openssl/util, branch openssl-3.2

Properly error out when AEAD Algorithms are used with Encrypted Data

2025-11-10T19:42:27Z

Encrypted Data does not support AEAD algorithms. If you wish to use AEAD algorithms you will have to use a CMS_AuthEnvelopedData structure. Therefore, when AEAD algorithms are used with CMS_EncryptedData_set1_key will now return an error. Fixes: #28607 Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28711) (cherry picked from commit 86344acb02eb3718b0491b9915846667c55c95ff)

Fixup non-optional use of IO::Socket::IP

2025-07-09T10:09:13Z

IO::Socket::IP is an optionally used package in our perl scripts, and a recent change of mine used it unilaterally, causing breakage on older perl installations. Fix it up to use it optionally again, falling back to IO::Socket::INET when needed. Fixes #27940 Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27941) (cherry picked from commit b321bf25c88f2e604f3dd387dd14e1e6369895ad)

Copyright year updates

2025-07-01T12:04:53Z

Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Release: yes

Fix use of IO::Socket::IP on windows 2025

2025-06-06T07:39:02Z

Apparently IO::Socket::IP has several odd behaviors on windows 2025, notably indicating that AF_INET6 isn't a supported family when it clearly is. Follow the pattern in determinig the haveIPV6 variable in Proxy.pm, and record if we determine IPv6 availablity with the IP class or the INET6 class and use the same method when testing port binding Fixes project/#1213 Reviewed-by: Tim Hudson Reviewed-by: Richard Levitte Reviewed-by: Paul Yang (Merged from https://github.com/openssl/openssl/pull/27780) (cherry picked from commit ae404a9b3bd052963b76434bcc97757d1d6d502e)

Test randomly selected client port for availabilty in sslrecords test

2025-06-05T14:32:44Z

Encountered this error in a pr today: https://github.com/openssl/openssl/actions/runs/15418713146/job/43387767612 === Proxy started on port [::1]:56662 Engine "ossltest" set. Using default temp DH parameters ACCEPT [::1]:59189 Server responds on [::1]:59189 Engine "ossltest" set. C0774F02907F0000:error:80000062:system library:BIO_bind:Address already in use:crypto/bio/bio_sock2.c:240:calling bind() C0774F02907F0000:error:10000075:BIO routines:BIO_bind:unable to bind socket:crypto/bio/bio_sock2.c:242: connect:errno=98 === Its occuring because we randomly select a port to use for our client connection in the sslrecords test. Thats usually fine, but sometimes, we get unlucky and pick a port thats already in use. This presents as random failures in our CI on this test. So lets try harden ourselves against it. When creating the client connection, test the randomly selected port by trying to bind to it via a call to IO::Socket::IP->new(). If that fails, try a different port number, until we get one that works. If it works, use that port in the assignment for the clients local port value. Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27752) (cherry picked from commit f78f824c8e4064148af1186490e9b445871765fd)

Split arguments taking quotes into account

2025-06-04T15:34:46Z

CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 287bbb28b09e930a8691efc92a5087bb951edb6b)

Copyright year updates

2025-02-11T14:36:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Release: yes

Fix documentation of OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION

2025-01-17T17:55:18Z

This drops OSSL_PKEY_PARAM_IMPLICIT_REJECTION - which is a meaningless name - everywhere apart from still existing (for API stability, in case someone uses that macro). Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26421) (cherry picked from commit 1df07c761b25e5aca8ecd90b81d05496631285fb)

Fix buildinf.h generation for space and backslash

2025-01-10T10:59:40Z

Builds may be configured with CC or CFLAGS containing space and double quotes. In particular on Windows, this may lead to passing more than two arguments into mkbuildinf.pl. In addition, backslashes must be escaped for constructing the C string. Fixes #26253. Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/26315) (cherry picked from commit e87a3473fd1e9d901a89d4b14a53826723357701)

die() in .tmpl file should not be silently ignored.

2024-11-29T16:08:14Z

call to die() in perl templates is currently ignored. any error printed by die() commad appears in template output. In order to make sure die() terminates processing we must ensure we emite `undef` value. This is ensured by adding a `BROKEN` callback to `fill_in()` Template method. The callback must return undef to stop processing. Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26064) (cherry picked from commit 578760bb6aae6a9d7f3805eea66bab124d06c9b0)