openssl/include/internal, branch openssl-3.3.7

Copyright year updates

2026-04-07T12:38:24Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:38:26 2026 Release: yes

Apply clang-format to the source tree

2026-04-03T14:51:47Z

Ensure that all the source files are formatted with the current .clang-format configuration, to avoid spurious clang-format checker errors when arbitrary files are touched. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Fri Apr 3 14:52:06 2026 (Merged from https://github.com/openssl/openssl/pull/29824)

3.3-POST-CLANG-FORMAT-WEBKIT

2025-12-09T10:18:23Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Nikola Pajkovsky (Merged from https://github.com/openssl/openssl/pull/29258)

3.3-PRE-CLANG-FORMAT-WEBKIT

2025-12-09T10:15:25Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Nikola Pajkovsky (Merged from https://github.com/openssl/openssl/pull/29258)

freebsd ktls: avoid unaligned 16 bit length store in ktls_read_record

2025-10-17T17:25:38Z

This prevents SIGBUS on strict alignment architectures when p+3 is not aligned for 16 bit access. Behavior is unchanged on x86 and matches the Linux path. Signed-off-by: Joshua Rogers Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28860) (cherry picked from commit c33120d0e403b4079e5104fd20040a51930e8d8e)

ktls: move ktls_enable() within ktls_start()

2025-10-14T14:48:43Z

On linux ktls can only be enabled on established TCP sockets. When SSL_set_fd() is called before the connection is established ktls_enable() fails and ktls is not setup. This moves ktls_enable() call within then ktls_start() function. Multiple calls to ktls_start() will trigger additional ktls_enable() calls which fail with EEXIST, but do not affect the ktls socket. CLA: trivial Signed-off-by: Ulrich Weber Reviewed-by: Paul Yang Reviewed-by: Saša Nedvědický Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/27908) (cherry picked from commit f23f706a26f2e7cd5dd5221d57e2d0db28530f4e)

Copyright year updates

2025-09-30T12:55:37Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes

- changes suggested by @t8m

2025-07-27T09:02:04Z

Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit 92330c8f80e4dbfc45b7718d9ed526f196daba0a)

ACK manager must avoid infinite probe time when waiting handshake confirmation

2025-07-27T09:01:59Z

According to RFC 9002, section 6.2.2.1 the client the client must keep PTO (probe time out) armed if it has not seen HANDSHAKE_DONE quic message from server. Not following RFC spec here may cause the QUIC session to stale during TLS handshake. Fixes openssl/project#1266 Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit cdbfacead0d07ed47fa1087d633acf6f6399aa2c)

Copyright year updates

2025-07-01T11:59:57Z

Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Release: yes