openssl/test, branch openssl-3.5

test/cmp_client_test.c: add RR tests with issuer or serialNumber missing

2026-10-24T10:05:37Z

Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit a752594ed84476fbb516b0f43e15de513dcd4a14)

QUIC: resend the whole ClientHello after a Retry

2026-10-23T13:20:27Z

When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit c69b5af10a754051274ef2e5ed17f47753bd6ea9)

QUIC: release pseudo-lost packets from the congestion controller

2026-10-23T13:20:20Z

On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit a87db42e4647d36fb82464d9493145ccc9bd21ed)

Fix SSL_poll() multi-reactor cleanup deadlock

2026-10-20T12:30:39Z

SSL_poll() cleaned up QUIC reactor wait registrations in item-array order. Leaving a reactor can block while its notifier is signalled, so two callers spanning the same reactors could each wait on one reactor while still registered on another. The translation abort path has the same ordering problem. Split QUIC leave into two phases: deregister from every QUIC reactor, then wait for any notification cycles still pending. For QUIC-only poll sets this removes every waiter registration before any notifier wait. DTLS listener cleanup is unchanged. Guard the QUIC drain call for no-quic builds. Phase 2 also prevents an immediate re-registration from keeping the notifier signalled. Capture notify_generation during deregistration so a wait is bounded to the observed cycle. Apply the same generation bound to the combined single-reactor leave operation. Exercise real SSL_poll cleanup on two reactors in both the post-poll and translation-abort paths, including repeated items sharing a reactor. Check that a delayed phase-2 waiter completes while a later notification cycle remains signalled. Fixes #32130 Assisted-by: OpenCode:GLM-5.2 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman Merge-date: Tue Oct 20 12:29:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32137 (cherry picked from commit 9682b1123accf8f6bf058a402bf7c8be0be5b5d2)

Fix use-after-free in EC_GROUP_get_ecpkparameters()

2026-10-18T15:38:04Z

When a caller-supplied ECPKPARAMETERS object is passed in, the CHOICE member it already holds is released on entry, but the union pointer was left untouched. If a later step then failed, the error exit called ECPKPARAMETERS_free() on that object, which followed the still valid selector and freed the already released member a second time. Clear the pointer once it has been released, so that the error exit has nothing left to free. This does not change the fact that a caller supplied object is freed on error. That behaviour differs from the sibling function EC_GROUP_get_ecparameters(), which only frees the object it allocated itself, but it is left as-is here. The new test only fails on a sanitizer build; the ECPKPARAMETERS layout is private to ec_asn1.c, so the state cannot be inspected directly. The regression test and the pull request description were written with AI assistance. Fixes: 012c86ab74ae "move ECC ASN1 that is not specific to ECDSA into crypto/ec/, and make some appropriate changes to the EC library." Co-authored-by: Jakub Zelenka Assisted-by: Claude:claude-fable-5 Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 18 15:26:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit 4c49f3f1103fc731cf1ec64fec5b744fa031241e)

test/cmp_vfy_test.c: prevent memory leak in test_msg_check_update_malicious_sender

2026-10-15T12:02:18Z

In test_msg_check_update_malicious_sender(), expected and actual were allocated via X509_NAME_new() prior to SETUP_TEST_FIXTURE(). If set_up() failed, SETUP_TEST_FIXTURE() returned early, leaking both allocated X509_NAME objects. Defer allocation until after SETUP_TEST_FIXTURE(), initialize both pointers to NULL, and allocate them safely within the TEST_ptr() validation chain. On setup or validation failure, both pointers and the test fixture are freed cleanly. Resolves: https://github.com/openssl/openssl/issues/33200 Fixes: 9d838f67fec7 "Add test for CVE-2026-63073" CLA: trivial Signed-off-by: jdymitarai Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Merge-date: Thu Oct 15 11:51:16 2026 Merged-from: https://github.com/openssl/openssl/pull/33203 (cherry picked from commit 6d76833d61fad07a171219d9cb1444bc37f88b8f)

QUIC: don't answer a refused Retry token with another Retry

2026-10-11T20:31:37Z

When an Initial packet carries a Retry token that we minted, but which then fails validation (expired, wrong address or DCID), the server sent a fresh Retry. The client has already processed a Retry packet and must ignore any further ones (RFC 9000 section 17.2.5.2), so it just waits for its idle timeout. Drop the packet instead, which RFC 9000 section 8.1.2 allows. Tokens that don't decrypt, or NEW_TOKEN tokens, still get a Retry as before. Fixes: 29e861a5a605 "Add lookup for initial token assignment on channel start" Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 11 20:18:44 2026 Merged-from: https://github.com/openssl/openssl/pull/33149 (cherry picked from commit 061b82ade3c2c9fb1149d66ba046888b078675d5)

test/quicapitest.c: fix BIO leak in test_quic_amplification_limit()

2026-10-10T08:29:00Z

The dgram pair BIOs leaked if the test failed before SSL_set_bio(). Free them on exit, and clear the local pointers once the SSL objects own them, as other tests in this file do. Fixes: 370808da9820 "Add a test to check for quic unvalidated credit" Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 10 08:16:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33150 (cherry picked from commit bb908b895bef4bf5965ddb483f12eb1fe1ec5b40)

CONF: reject a NUL list separator in CONF_parse_list()

2026-10-09T21:36:02Z

CONF_parse_list() treated any integer separator that converts to NUL as a match for the input string terminator. After processing the final element, the loop advanced beyond the input and searched from that invalid pointer on the next iteration. Reject every NUL-equivalent separator before parsing and raise ERR_R_PASSED_INVALID_ARGUMENT. Add a regression test that verifies the direct NUL value and positive/negative integer aliases, confirms that no callback is invoked, checks the error queue, and checks that normal comma-separated parsing keeps working as expected. Resolves: https://github.com/openssl/openssl/issues/32667 Fixes: df5eaa8a5297 "default_algorithms option in ENGINE config." Reported-by: x-ray-z Assisted-by: OpenAI Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Fri Oct 9 21:25:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32684 (cherry picked from commit a502c66ce4d8784c2a1f3c195fd876f19fbe8392)

EVP_MD_demo.c, tls13secretstest.c: avoid signed-to-unsigned integer conversion

2026-10-09T19:36:53Z

Should EVP_MD_size() return -1, the size_t len variable would wrap, causing any subsequent error checks to not trigger. Change to type int (which is what EVP_MD_size() returns). While this is just in test/demo code, that's the kind of code that people might copy and reuse elsewhere, and that AI vuln scanners trigger on, so might as well try to eliminate that noise. Fixes: 7a7fbeb924a0 "fix all the warnings in our demos and make them enableable" Fixes: 134bfe56c4fe "Add a test for the TLS1.3 secret generation" Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky Reviewed-by: Eugene Syromiatnikov Merge-date: Fri Oct 9 19:19:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31222 (cherry picked from commit 9f561c1c232786f8406173f4d09ccc49a33f8883)