openssl, branch dependabot/github_actions/docker/setup-docker-action-5.5.0

Dependabot update

2026-10-06T17:33:17Z

CLA: trivial (deps): Bump docker/setup-docker-action Bumps [docker/setup-docker-action](https://github.com/docker/setup-docker-action) from 4.5.0 to 5.5.0. - [Release notes](https://github.com/docker/setup-docker-action/releases) - [Commits](https://github.com/docker/setup-docker-action/compare/efe9e3891a4f7307e689f2100b33a155b900a608...2bf61fb9464cc67f0cbdeabed6aa0380accd1c70) --- updated-dependencies: - dependency-name: docker/setup-docker-action dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot]

Include DTLSv1.3 in the top-level readme overview.

2026-10-06T16:12:49Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Mounir Idrassi Reviewed-by: Matt Caswell Merge-date: Tue Oct 6 16:12:50 2026 Merged-from: https://github.com/openssl/openssl/pull/32763

Revert "Don't let stderr block when filling up."

2026-10-06T16:03:53Z

This reverts commit 0fff0090507a205e6d37072d6ea151b68d0f74b6. That commit discarded command stderr without an explicit redirection under the default non-verbose harness. This hides diagnostics, including LeakSanitizer reports from failing commands in sanitizer CI jobs. Restore command stderr to the harness's existing reporting path, retaining the VMS-only null-device redirection and explicit recipe redirections. The harness can then show diagnostics for failed assertions, including when a command succeeds but an assertion about its captured stdout fails. Passing full-suite runs produced no additional diagnostic output. This depends on the preceding callback fix. Without it, restoring stderr also restores quadratic processing of that output. On Linux, the fix removes a slowdown with the blocked-writer signature reported in #32128. Native OpenBSD and macOS confirmation remains outstanding. Assisted-by: Claude Code:claude-opus-5-5 Assisted-by: Codex:gpt-6-astra Reviewed-by: Jakub Zelenka Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 16:04:02 2026 Merged-from: https://github.com/openssl/openssl/pull/33078

test/run_tests.pl: avoid quadratic time on long test output

2026-10-06T16:03:53Z

With failure buffering enabled, the ALL callback appends nonempty output lines that it does not recognize as plans or test results to $output_buffer. Without an explicit return, that branch returns the accumulated buffer. TAP::Base::_make_callback() invokes callbacks in list context, even when TAP::Parser calls it in void context, so the buffer is copied. Each append then costs time proportional to the output accumulated so far, making processing quadratic for a growing sequence of such lines. run_tests.pl merges recipe stderr into the stream it reads. While the harness copies, a command writing enough stderr can fill that pipe and block. On Linux, with command stderr restored to this stream and the radix recipe from before #32395, test_quic_radix took 9.9 seconds without the fix and 2.3 seconds with it. Setting glibc's mmap threshold to a fixed 128 KiB increased the former to 85 seconds, while the fixed run took 2.3 seconds. The command blocked writing stderr while the harness kept a CPU busy, reproducing the signature reported in #32128. These measurements do not establish the cause of the historical OpenBSD and macOS stalls. Return no values from the callback; the parser does not use its result. V=1 disables failure buffering and avoids this accumulation path. Assisted-by: Claude Code:claude-opus-5-5 Assisted-by: Codex:gpt-6-astra Reviewed-by: Jakub Zelenka Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 16:04:01 2026 Merged-from: https://github.com/openssl/openssl/pull/33078

dtls: honour SSL_OP_COOKIE_EXCHANGE for DTLS 1.3

2026-10-06T14:46:47Z

Setting SSL_OP_COOKIE_EXCHANGE on a server connection only ever produced a HelloVerifyRequest, so once the peer negotiated DTLS 1.3 the option was silently ignored and the client was accepted without any address validation. The HelloRetryRequest cookie code was gated purely on the internal stateless flag, which only SSL_stateless() and the DTLS listener set, leaving no way for an application driving its own per-peer SSL objects with SSL_accept() to get a cookie exchange. Treat the option as "a cookie is required" for DTLS 1.3 as well. A ClientHello without a valid cookie is answered with a HelloRetryRequest carrying one, and the handshake continues only once it is echoed back. The stateless cookie callbacks are used for the application part of the cookie, falling back to the HelloVerifyRequest callbacks so existing servers written for DTLS 1.2 keep working unchanged. A client that repeats its ClientHello after the HelloRetryRequest and still presents no valid cookie now gets an illegal_parameter alert rather than tripping an internal error. The listener is unaffected since it sets both the flag and the option. s_server always sets the option for DTLS, so teach the TLSProxy handshake checker that every DTLS handshake now starts with a cookie round trip. Add a test covering the 1.2 and 1.3 paths, the callback fallback, the missing-callback failure and the PSK-only resumption, and make the dtlsecho demo server validate its peer this way. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 14:46:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33093

apps: set cookie callbacks on s_server SNI context

2026-10-06T14:46:47Z

s_server only installed the DTLS and stateless cookie callbacks on its main SSL_CTX. When -servername matched, the connection was switched to the second context before the cookie was generated, so a DTLS 1.2 client sending that name failed the handshake with a cookie generation callback failure instead of getting a HelloVerifyRequest. Install the callbacks on the SNI context as well and cover the case with a (D)TLSv1.2 server name handshake in the TLSProxy message test. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 14:46:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33093

Omit key_share from a cookie-only HelloRetryRequest

2026-10-06T14:46:47Z

When the server requires a HelloRetryRequest cookie and the client is resuming with a PSK-only key exchange, no (EC)DHE group is selected, so there is no key_share to process and the group id stays at zero. The HelloRetryRequest construction still treated a missing peer key share as "ask for a different group" and emitted a key_share extension naming group 0, which the client rightly rejects with illegal_parameter. Only include key_share in the HelloRetryRequest when a different group was actually selected, and record the same decision in the cookie so the transcript is reconstructed correctly on the second ClientHello. A DTLS test for this follows with the SSL_OP_COOKIE_EXCHANGE change that exposed it. SSL_stateless() cannot be used for it since it fails the PSK binder check on the second ClientHello for an unrelated reason. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 14:46:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33093

.github/workflows/interop-tests.yml: avoid using dashes in PRE_RELEASE_TAG

2026-10-06T14:44:35Z

rpm complains about double dashes in pkgconfig version: error: Invalid version (double separator '-'): 4.1.0-beta2-dev: pkgconfig(libcrypto) = 4.1.0-beta2-dev error: Invalid version (double separator '-'): 4.1.0-beta2-dev: pkgconfig(libssl) = 4.1.0-beta2-dev error: Invalid version (double separator '-'): 4.1.0-beta2-dev: pkgconfig(openssl) = 4.1.0-beta2-dev Mangle dashes to tildes in PRE_RELEASE_TAG in VERSION.dat to avoid that. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Merge-date: Tue Oct 6 14:44:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33118 (cherry picked from commit 9d264784fc03cd3ecd41f877f5500cba98e1d104)

test_cipher_reinit(): Reinit is not supported with CCM on old providers

2026-10-06T07:57:47Z

Reviewed-by: Daniel Kubec Reviewed-by: Neil Horman Merge-date: Tue Oct 6 08:58:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33114

Allow EVP_SKEY_get0_raw_key() to return only the key length

2026-10-05T10:27:11Z

There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035