openssl, branch openssl-3.5

test/cmp_client_test.c: add RR tests with issuer or serialNumber missing

2026-10-24T10:05:37Z

Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit a752594ed84476fbb516b0f43e15de513dcd4a14)

apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

2026-10-24T10:05:34Z

The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e)

QUIC: resend the whole ClientHello after a Retry

2026-10-23T13:20:27Z

When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit c69b5af10a754051274ef2e5ed17f47753bd6ea9)

QUIC: release pseudo-lost packets from the congestion controller

2026-10-23T13:20:20Z

On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit a87db42e4647d36fb82464d9493145ccc9bd21ed)

doc: RAND(7): a restore from a saved image is not detected; reseed after it

2026-10-23T12:52:23Z

The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285 (cherry picked from commit f4ada04e0c795e3ff07aa24be79b7240cfbf3388)

Document the OSSL_PARAM_merge() entry limit

2026-10-23T12:48:11Z

OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244 (cherry picked from commit 25bba416c07ca811f99d2602ca7e7e6fbd43c45a)

doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examples

2026-10-23T12:45:16Z

The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228 (cherry picked from commit 1b02949afd9ddba89ef4f133ecb3c4e9de8c223d)

CI: give the cross-compile matrix jobs stable names

2026-10-21T16:53:22Z

GitHub names a matrix job after all its matrix values and cuts the name at 100 characters, so the aarch64 and riscv legs report identical names. Nothing reading job results by name can then tell whether every leg ran or which one failed. Name the jobs after a short per-entry label instead, as interop-tests.yml already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Wed Oct 21 16:48:12 2026 Merged-from: https://github.com/openssl/openssl/pull/33121 (cherry picked from commit 4fe51b0ad523d1863533b2c1f395ace6bf06fddf)

Fix SSL_poll() multi-reactor cleanup deadlock

2026-10-20T12:30:39Z

SSL_poll() cleaned up QUIC reactor wait registrations in item-array order. Leaving a reactor can block while its notifier is signalled, so two callers spanning the same reactors could each wait on one reactor while still registered on another. The translation abort path has the same ordering problem. Split QUIC leave into two phases: deregister from every QUIC reactor, then wait for any notification cycles still pending. For QUIC-only poll sets this removes every waiter registration before any notifier wait. DTLS listener cleanup is unchanged. Guard the QUIC drain call for no-quic builds. Phase 2 also prevents an immediate re-registration from keeping the notifier signalled. Capture notify_generation during deregistration so a wait is bounded to the observed cycle. Apply the same generation bound to the combined single-reactor leave operation. Exercise real SSL_poll cleanup on two reactors in both the post-poll and translation-abort paths, including repeated items sharing a reactor. Check that a delayed phase-2 waiter completes while a later notification cycle remains signalled. Fixes #32130 Assisted-by: OpenCode:GLM-5.2 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman Merge-date: Tue Oct 20 12:29:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32137 (cherry picked from commit 9682b1123accf8f6bf058a402bf7c8be0be5b5d2)

chore(bump): update FreeBSD image

2026-10-19T13:14:24Z

This is being done to help reduce OS maintainer burden as well as OpenSSL developer burden by using a version of FreeBSD which is currently supported by the project. This change updates FreeBSD from 13.4-RELEASE (an EOL release) to 14.4-RELEASE (a close to EOL release, but at the very least supported). Once 15.2-RELEASE is made available, this project should cut over to that version. Original-Commit: e4653f59eeea "chore(bump): update FreeBSD and OpenBSD images" Original-PR: https://github.com/openssl/openssl/pull/31840 Signed-off-by: Enji Cooper Reviewed-by: Nikola Pajkovsky Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 19 13:14:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33248