904 "Add documentation for newly added ASN1 functions" Fixes: 408622b73a18 "BIO_s_dgram: add documentation and hazard warnings" Fixes: e2f6960fc5fe "CMS: Export CMS_EnvelopedData and add CMS_EnvelopedData_decrypt()" Fixes: 9efd7e9e98a9 "Fix group tuple handling in DEFAULT expansion" Fixes: bfcf1356f9fd "Update the msg_callback documentation" Fixes: 606e0426a148 "Add support for loading root CAs from Windows crypto API" Fixes: 329b2a2cde48 "DOCS: add openssl-core_numbers.h(7)" Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 21 22:50:14 2026
(Merged from https://github.com/openssl/openssl/pull/31596)
projects / thirdparty / openssl.git / log
