aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Dependabot updatedependabot/github_actions/actions/setup-python-7dependabot[bot]2026-07-272-2/+2
| | | | | | | | | | | | | | | | | | | CLA: trivial (deps): Bump actions/setup-python Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
* ech: check memory failure in vpm allocation in store final checkJakub Zelenka2026-07-271-0/+4
| | | | | | | | | | | This fixes issue found by fuzz test in updated corpora for echconfiglist_parser. Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 27 16:36:15 2026 (Merged from https://github.com/openssl/openssl/pull/32070)
* test: fix flaky -md and -iter mismatch checks in 20-test_enc.tNorbert Pocs2026-07-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | The subtests added in f26d632a0e assert that "openssl enc -d" exits non-zero when the key derivation parameters do not match. enc has no MAC, so a wrong key is not detectable as such; the only signal is whether the garbage happens to form valid PKCS#7 padding, which openssl-enc(1) documents as passing better than one time in 256. With a random salt the tests thus failed about 0.4% of the time. Assert instead that mismatching parameters do not recover the plaintext: the decryption must either fail or produce differing output. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Mon Jul 27 12:17:21 2026 (Merged from https://github.com/openssl/openssl/pull/32083)
* apps: drop invalid trust setting in check_cert_might_be_valid()Jakub Zelenka2026-07-272-2/+13
| | | | | | | | | | | | | | | | | | | | | | check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and left that error on the error stack, which was then printed via ERR_print_errors() for every certificate loaded by the x509 app, even on success. The intended liberal behavior is already provided by X509_PURPOSE_ANY and by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call. Add a test checking that printing certificate info emits nothing on stderr. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 11:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31968)
* crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checksAdel-Ayoub2026-07-271-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value, so the "< 0" checks on the cipher-with-MAC path cannot detect any failure. A return of 0 means a failed or unsupported control, or for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is usable here. Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG check fixed by commit 674c23d2656e in this function. Follow-up to https://github.com/openssl/openssl/pull/30923. Fixes: ea0add4a8227 "New GOST PKCS12 standard support" CLA: trivial Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> MergeDate: Mon Jul 27 10:21:13 2026 (Merged from https://github.com/openssl/openssl/pull/31848)
* apps: test dgst -r and -c output formatsJakub Zelenka2026-07-271-1/+53
| | | | | | | | | | | | | | | | | Add coverage for the coreutils style output of `openssl dgst -r`, including the newline escaping done by newline_escape_filename() when the digested file name contains a newline, and for the colon separated output of `openssl dgst -c`. The newline in file name part is skipped where such a file cannot be created. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 10:19:58 2026 (Merged from https://github.com/openssl/openssl/pull/32035)
* apps: cover the req -subj modification of an existing requestJakub Zelenka2026-07-271-1/+19
| | | | | | | | | | | | | Add a subtest exercising the code path in the req app that rewrites the subject of an existing certificate request loaded via -in, i.e. when -subj is given without -new/-newkey/-x509. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 10:19:06 2026 (Merged from https://github.com/openssl/openssl/pull/31965)
* ci: accept uppercase hex in dispatch head_sha validationGeorgy Karataev2026-07-271-1/+1
| | | | | | | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:17:00 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* ci: preserve valgrind fork runsGeorgy Karataev2026-07-271-2/+3
| | | | | | | Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:16:58 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* ci: allow dispatch cancellationGeorgy Karataev2026-07-273-14/+14
| | | | | | | Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:16:57 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* ci: centralize dispatch input validationGeorgy Karataev2026-07-274-53/+73
| | | | | | | | | | | | Clarify the bot-only workflow inputs and validate any supplied tuple through a shared reusable workflow without interpolating input values into shell source. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:16:56 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* ci: allow run-checker-daily and valgrind-daily to be dispatched against a PR ↵Georgy Karataev2026-07-272-11/+149
| | | | | | | | | | | | | | | head SHA Additive: schedule and bare-manual runs unchanged. Adds validated, fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch each against an exact commit; run-name echoes them back for correlation. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:16:55 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* ci: allow ct-validation-daily to be dispatched against a PR head SHAGeorgy Karataev2026-07-271-1/+44
| | | | | | | | | | | | | Additive: schedule and bare-manual runs unchanged. Adds validated, fail-closed pr/head_sha/check_run_id inputs so a caller can dispatch against an exact commit; run-name echoes them back for correlation. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jul 27 10:16:54 2026 (Merged from https://github.com/openssl/openssl/pull/32053)
* apps: cover the crl -crlnumber and -issuer print optionsJakub Zelenka2026-07-271-1/+26
| | | | | | | | | | | | | | Add a subtest exercising the -crlnumber and -issuer print options of the crl app: with a CRL that carries a CRL Number extension (printed as a hex value), with a CRL that has none (printed as <NONE>), and checking the printed issuer DN in both cases. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Mon Jul 27 10:15:03 2026 (Merged from https://github.com/openssl/openssl/pull/31969)
* apps: cover the x509 -serial, name-hash and -fingerprint print optionsJakub Zelenka2026-07-271-1/+39
| | | | | | | | | | | | | | | | | | Add a subtest exercising the informational print options of the x509 app that operate on any certificate: -serial, -next_serial, -subject_hash (and its -hash alias), -issuer_hash, -subject_hash_old, -issuer_hash_old and -fingerprint (default SHA-1 and -sha256). These branches of the print loop were previously not exercised. The expected values are those of the committed test/certs/ca-cert.pem; the fingerprints are the SHA-1 and SHA-256 digests of its DER encoding. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Mon Jul 27 10:14:18 2026 (Merged from https://github.com/openssl/openssl/pull/31967)
* x509: replace x509_memfail with in-tree mfail testsJakub Zelenka2026-07-275-144/+74
| | | | | | | | | | | | | | | | | | | The standalone x509_memfail is superseded by mfail tests. They cover the certificate parse, self-signature verification and issuer name hashing paths. Two new mfail tests still need NO_CHECK because a certificate still parses with an undecoded public key, and EVP_DigestVerifyFinal falls back to the original context when its EVP_PKEY_CTX_dup optimisation fails. The issuer name hashing propagates cleanly and runs checked. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Mon Jul 27 10:13:22 2026 (Merged from https://github.com/openssl/openssl/pull/31901)
* rand: factor out seed source creation and fix store raceJakub Zelenka2026-07-272-24/+97
| | | | | | | | | | | | | | | | | | | | | | | | | rand_get0_primary() created the seed source ahead of the primary DRBG and stored both under the write lock at the end. When two threads raced to create the primary DRBG and one of them failed after having created and stored the seed source, the other thread overwrote the stored seed source with its own instance, leaking the previous one. Factor the get-or-create logic out into rand_get0_seed() which rechecks the global under the write lock, so exactly one instance is kept and returned to every racing thread, and the seed source is stored independently of the primary DRBG creation outcome. Add a regression test checking that creating the primary DRBG creates and stores the seed source and that later use keeps returning the same instance. Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 09:13:12 2026 (Merged from https://github.com/openssl/openssl/pull/32029)
* apps: test enc -P, -nosalt, -md and -iter optionsJakub Zelenka2026-07-271-1/+73
| | | | | | | | | | | | | | | | | | Several enc options were not exercised by any test. Add subtests covering -P/-p printing of the derived salt, key and iv (deterministic with a fixed salt and PBKDF2) together with the -nosalt variant that omits the salt line, a -nosalt encrypt/decrypt round-trip, -md selecting the key derivation digest with a mismatching digest that must fail to decrypt, and -iter setting the PBKDF2 iteration count with a mismatching count that must fail to decrypt. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:11:47 2026 (Merged from https://github.com/openssl/openssl/pull/31948)
* apps: test pkcs8 -nocrypt reading a PKCS#8 PEMJakub Zelenka2026-07-271-1/+18
| | | | | | | | | | | | | | | | | | | | Reading an unencrypted PKCS#8 (PrivateKeyInfo) in PEM form with -nocrypt was not exercised by any test; the existing round-trip test only read the DER form via -inform DER, hitting d2i_PKCS8_PRIV_KEY_INFO_bio(). The PEM branch in apps/pkcs8.c (the informat == FORMAT_PEM || FORMAT_UNDEF case calling PEM_read_bio_PKCS8_PRIV_KEY_INFO()) was left uncovered. Add a subtest that writes an unencrypted PKCS#8 PEM and reads it back with -nocrypt from PEM, exercising PEM_read_bio_PKCS8_PRIV_KEY_INFO(), and checks the recovered key matches the original. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Mon Jul 27 09:10:45 2026 (Merged from https://github.com/openssl/openssl/pull/31955)
* apps: test pkeyutl -peerform optionJakub Zelenka2026-07-271-1/+22
| | | | | | | | | | | | | | | | The -peerform option of the pkeyutl app was not exercised by any test. Extend the -derive peer key subtest to convert the peer public key to DER and derive against it with -peerform DER, checking the shared secret matches the one derived from the PEM peer key, and that reading the DER peer key as PEM fails. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:10:00 2026 (Merged from https://github.com/openssl/openssl/pull/31953)
* apps: test pkcs12 -clcerts/-cacerts and -name optionsJakub Zelenka2026-07-271-1/+45
| | | | | | | | | | | | | | | | | The -clcerts and -cacerts certificate filtering and the -name friendly name option of the pkcs12 app were not exercised by any test. Add a subtest that exports a PKCS#12 holding a client cert (with a localKeyID), a CA cert and a friendly name, then checks the friendly name is present, that -clcerts outputs only the client certificate and -cacerts only the CA certificate. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:09:09 2026 (Merged from https://github.com/openssl/openssl/pull/31956)
* apps: test rsa -modulus outputJakub Zelenka2026-07-271-2/+27
| | | | | | | | | | | | | | Add a test recipe subtest checking that 'openssl rsa -modulus' prints the expected modulus for both a private key and a -pubin public key, mirroring the existing dsa -modulus test. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:08:13 2026 (Merged from https://github.com/openssl/openssl/pull/32048)
* apps: test skeyutl -skeyopt handlingJakub Zelenka2026-07-271-1/+26
| | | | | | | | | | | | | | | Cover the -skeyopt option of skeyutl using the fake cipher provider: a key name passed as a key option shows up in the reported key id, while an option unknown to the key management and an option missing the opt:value separator both make the command fail. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:06:06 2026 (Merged from https://github.com/openssl/openssl/pull/32036)
* test: support key options in the fake cipher providerJakub Zelenka2026-07-271-0/+26
| | | | | | | | | | | | | | | | | | | The fake cipher key management accepted a key name and raw key bytes on generation and import, but did not advertise them as settable parameters, so applications converting opt:value strings with OSSL_PARAM_allocate_from_text() had nothing to look them up in. Add the settable parameter table for both generation and import, and report the key name as the key id, so that setting it has an observable effect. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:06:05 2026 (Merged from https://github.com/openssl/openssl/pull/32036)
* apps: fail skeyutl -genkey on bad -skeyoptJakub Zelenka2026-07-271-0/+3
| | | | | | | | | | | | | | | | | | | | app_params_new_from_opts() returns NULL when a key option cannot be converted, either because the key management does not settle the parameter or because the opt:value separator is missing. skeyutl ignored that and generated the key without the requested options, only printing the parameter error to stderr and still exiting successfully. Bail out instead, the way the mac, kdf and enc applications do. A NULL return is only an error when key options were actually given, as app_params_new_from_opts() also returns NULL for an empty option list. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:06:03 2026 (Merged from https://github.com/openssl/openssl/pull/32036)
* x509: keep RFC 3779 stacks hole-free after a failed canonizeMounir IDRASSI2026-07-273-57/+239
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL slots in the live stack when a merge succeeded before a later failure (overlap, inverted range, or OOM). The NULLs were closed up only on the success path, so a failed X509v3_asid_canonize() / X509v3_addr_canonize() left the object poisonable: a retry of either function dereferences a NULL in the sort comparator during the re-sort, the i2r extension printers dereference the hole when printing (both in all builds), and on the asid side is_canonical trips extract_min_max's ossl_assert(aor != NULL), an abort in debug builds. This is a regression introduced by e59165a1e3 ("crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the previous delete-per-merge loop kept the stack hole-free at every step, so a failed canonize always left the object sorted, partially merged and structurally valid. Run the compaction pass unconditionally, whether the sweep succeeded or failed, restoring that contract: the stack is always left partially canonicalized but hole-free, safe to inspect, print, encode, free, or retry. In v3_addr.c this also routes the bare return-0 error paths through the done: cleanup label. New tests cover the crash vectors (is_canonical then retry) on both the asid and addr sides. The existing *_error_midsweep tests are strengthened with the same inspect/retry assertions. Fixes #31856 Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 27 07:59:21 2026 (Merged from https://github.com/openssl/openssl/pull/31857)
* DOCS: Fix KEM init function documentationolszomal2026-07-271-7/+10
| | | | | | | | | | | | | Document the missing params argument for OSSL_FUNC_kem_decapsulate_init(), remove stale name references, and fix the malformed provider-keymgmt(7) link. Complements: 78c44b05945b Add HPKE DHKEM provider support for EC, X25519 and X448. Signed-off-by: olszomal <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 27 07:57:01 2026 (Merged from https://github.com/openssl/openssl/pull/32045)
* doc: clarify raw RSA migrationMounir IDRASSI2026-07-271-2/+5
| | | | | | | | | | | | | | | | RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5 and no padding, but the migration guide currently describes their EVP replacements as using no padding only. Document direct mappings to EVP_PKEY_sign() and EVP_PKEY_verify_recover(), and explain that compatibility requires no signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or RSA_NO_PADDING. Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 27 07:54:00 2026 (Merged from https://github.com/openssl/openssl/pull/31996)
* Update SSL_CTX_set1_curves.pod for OpenSSL 3.5 additionsBrady Foster2026-07-241-0/+4
| | | | | | | | | | | | Added documentation of the addition of group tuples in openSSL 3.5 in HISTORY section of SSL_CTX_set1_curves.pod. CLA: trivial Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Jul 24 13:13:26 2026 (Merged from https://github.com/openssl/openssl/pull/32007)
* Restore empty raw PKCS#1 verify-recover behaviorMounir IDRASSI2026-07-242-1/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured signature digest rejected a valid signature whose recovered payload is empty, instead of returning success with a recovered length of zero. RSA_public_decrypt() returns -1 on error and otherwise the number of recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5 signature that encodes an empty payload. Pull request #28306 ("Make error checks on RSA_public_decrypt() consistent") changed the error check in the raw, no-digest verify-recover path from "ret < 0" to "ret <= 0", so a valid zero recovered length was mistaken for an error. Restore the "< 0" check in that branch only, leaving the digest-aware PKCS#1, X9.31, PSS and ordinary verification paths untouched. Add test_RSA_verify_recover_empty_payload, which performs a complete zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and fails on the unmodified implementation specifically at the EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same signature and reports a zero-byte result. The behavior regressed as a result of #28306. Fixes #32000 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> MergeDate: Fri Jul 24 13:06:58 2026 (Merged from https://github.com/openssl/openssl/pull/32001)
* Reject unknown TLS 1.3 ServerHello extensionsMounir IDRASSI2026-07-236-8/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello or HelloRetryRequest. Add a validation pass for these messages so fully unknown extension types fail early with unsupported_extension. Keep the existing ignore behavior for other extension contexts and leave TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the TLS 1.3 ServerHello case. Correct the unknown-extension path in tls_collect_extensions(). Collection still runs before the new TLS 1.3 validation, and verify_extension() returns success with thisex == NULL for fully unknown extension types. The previous idx calculation used invalid pointer arithmetic on NULL in that path. Map unknown extensions explicitly outside the built-in extension range instead, preserving the existing ignore semantics while avoiding undefined behavior. Update the truncated HRR ECH corruption vector to keep testing malformed ECH length after the new unknown-extension validation. The old 0xdddd bytes were only padding to preserve the replacement length, but they now trigger the unknown-extension check before the ECH parser. Use a known HRR cookie extension as padding so the test still reaches the intended SSL_R_LENGTH_MISMATCH path. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 23 15:55:09 2026 (Merged from https://github.com/openssl/openssl/pull/31086)
* crypto: use void * in LoongArch SHA shimChristoph Müllner2026-07-231-4/+4
| | | | | | | | | | | | | The LoongArch SHA dispatch shim uses the same deprecated typed interfaces as the RISC-V shim. Switch its entry points to void * so it no longer depends on deprecated SHA context types. Signed-off-by: Christoph Müllner <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 23 15:43:31 2026 (Merged from https://github.com/openssl/openssl/pull/30763)
* crypto: use void * in RISC-V digest shimsChristoph Müllner2026-07-232-8/+8
| | | | | | | | | | | | | | | | | | | The RISC-V MD5 and SHA dispatch files use low-level digest context types that are hidden in no-deprecated builds. Switch their shim entry points to void * so they no longer depend on deprecated typed interfaces. Update the local MD5 declaration to match the untyped shim interface. Fixes: openssl/openssl#29357 Signed-off-by: Christoph Müllner <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 23 15:43:30 2026 (Merged from https://github.com/openssl/openssl/pull/30763)
* Add OSSL_ECHSTORE_read_echconfiglist fuzzerGreensi72026-07-233-0/+129
| | | | | | | | | | | | | | | Fuzz OSSL_ECHSTORE_read_echconfiglist with raw fuzzer input in stage 1. Then fixup the starting bytes to reach deeper code withotu relying only on corpus. Fixup is done for binary encoding only (not base64). Assisted-by: ChatGPT:gpt-5.5 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 13:57:54 2026 (Merged from https://github.com/openssl/openssl/pull/32021)
* doc: document that `HMAC_Update` cannot be called after `HMAC_Final`Nicky Mouha2026-07-231-0/+3
| | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Thu Jul 23 08:33:21 2026 (Merged from https://github.com/openssl/openssl/pull/31570)
* Fix capitalization of 'Swiss Army knife' in READMEcodingsushi792026-07-231-1/+1
| | | | | | | | | | | CLA: trivial Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Jul 23 08:30:57 2026 (Merged from https://github.com/openssl/openssl/pull/31871)
* docs: clarify EVP_PKEY context workflow and operation descriptionsMounir IDRASSI2026-07-235-25/+44
| | | | | | | | | | | | | | | | | | | | Document that a generated key is returned separately from its generation context and that a new key-bound context is needed for subsequent operations. Correct the encrypt and decrypt initialization descriptions and examples accordingly. Correct two copy-and-paste errors in the verify-recover documentation: describe its initializer as starting a verify-recover operation and refer to EVP_PKEY_verify_recover() when discussing its input. Fixes #31989 Assisted-by: Grok:Grok-4.5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Thu Jul 23 08:29:24 2026 (Merged from https://github.com/openssl/openssl/pull/31995)
* Added Nvidia/Olympus CPU dispatch for SHA3/EOR3 AES GCM on Vera CPUAlexander Nesterovskiy2026-07-231-1/+2
| | | | | | | | | | CLA: trivial Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Thu Jul 23 08:26:09 2026 (Merged from https://github.com/openssl/openssl/pull/31191)
* Fix missing NULL check in statem_clnt_construct_testNeil Horman2026-07-231-1/+2
| | | | | | | | | | | Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695905 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 08:24:25 2026 (Merged from https://github.com/openssl/openssl/pull/31992)
* use safe_math on do_name_exNeil Horman2026-07-231-6/+25
| | | | | | | | | | | | | | | Coverity caught some potential overflows in do_name_ex. Seems unlikely to occur, but lets just do all the adds under safe_math to ensure we don't overflow our buffer length. Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695278 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 08:24:23 2026 (Merged from https://github.com/openssl/openssl/pull/31992)
* Add return check to OSSL_DECODER_up_refNeil Horman2026-07-231-1/+4
| | | | | | | | | | | | | | Coverity flagged a location where we didn't check this return code, fix it up. Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1696759 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 08:24:22 2026 (Merged from https://github.com/openssl/openssl/pull/31992)
* errors: fix stale string overrides in openssl.txt for renamed SSL error codesTodd Short2026-07-214-62/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3 error codes to TLS equivalents and updated the string descriptions in crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to "tls alert bad certificate"), but did not update the corresponding strings in crypto/err/openssl.txt. This caused a latent divergence: running mkerr.pl -rebuild would regenerate ssl_err.c with the old openssl.txt strings, undoing the intentional name cleanup. Similarly, adding any new SSL error code triggers a full SSL regeneration that would revert the strings and reorder entries to their correct alphabetical positions, producing spurious changes unrelated to the new code. Update openssl.txt to match the strings already in ssl_err.c, which also happen to be the auto-generated strings derived from the reason code names. Regenerate ssl_err.c and sslerr.h with the correct alphabetical ordering so that future make update runs are idempotent: adding and removing a new SSL error code now produces only the expected changes to the generated files, with no side-effect reordering or string reversions. Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jul 21 14:28:22 2026 (Merged from https://github.com/openssl/openssl/pull/31993)
* CHANGES.md updatesViktor Dukhovni2026-07-211-1/+11
| | | | | | | Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Jul 21 14:12:07 2026 (Merged from https://github.com/openssl/openssl/pull/31964)
* PSK: Handle non-empty client sid_ctxViktor Dukhovni2026-07-212-0/+183
| | | | | | | | | | | | - Do not reject external PSKs when client-side sid_ctx is set, fixed by copying the sid_ctx into the pending session. Tests added for this and also the server side sid_ctx issues. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Jul 21 14:12:06 2026 (Merged from https://github.com/openssl/openssl/pull/31964)
* Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.Viktor Dukhovni2026-07-214-11/+56
| | | | | | | | | | | | | | | | | | | | | | A server with client certificate verification requested, but no session ID context configured, wrongly rejected every TLS 1.3 PSK-based connection, whether a resumption ticket, or an external PSK. After a full non-PSK handshake the same server issued a poison resumption PSK (session ticket) that led to handshake failure if/when used. The session ID context check exists to stop SSL acceptors with distinct authentication policies that share a session cache from resuming each other's sessions and trusting their authentication results; it doesn't apply to a just-validated external PSK, so the corresponding sessions are now exempted. Ticket issuance is also suppressed when it's already known that the ticket would lead to a handshake failure with the same server's configuration. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Jul 21 14:12:04 2026 (Merged from https://github.com/openssl/openssl/pull/31964)
* Guard against NULL data in empty ASN1_STRINGsNorbert Pocs2026-07-213-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | Since 28179061bf a zero-length ASN1_STRING has data == NULL in fuzzing builds instead of a 1-byte allocation. Several call sites did pointer arithmetic or memcpy on the data pointer before any length check, which is undefined behaviour for NULL even with a zero offset and aborts the fuzz targets under UBSan: - asn1_string_canon: skip canonicalisation of empty values - do_buf, do_hex_dump: return early on an empty buffer - i2d_ocsp_nonce: skip the memcpy for an empty nonce The loops at these sites were already no-ops for zero length, so there is no behaviour change outside sanitizer builds. Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jul 21 12:54:48 2026 (Merged from https://github.com/openssl/openssl/pull/31998)
* quic: report SRTM entry match status via an output argumentNikola Pajkovsky2026-07-215-14/+40
| | | | | | | | | | | | | | | | | | | | | | Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value could not be usefully checked because 0 was overloaded to mean both "no matching entry" and a genuine internal failure (alloc_failed or an lhash consistency error). Give the return value a single meaning (1 on success, 0 on internal error) and report whether a matching entry was found through a new uint8_t *match output argument, which may be NULL if the caller does not need it. Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jul 21 09:24:45 2026 (Merged from https://github.com/openssl/openssl/pull/31974)
* Wire radix QUIC test framework clock to simulated timeAndrew Dinh2026-07-212-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance simulated time so that TXKU cooldown/RTT-gated behaviour can be exercised deterministically, but the framework never actually plumbed that simulated clock into the QUIC channels under test -- OP_SKIP_TIME only affected the terp's own bookkeeping, so real key updates only ever occurred by chance regardless of how much time was "skipped". Fix this by: - Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC channel actually uses the framework's simulated clock, matching what the older quictestlib.c harness already did via fake_now_cb(). - Activating the server-side connection object in hf_accept_conn() so it gets ticked (SSL_handle_events()) like every other object, driving its internal key-update/timer processing forward. Two correctness issues had to be addressed to make this clock plumbing safe and deterministic: - The clock handed to QUIC channels must be purely virtual (a fixed base time plus an explicit slip that only advances via radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or protocol-timing-sensitive assertions become flaky depending on how long real cryptographic work takes on a given machine (e.g. much slower on ASAN+UBSAN debug builds), occasionally triggering a spurious second TXKU before the first is confirmed. radix_process is a single static struct reused across every script in the suite, so time_slip must be reset in RADIX_PROCESS_init() -- otherwise a script would inherit the previous script's accumulated slip and see time jump forward all at once for a brand new connection. The virtual clock also needs a small, fixed per-tick advance (do_per_op(), mirroring the old harness's qtest_add_time(1) in its own connect-wait loop), since QUIC's internal timers need to observe time actually passing to make progress during a busy-wait such as hf_connect_wait spinning on SSL_connect(). - time_slip needs its own dedicated mutex (time_m) rather than being protected by the existing global mutex (gm): get_time() is now called by libssl/QUIC's internals (e.g. from within the reactor tick while holding QUIC's own locks), whereas gm is held by test code across calls into libssl (e.g. hf_clear() holds gm while calling SSL_free()). Sharing gm would take gm and QUIC's internal lock in opposite orders across those two paths, risking a real deadlock (confirmed via a ThreadSanitizer lock-order-inversion report). - The terp's own script-execution watchdog (max_execution_time) needs its own now_cb (terp_now) based on real wall-clock time, so that OP_SKIP_TIME doesn't eat into its execution budget, and so it can still catch a genuinely stuck script independent of the virtual protocol clock. Some scripts also legitimately need a larger budget than the terp default on slow or heavily instrumented CI machines. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Tue Jul 21 09:22:53 2026 (Merged from https://github.com/openssl/openssl/pull/31889)
* Port script_19 to radix test frameworkAndrew Dinh2026-07-213-25/+73
| | | | | | | | | | Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Tue Jul 21 09:22:51 2026 (Merged from https://github.com/openssl/openssl/pull/31889)
* Port script_18 to radix test frameworkAndrew Dinh2026-07-212-97/+36
| | | | | | | | | | Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Tue Jul 21 09:22:49 2026 (Merged from https://github.com/openssl/openssl/pull/31889)
generated by cgit (git 2.51.2) at 2026-10-25 07:49:37 +0100