openssl, branch openssl-4.0

test/cmp_client_test.c: add RR tests with issuer or serialNumber missing

2026-10-24T09:59:02Z

Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit a752594ed84476fbb516b0f43e15de513dcd4a14)

apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

2026-10-24T09:58:44Z

The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e)

QUIC: resend the whole ClientHello after a Retry

2026-10-23T13:18:02Z

When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit c69b5af10a754051274ef2e5ed17f47753bd6ea9)

QUIC: release pseudo-lost packets from the congestion controller

2026-10-23T13:17:53Z

On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit a87db42e4647d36fb82464d9493145ccc9bd21ed)

doc: RAND(7): a restore from a saved image is not detected; reseed after it

2026-10-23T12:52:13Z

The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285 (cherry picked from commit f4ada04e0c795e3ff07aa24be79b7240cfbf3388)

poly1305-armv9-sve2.pl: close STDOUT before exiting

2026-10-23T12:49:58Z

The last line of the script was " STDOUT or die ...", without the "close" keyword, so the pipe to arm-xlate.pl was never closed explicitly. Perl could then exit before arm-xlate.pl had written the output file, and make compiled poly1305-armv9-sve2.S before it existed: gcc: error: crypto/poly1305/poly1305-armv9-sve2.S: No such file or directory This was seen on linux-aarch64 builds in the manylinux2014 image (perl 5.16.3) under QEMU. Running the generator alone 5 times in that image, the output file was missing right after perl exited 5 times out of 5; with this change, 0 times out of 5. The other perlasm scripts, for example poly1305-armv8.pl and chacha-armv8-sve.pl, already end with "close STDOUT or die ...". CLA: trivial Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Shane Lontis Reviewed-by: Tom Cosgrove Merge-date: Fri Oct 23 12:49:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33276 (cherry picked from commit 11d83607b8152c77e1175190e42034c5a6f6e77c)

Document the OSSL_PARAM_merge() entry limit

2026-10-23T12:48:01Z

OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244 (cherry picked from commit 25bba416c07ca811f99d2602ca7e7e6fbd43c45a)

doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examples

2026-10-23T12:45:05Z

The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228 (cherry picked from commit 1b02949afd9ddba89ef4f133ecb3c4e9de8c223d)

CHANGES.md, NEWS.md: 4.0.3 fixups

2026-10-21T17:02:52Z

Fix CVE-2026-54872 title wording in NEWS.md, fix a typo in PR #31610[1] description. This is a partial backport of "CHANGES.md, NEWS.md: 4.0.3 fixups" commit from the master branch, as a previous (incomplete) version of it has been applied already as ae139e8695ec "CHANGES.md, NEWS.md: 4.0.3 fixups". [1] https://github.com/openssl/openssl/pull/31610 Co-Authored-by: Mounir IDRASSI Fixes: c3ad12c9ec85 "CHANGES.md, NEWS.md: update for 4.0.3" Complements: ae139e8695ec "CHANGES.md, NEWS.md: 4.0.3 fixups" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Milan Broz Reviewed-by: Frederik Wedel-Heinen Merge-date: Wed Oct 21 17:02:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33162

CI: give the cross-compile matrix jobs stable names

2026-10-21T16:51:52Z

GitHub names a matrix job after all its matrix values and cuts the name at 100 characters, so the aarch64 and riscv legs report identical names. Nothing reading job results by name can then tell whether every leg ran or which one failed. Name the jobs after a short per-entry label instead, as interop-tests.yml already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Wed Oct 21 16:48:12 2026 Merged-from: https://github.com/openssl/openssl/pull/33121 (cherry picked from commit 4fe51b0ad523d1863533b2c1f395ace6bf06fddf)