openssl, branch master

test/cmp_client_test.c: add RR tests with issuer or serialNumber missing

2026-10-24T09:43:46Z

Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071

apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

2026-10-24T09:42:53Z

The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071

Migrate test_gcm_reinit from evp_extra_test.c to evp_aead_test.c

2026-10-23T20:40:10Z

Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Fri Oct 23 20:40:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33308

s390x: Display 'cex_min_bits' and 'nocex' as part of CPUINFO

2026-10-23T15:19:41Z

Command 'openssl version -c' as well as other commands (e.g. 'openssl speed') display the CPU information. For s390x, this includes the OPENSSL_s390xcap settings that are currently in place. Also display the 'cex_min_bits:' and 'nocex' settings there. The 'cex_min_bits' setting is always displayed, showing the default value if it was not explicitly specified via the OPENSSL_s390xcap environment variable. The 'nocex' setting is only displayed when it was explicitly set via the OPENSSL_s390xcap environment variable, or if offloading is disabled because no crypto adapters are available or the file descriptor has been closed by other means. Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:46 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

s390x: Disable mod-expo offloading to a crypto card for small exponents

2026-10-23T15:19:37Z

Add a new keyword 'cex_min_bits:' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

QUIC: resend the whole ClientHello after a Retry

2026-10-23T12:53:53Z

When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298

QUIC: release pseudo-lost packets from the congestion controller

2026-10-23T12:53:45Z

On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298

doc: RAND(7): a restore from a saved image is not detected; reseed after it

2026-10-23T12:51:41Z

The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285

poly1305-armv9-sve2.pl: close STDOUT before exiting

2026-10-23T12:49:38Z

The last line of the script was " STDOUT or die ...", without the "close" keyword, so the pipe to arm-xlate.pl was never closed explicitly. Perl could then exit before arm-xlate.pl had written the output file, and make compiled poly1305-armv9-sve2.S before it existed: gcc: error: crypto/poly1305/poly1305-armv9-sve2.S: No such file or directory This was seen on linux-aarch64 builds in the manylinux2014 image (perl 5.16.3) under QEMU. Running the generator alone 5 times in that image, the output file was missing right after perl exited 5 times out of 5; with this change, 0 times out of 5. The other perlasm scripts, for example poly1305-armv8.pl and chacha-armv8-sve.pl, already end with "close STDOUT or die ...". CLA: trivial Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Shane Lontis Reviewed-by: Tom Cosgrove Merge-date: Fri Oct 23 12:49:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33276

Document the OSSL_PARAM_merge() entry limit

2026-10-23T12:47:43Z

OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244