aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* test/cmp_client_test.c: add RR tests with issuer or serialNumber missingopenssl-3.6Daniel Kubec20 hours1-0/+72
| | | | | | | | | | | | | | | Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit a752594ed84476fbb516b0f43e15de513dcd4a14)
* apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()Daniel Kubec20 hours1-2/+5
| | | | | | | | | | | | | | | | | The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e)
* QUIC: resend the whole ClientHello after a RetryNikolas Gauder41 hours4-103/+390
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit c69b5af10a754051274ef2e5ed17f47753bd6ea9)
* QUIC: release pseudo-lost packets from the congestion controllerNikolas Gauder41 hours2-0/+103
| | | | | | | | | | | | | | | | | | | | | | | | On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298 (cherry picked from commit a87db42e4647d36fb82464d9493145ccc9bd21ed)
* doc: RAND(7): a restore from a saved image is not detected; reseed after itYuxiang Ji41 hours1-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285 (cherry picked from commit f4ada04e0c795e3ff07aa24be79b7240cfbf3388)
* Document the OSSL_PARAM_merge() entry limitMartin Mirchev41 hours1-0/+2
| | | | | | | | | | | | | | | OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev <[email protected]> Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244 (cherry picked from commit 25bba416c07ca811f99d2602ca7e7e6fbd43c45a)
* doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examplesJWWTSL41 hours1-6/+6
| | | | | | | | | | | | | | | | | | | | The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228 (cherry picked from commit 1b02949afd9ddba89ef4f133ecb3c4e9de8c223d)
* CHANGES.md, NEWS.md: 3.6.5 fixupsEugene Syromiatnikov4 days2-5/+17
| | | | | | | | | | | | | | | | Fix CVE-2026-54872 title wording, fix typos in CVE-2026-35191, CVE-2026-75804, and PR #31610[1] descriptions, mention the FIPS indicator change in NEWS.md. [1] https://github.com/openssl/openssl/pull/31610 Co-Authored-by: Mounir IDRASSI <[email protected]> Fixes: 86fc151d787f "CHANGES.md, NEWS.md: update for 3.6.5" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Wed Oct 21 17:04:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33163
* CI: give the cross-compile matrix jobs stable namesDmitry Misharov4 days2-0/+33
| | | | | | | | | | | | | | | GitHub names a matrix job after all its matrix values and cuts the name at 100 characters, so the aarch64 and riscv legs report identical names. Nothing reading job results by name can then tell whether every leg ran or which one failed. Name the jobs after a short per-entry label instead, as interop-tests.yml already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Wed Oct 21 16:48:12 2026 Merged-from: https://github.com/openssl/openssl/pull/33121 (cherry picked from commit 4fe51b0ad523d1863533b2c1f395ace6bf06fddf)
* Fix SSL_poll() multi-reactor cleanup deadlockMounir IDRASSI5 days8-51/+672
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_poll() cleaned up QUIC reactor wait registrations in item-array order. Leaving a reactor can block while its notifier is signalled, so two callers spanning the same reactors could each wait on one reactor while still registered on another. The translation abort path has the same ordering problem. Split QUIC leave into two phases: deregister from every QUIC reactor, then wait for any notification cycles still pending. For QUIC-only poll sets this removes every waiter registration before any notifier wait. DTLS listener cleanup is unchanged. Guard the QUIC drain call for no-quic builds. Phase 2 also prevents an immediate re-registration from keeping the notifier signalled. Capture notify_generation during deregistration so a wait is bounded to the observed cycle. Apply the same generation bound to the combined single-reactor leave operation. Exercise real SSL_poll cleanup on two reactors in both the post-poll and translation-abort paths, including repeated items sharing a reactor. Check that a delayed phase-2 waiter completes while a later notification cycle remains signalled. Fixes #32130 Assisted-by: OpenCode:GLM-5.2 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Tue Oct 20 12:29:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32137 (cherry picked from commit 9682b1123accf8f6bf058a402bf7c8be0be5b5d2)
* chore(bump): update FreeBSD imageEnji Cooper6 days2-8/+8
| | | | | | | | | | | | | | | | | | | | This is being done to help reduce OS maintainer burden as well as OpenSSL developer burden by using a version of FreeBSD which is currently supported by the project. This change updates FreeBSD from 13.4-RELEASE (an EOL release) to 14.4-RELEASE (a close to EOL release, but at the very least supported). Once 15.2-RELEASE is made available, this project should cut over to that version. Original-Commit: e4653f59eeea "chore(bump): update FreeBSD and OpenBSD images" Original-PR: https://github.com/openssl/openssl/pull/31840 Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Mon Oct 19 13:10:16 2026 Merged-from: https://github.com/openssl/openssl/pull/33249
* chore(bump): update cross-platform-actions/action to v1.5.0Enji Cooper6 days2-8/+8
| | | | | | | | | | | Original-Commit: eacf272ea86a "chore(bump): update cross-platform-actions/action to v1.5.0" Original-PR: https://github.com/openssl/openssl/pull/31840 Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Mon Oct 19 13:10:15 2026 Merged-from: https://github.com/openssl/openssl/pull/33249
* fips: improve reporting of failure CRNG testsPauli6 days1-4/+12
| | | | | | | | | | | | The CRNG tests occasionally false positive. The error report is unhelpful in determining the underlying cause. Change the error messages to be more informative. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Merge-date: Mon Oct 19 01:19:58 2026 Merged-from: https://github.com/openssl/openssl/pull/33100 (cherry picked from commit 0d1baa1cd70e6ac619a390159548b935dc62f3d7)
* err: add two new errorsPauli6 days3-0/+10
| | | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Merge-date: Mon Oct 19 01:19:53 2026 Merged-from: https://github.com/openssl/openssl/pull/33100 (cherry picked from commit c882093e70be163f8eac1274d9e27e21dbe96a08)
* doc/man3/EC_GROUP_new.pod: document EC_GROUP_get_ecpkparameters functionmkpark7 days1-0/+5
| | | | | | | | | | | | Added EC_GROUP_get_ecpkparameters() function description and usage details. Complements: 60b350a3ef96 "RT3676: Expose ECgroup i2d functions" Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sun Oct 18 15:26:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit f7b2254eeebdc68bd4e57a3147606590b8188ab1)
* Fix use-after-free in EC_GROUP_get_ecpkparameters()Minkyung Park7 days2-4/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a caller-supplied ECPKPARAMETERS object is passed in, the CHOICE member it already holds is released on entry, but the union pointer was left untouched. If a later step then failed, the error exit called ECPKPARAMETERS_free() on that object, which followed the still valid selector and freed the already released member a second time. Clear the pointer once it has been released, so that the error exit has nothing left to free. This does not change the fact that a caller supplied object is freed on error. That behaviour differs from the sibling function EC_GROUP_get_ecparameters(), which only frees the object it allocated itself, but it is left as-is here. The new test only fails on a sanitizer build; the ECPKPARAMETERS layout is private to ec_asn1.c, so the state cannot be inspected directly. The regression test and the pull request description were written with AI assistance. Fixes: 012c86ab74ae "move ECC ASN1 that is not specific to ECDSA into crypto/ec/, and make some appropriate changes to the EC library." Co-authored-by: Jakub Zelenka <[email protected]> Assisted-by: Claude:claude-fable-5 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sun Oct 18 15:26:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit 4c49f3f1103fc731cf1ec64fec5b744fa031241e)
* test/cmp_vfy_test.c: prevent memory leak in ↵jdymitarai10 days1-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | test_msg_check_update_malicious_sender In test_msg_check_update_malicious_sender(), expected and actual were allocated via X509_NAME_new() prior to SETUP_TEST_FIXTURE(). If set_up() failed, SETUP_TEST_FIXTURE() returned early, leaking both allocated X509_NAME objects. Defer allocation until after SETUP_TEST_FIXTURE(), initialize both pointers to NULL, and allocate them safely within the TEST_ptr() validation chain. On setup or validation failure, both pointers and the test fixture are freed cleanly. Resolves: https://github.com/openssl/openssl/issues/33200 Fixes: 1951c3cbd9d5 "Add test for CVE-2026-63073" CLA: trivial Signed-off-by: jdymitarai <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Oct 15 11:51:16 2026 Merged-from: https://github.com/openssl/openssl/pull/33203 (cherry picked from commit 6d76833d61fad07a171219d9cb1444bc37f88b8f)
* Fix set but unsued variable in lib/opt.cNeil Horman13 days1-2/+0
| | | | | | | | | | | | | | | | | https://github.com/openssl/openssl/actions/runs/34494520852/job/102982686286 CI is failing because we have a varaible in opt.c that is set but never used. Just remove it. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Sat Sep 12 13:18:16 2026 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merged-from: https://github.com/openssl/openssl/pull/33194 (cherry picked from commit eadfce0e20dafd9a9bc8232caf84c4c9498ea667)
* Correct PEM X509 docs regarding TRUSTED CERTIFICATE blockschrissorr13 days1-2/+3
| | | | | | | | | | | | | | | The documentation stated that the X509 PEM functions also process trusted certificates, discarding the trust settings. In fact, they reject "TRUSTED CERTIFICATE" blocks; only the X509_AUX functions accept them. Update the text accordingly. Resolves: https://github.com/openssl/openssl/issues/33019 CLA: trivial Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Sun Oct 11 21:31:53 2026 Merged-from: https://github.com/openssl/openssl/pull/33166 (cherry picked from commit 22d309a11839d7c505af63c54880e657fc4bab5c)
* QUIC: don't answer a refused Retry token with another RetryNikolas Gauder13 days2-2/+238
| | | | | | | | | | | | | | | | | | | | When an Initial packet carries a Retry token that we minted, but which then fails validation (expired, wrong address or DCID), the server sent a fresh Retry. The client has already processed a Retry packet and must ignore any further ones (RFC 9000 section 17.2.5.2), so it just waits for its idle timeout. Drop the packet instead, which RFC 9000 section 8.1.2 allows. Tokens that don't decrypt, or NEW_TOKEN tokens, still get a Retry as before. Fixes: 29e861a5a605 "Add lookup for initial token assignment on channel start" Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sun Oct 11 20:18:44 2026 Merged-from: https://github.com/openssl/openssl/pull/33149 (cherry picked from commit 061b82ade3c2c9fb1149d66ba046888b078675d5)
* test/quicapitest.c: fix BIO leak in test_quic_amplification_limit()Nikolas Gauder2026-10-101-3/+9
| | | | | | | | | | | | | | | The dgram pair BIOs leaked if the test failed before SSL_set_bio(). Free them on exit, and clear the local pointers once the SSL objects own them, as other tests in this file do. Fixes: 58f250eee071 "Add a test to check for quic unvalidated credit" Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 10 08:16:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33150 (cherry picked from commit bb908b895bef4bf5965ddb483f12eb1fe1ec5b40)
* cipher_aes_gcm_hw_vaes_avx512.inc: fix linux-x32 build failureRichard Levitte2026-10-101-0/+2
| | | | | | | | | | | | | | | | | | | The VAES GCM code is enabled by an ISA check (__x86_64__ & co), which the x32 ABI satisfies: x32 is a 64-bit platform with a 32-bit size_t. There, comparing the size_t ivlen against 2^61 is always false, which -Wtype-limits (via --strict-warnings) turns into a build failure. Only perform the check where size_t is wide enough to violate the limit. Fixes: 63b996e752ac "AES-GCM enabled with AVX512 vAES and vPCLMULQDQ." Assisted-by: Pi:moonshotai/kimi-k3 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 22:32:44 2026 Merged-from: https://github.com/openssl/openssl/pull/32926 (cherry picked from commit 04c2d1b7b37148808b5cdc9c2c029b2e9f13a783)
* CONF: reject a NUL list separator in CONF_parse_list()Darren Carreras2026-10-094-1/+127
| | | | | | | | | | | | | | | | | | | | | | | | CONF_parse_list() treated any integer separator that converts to NUL as a match for the input string terminator. After processing the final element, the loop advanced beyond the input and searched from that invalid pointer on the next iteration. Reject every NUL-equivalent separator before parsing and raise ERR_R_PASSED_INVALID_ARGUMENT. Add a regression test that verifies the direct NUL value and positive/negative integer aliases, confirms that no callback is invoked, checks the error queue, and checks that normal comma-separated parsing keeps working as expected. Resolves: https://github.com/openssl/openssl/issues/32667 Fixes: df5eaa8a5297 "default_algorithms option in ENGINE config." Reported-by: x-ray-z Assisted-by: OpenAI Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 21:25:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32684 (cherry picked from commit a502c66ce4d8784c2a1f3c195fd876f19fbe8392)
* EVP_MD_demo.c, tls13secretstest.c: avoid signed-to-unsigned integer conversionJan Schaumann2026-10-092-3/+9
| | | | | | | | | | | | | | | | | | | Should EVP_MD_size() return -1, the size_t len variable would wrap, causing any subsequent error checks to not trigger. Change to type int (which is what EVP_MD_size() returns). While this is just in test/demo code, that's the kind of code that people might copy and reuse elsewhere, and that AI vuln scanners trigger on, so might as well try to eliminate that noise. Fixes: 7a7fbeb924a0 "fix all the warnings in our demos and make them enableable" Fixes: 134bfe56c4fe "Add a test for the TLS1.3 secret generation" Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 19:19:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31222 (cherry picked from commit 9f561c1c232786f8406173f4d09ccc49a33f8883)
* rsa_multiprime_keygen(): Fix leak of tmp if stack insertion failsTomas Mraz2026-10-071-2/+6
| | | | | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Wed Oct 7 07:39:03 2026 Merged-from: https://github.com/openssl/openssl/pull/33129 (cherry picked from commit 35b8874b1d45aed1a5a604cca75d7af3c1c72067)
* Revert "Don't let stderr block when filling up."Mounir IDRASSI2026-10-061-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 0fff0090507a205e6d37072d6ea151b68d0f74b6. That commit discarded command stderr without an explicit redirection under the default non-verbose harness. This hides diagnostics, including LeakSanitizer reports from failing commands in sanitizer CI jobs. Restore command stderr to the harness's existing reporting path, retaining the VMS-only null-device redirection and explicit recipe redirections. The harness can then show diagnostics for failed assertions, including when a command succeeds but an assertion about its captured stdout fails. Passing full-suite runs produced no additional diagnostic output. This depends on the preceding callback fix. Without it, restoring stderr also restores quadratic processing of that output. On Linux, the fix removes a slowdown with the blocked-writer signature reported in #32128. Native OpenBSD and macOS confirmation remains outstanding. Assisted-by: Claude Code:claude-opus-5-5 Assisted-by: Codex:gpt-6-astra Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 16:04:02 2026 Merged-from: https://github.com/openssl/openssl/pull/33078 (cherry picked from commit 6e03d305580a57160466cdf4a22e2a59c1dd3aa5)
* test/run_tests.pl: avoid quadratic time on long test outputMounir IDRASSI2026-10-061-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With failure buffering enabled, the ALL callback appends nonempty output lines that it does not recognize as plans or test results to $output_buffer. Without an explicit return, that branch returns the accumulated buffer. TAP::Base::_make_callback() invokes callbacks in list context, even when TAP::Parser calls it in void context, so the buffer is copied. Each append then costs time proportional to the output accumulated so far, making processing quadratic for a growing sequence of such lines. run_tests.pl merges recipe stderr into the stream it reads. While the harness copies, a command writing enough stderr can fill that pipe and block. On Linux, with command stderr restored to this stream and the radix recipe from before #32395, test_quic_radix took 9.9 seconds without the fix and 2.3 seconds with it. Setting glibc's mmap threshold to a fixed 128 KiB increased the former to 85 seconds, while the fixed run took 2.3 seconds. The command blocked writing stderr while the harness kept a CPU busy, reproducing the signature reported in #32128. These measurements do not establish the cause of the historical OpenBSD and macOS stalls. Return no values from the callback; the parser does not use its result. V=1 disables failure buffering and avoids this accumulation path. Assisted-by: Claude Code:claude-opus-5-5 Assisted-by: Codex:gpt-6-astra Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 16:04:01 2026 Merged-from: https://github.com/openssl/openssl/pull/33078 (cherry picked from commit ab9decd55becb870eb4bf99171dad6e8b706ac24)
* test_cipher_reinit(): Reinit succeeds with CCM on providers >=4.2.0Tomas Mraz2026-10-061-2/+3
| | | | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Tue Oct 6 13:22:05 2026 Merged-from: https://github.com/openssl/openssl/pull/33115 (cherry picked from commit 752d9a2c12fc3e0e1f10e5f09b2e17fe689a8fc3)
* NOTES-ANDROID.md: add a note on 16 KiB page size for older OpenSSL versionsPSJ2026-10-051-0/+6
| | | | | | | | | | | CLA: trivial Co-authored-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Mon Oct 5 10:14:10 2026 Merged-from: https://github.com/openssl/openssl/pull/30013 (cherry picked from commit 31f4ecc5d000c5c8b902637deb841a4aeb8ee49a)
* Change all files with OpenSSL License to ASL 2.0 LicenseTomas Mraz2026-10-054-7/+7
| | | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Oct 5 09:34:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33070 (cherry picked from commit 85cdce464b1bdeab55e620cff0be6bc85a1d3103)
* docs: fix two broken doc linksyuwk2026-10-022-2/+2
| | | | | | | | | | | | | | Fixes: 312142583092 "Add --fips-key configuration parameter to fipsinstall application." Fixes: dc589daec888 "Reformat some NOTES and README files" CLA: trivial Signed-off-by: yuwk <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Fri Oct 2 08:47:38 2026 Merged-from: https://github.com/openssl/openssl/pull/33051 (cherry picked from commit 4d25710dbfeacbb36d055592a3bc6811172248b1)
* RISC-V: handle misaligned input in the SHA-512 coreJulian Zhu2026-10-021-12/+61
| | | | | | | | | | | | Build each doubleword from two aligned loads when the input is misaligned, as for SHA-256, instead of relying on slow misaligned ld. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:26:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33008 (cherry picked from commit 4f307857f9bde35039517e55468e929560a716ff)
* RISC-V: shorten the SHA-512 round chainJulian Zhu2026-10-021-148/+79
| | | | | | | | | | | Apply the same round restructuring as for SHA-256. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:26:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33008 (cherry picked from commit 0855b7fb7ea06bcbc29e0445461d295a4497ac58)
* RISC-V: handle misaligned input in the SHA-256 coreJulian Zhu2026-10-021-12/+73
| | | | | | | | | | | | | The Zbb path loads input with ld, which is very slow on cores that trap misaligned accesses. Build each doubleword from two aligned loads when the input is misaligned. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:26:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33008 (cherry picked from commit c039e9951f2c333972b03f69a2f8184c511b23b7)
* RISC-V: shorten the SHA-256 round chainJulian Zhu2026-10-021-141/+97
| | | | | | | | | | | | | Reuse values the previous round already has instead of recomputing or reloading them, and reorder the round so adjacent instructions are independent. This lowers the instruction count and helps in-order cores. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:26:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33008 (cherry picked from commit da3464bcd0ef86d65d0e6bac0445f39ea69c070f)
* RISC-V: handle misaligned input in the SM3 coreJulian Zhu2026-10-021-10/+42
| | | | | | | | | | | | | The input is loaded with ld, which is very slow on cores that trap misaligned accesses. Build each doubleword from two aligned loads when the input is misaligned. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:24:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33007 (cherry picked from commit 146feef481212287596f0bf9d8a34251354ccec4)
* RISC-V: shorten the SM3 round chainJulian Zhu2026-10-021-248/+139
| | | | | | | | | | | | | Use register-resident message words directly instead of copying them, and reorder the round and message expansion so fewer instructions wait on each other. Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:24:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33007 (cherry picked from commit 58a8d50b884225b7f0f46e5b7ee6a173cb445287)
* LoongArch: Include internal/cryptlib.h in loongarchcap.cJulian Zhu2026-10-021-0/+1
| | | | | | | | | | | | | | It declares OPENSSL_cpuid_setup(). Without it, a --strict-warnings build fails with -Werror=missing-prototypes. Fixes #32984 Signed-off-by: Julian Zhu <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:19:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32985 (cherry picked from commit d91e23d7663db115676ebd0d7b789011b551e915)
* doc: move OPENSSL_RUNNING_UNIT_TESTS out of OPENSSL_TRACEs4ge2026-10-021-7/+9
| | | | | | | | | | | | | | | The env var was documented as an =item between the OPENSSL_TRACE description and its nested trace-name list, so openssl-env(7) rendered it as if it were a TRACE category. Move it to a top-level =item after OPENSSL_MODULES. Fixes: https://github.com/openssl/openssl/issues/31094 CLA: trivial Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Fri Oct 2 07:56:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33000
* Increase BIO_dgram_pair ring buffer size on AIX for quic testsNeil Horman2026-10-011-1/+11
| | | | | | | | | | | | | | | | | | | | | | | AIX has a unique definition of struct sockaddr_un (AF_UNIX addresses). Whereas most unixes define the structure to have a sun_path field of 108 bytes, AIX defines sun_path to be an array of 1023 bytes. Because BIO_dgram_pairs use two BIO_ADDR's (which are a union containing sockaddr_un) to define a pseudo UDP header, any dgram pair with a fixed ring buffer size is likely to be unable to transmit a complete frame if the ring buffer is sized with less than sizeof(BIO_ADDR)*2 + 1200 bytes allocated on AIX. Fix it by increasing the ring buffer size for such tests Fixes #32506 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Thu Oct 1 19:13:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32838 (cherry picked from commit 7ef69a722c129fe446d7a1fef52ff8f12ccb010b)
* Accept multi-digit version components in the qlog verifierGeorgy Karataev2026-09-301-1/+1
| | | | | | | | Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 10:01:42 2026 Merged-from: https://github.com/openssl/openssl/pull/33050 (cherry picked from commit ef0d748ece707e4518891751e3d06cf5632301b0)
* use proper loop index when building new cid in packetNeil Horman2026-09-291-1/+1
| | | | | | | | | | | | | | | | | | | commit 596baa5b032dc4bc3f89f97f4b57ae63c56d5f93 added a test that builds a series of packets with connection ids in them, using the index i for the outer packet loop, and index j for the inner WPACKET_memcpy_u8 loop to copy the cid into the packet. However the i index was used to index the cid id array, and so after 8 packets (the length of a connection id), we started indexing off the end of the array, which triggered an msan issue in CI. Use the proper loop index j for the copy loop of the cid. Fixes openssl/project#2066 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Tue Sep 29 20:40:05 2026 Merged-from: https://github.com/openssl/openssl/pull/33040
* Fix NULL dereference in SSL_get0_group_name() before a handshakeAlberto Maschietto2026-09-293-4/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_get0_group_name() falls back to sc->session->kex_group whenever the connection is not a TLSv1.3 one that has already done a key exchange. On a connection that has not started (or completed) a handshake yet, sc->session is still NULL, so the fallback crashes instead of returning NULL as the manual page promises. This is the same problem that was fixed for SSL_get_negotiated_group() in commit 4ca80d3941, and the fix here mirrors it: only consult the session when there is one, and report "no group" otherwise. It affects TLS, DTLS and QUIC connections, and every branch since the accessor was added in 3.2. The RETURN VALUES section said a NULL return meant an error occurred. That is not accurate: NULL simply means no group is available, which is the normal answer before a handshake or after one that used no key agreement group. Reword it accordingly. Add a regression test that calls both group accessors on a fresh SSL object. Without the fix it segfaults; with it, SSL_get0_group_name() returns NULL and SSL_get_negotiated_group() returns NID_undef. Fixes #32379 Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 17:04:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32437 (cherry picked from commit 33eaaad65ba7623345a6dcf7a20612dc0339107e)
* Add support for Arm Neoverse V3AE platformGowtham Suresh Kumar2026-09-292-0/+3
| | | | | | | | | | | | | | | Add cpu MIDR and ensure relevant optimisations are enabled. Backport of commit 32ff0eb from master branch. Signed-off-by: Paul Elliott <[email protected]> Signed-off-by: Gowtham Suresh Kumar <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Tue Sep 29 16:59:13 2026 Merged-from: https://github.com/openssl/openssl/pull/32125 (cherry picked from commit b108e866388f32a4d0a1ae71d176035426ac8b2a)
* Prepare for 3.6.6openssl-machine2026-09-293-3/+11
| | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 13:57:39 2026 Release: yes
* Prepare for release of 3.6.5openssl-3.6.5openssl-machine2026-09-293-4/+4
| | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 13:57:30 2026 Release: yes
* make updateopenssl-machine2026-09-293-40/+75
| | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 13:57:30 2026 Release: yes
* Copyright year updatesopenssl-machine2026-09-29112-112/+112
| | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 13:55:15 2026 Release: yes
* CHANGES.md, NEWS.md: update for 3.6.5Eugene Syromiatnikov2026-09-292-8/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3.6.5 CHANGES.md includes the following: * CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84784 * https://github.com/openssl/openssl/pull/31610 "siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure." * https://github.com/openssl/openssl/pull/32694 "http: reject HTTPS downgrades after relative redirects" * https://github.com/openssl/openssl/pull/32872 "Remove /Gs0 windows compiler flag" * https://github.com/openssl/openssl/pull/32939 "FIPS[3.6]: Change FIPS indicators so that all approved algorithms have a gettable indicator" 3.6.5 NEWS.md includes the following: * CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84784 * https://github.com/openssl/openssl/pull/31610 "siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Tue Sep 29 12:02:01 2026
* test verifies the connection level RX flow controlAlexandr Nedvedicky2026-09-291-1/+22
| | | | | | | | | window is enforced. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Tue Sep 29 11:58:11 2026
generated by cgit (git 2.51.2) at 2026-10-25 07:12:30 +0100