aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* test/cmp_client_test.c: add RR tests with issuer or serialNumber missingHEADmasterDaniel Kubec21 hours1-0/+72
| | | | | | | | | | | | | | Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071
* apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()Daniel Kubec21 hours1-2/+5
| | | | | | | | | | | | | | | | The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071
* Migrate test_gcm_reinit from evp_extra_test.c to evp_aead_test.cDanny Nichols34 hours2-185/+185
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Fri Oct 23 20:40:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33308
* s390x: Display 'cex_min_bits' and 'nocex' as part of CPUINFOIngo Franzki40 hours1-2/+10
| | | | | | | | | | | | | | | | | | | | | | | Command 'openssl version -c' as well as other commands (e.g. 'openssl speed') display the CPU information. For s390x, this includes the OPENSSL_s390xcap settings that are currently in place. Also display the 'cex_min_bits:<bits>' and 'nocex' settings there. The 'cex_min_bits' setting is always displayed, showing the default value if it was not explicitly specified via the OPENSSL_s390xcap environment variable. The 'nocex' setting is only displayed when it was explicitly set via the OPENSSL_s390xcap environment variable, or if offloading is disabled because no crypto adapters are available or the file descriptor has been closed by other means. Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Oct 23 15:20:46 2026 (Merged from https://github.com/openssl/openssl/pull/31630)
* s390x: Disable mod-expo offloading to a crypto card for small exponentsIngo Franzki40 hours7-7/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new keyword 'cex_min_bits:<bits>' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)
* QUIC: resend the whole ClientHello after a RetryNikolas Gauder42 hours5-103/+398
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298
* QUIC: release pseudo-lost packets from the congestion controllerNikolas Gauder42 hours2-0/+103
| | | | | | | | | | | | | | | | | | | | | | | On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298
* doc: RAND(7): a restore from a saved image is not detected; reseed after itYuxiang Ji42 hours1-0/+13
| | | | | | | | | | | | | | | | | | | | | | | The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285
* poly1305-armv9-sve2.pl: close STDOUT before exitingt0kubetsu42 hours1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The last line of the script was " STDOUT or die ...", without the "close" keyword, so the pipe to arm-xlate.pl was never closed explicitly. Perl could then exit before arm-xlate.pl had written the output file, and make compiled poly1305-armv9-sve2.S before it existed: gcc: error: crypto/poly1305/poly1305-armv9-sve2.S: No such file or directory This was seen on linux-aarch64 builds in the manylinux2014 image (perl 5.16.3) under QEMU. Running the generator alone 5 times in that image, the output file was missing right after perl exited 5 times out of 5; with this change, 0 times out of 5. The other perlasm scripts, for example poly1305-armv8.pl and chacha-armv8-sve.pl, already end with "close STDOUT or die ...". CLA: trivial Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Merge-date: Fri Oct 23 12:49:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33276
* Document the OSSL_PARAM_merge() entry limitMartin Mirchev42 hours1-0/+2
| | | | | | | | | | | | | | OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev <[email protected]> Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244
* doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examplesJWWTSL42 hours1-6/+6
| | | | | | | | | | | | | | | | | | | The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228
* test: clear stale RADIX handshake injection selectorsMounir IDRASSI42 hours2-0/+7
| | | | | | | | | | | | | | | | | | | | | The handshake injection helpers share radix_fault with earlier scripts but left its selector words unchanged. script_68 leaves word0 set to 1, which selects CertificateRequest. script_69 installs the same callback before it sets word0 to 2 for KeyUpdate. A session ticket generated in that interval can trigger the previous script's fault and close the connection before the intended KeyUpdate injection. Clear both selector words in the handshake injection setup paths, as the plaintext injection setup already does. Request a normal session ticket in script_69 before arming its fault, so the test exercises the interval where an inherited selector caused the unexpected close. Keep the expected KeyUpdate close code unchanged. Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 23 12:40:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33213
* test: make RADIX QUIC objects nonblocking by defaultMounir IDRASSI42 hours3-3/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RADIX drives both endpoints and advances its simulated clock from one interpreter. Accepted server connections inherit blocking mode from their listeners, even though the underlying UDP sockets are nonblocking. Extra handshake retries advance fake time and can inflate the initial RTT estimates. In the one-way key update loops the server's estimate can stay high while later samples reduce the client's PTO. The server can then retain its previous receive keys for longer than the client waits before its next update. Packets starting that update are then discarded, as permitted by RFC 9001 section 6.5. A blocking server read prevents the interpreter from driving client retransmission or advancing the clock, so this recoverable discard becomes a hang. The interpreter's 60-second deadline cannot interrupt the call, leaving the process watchdog to abort. External UDP loss is not required to reproduce the failure. Set clients and listeners to nonblocking mode at construction, including listeners created from a domain and the custom listener constructors. Accepted connections and their streams inherit this setting. The client setting makes the construction policy consistent before OP_CONNECT_WAIT, which also sets its mode. Retain the domain blocking capability needed by SSL_poll and document how tests can explicitly enable blocking I/O. Add a regression using existing opcodes to delay an ACK, increase the server's PTO and require recovery across successive client key updates. Cover both listener creation paths. Check listener and client modes before connection establishment and the accepted server's mode, so a recurrence fails promptly instead of waiting for the process watchdog. Fixes #33206. Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 23 12:40:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33213
* Document DTLS 1.3 handshake ACK known issueRyan Hooper3 days1-0/+6
| | | | | | | | | | | | | Note that servers may reject ACKs received while waiting for the client's handshake response. Refs: #33242 Refs: #33267 Assisted-by: OpenAI:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Thu Oct 22 14:58:41 2026 Merged-from: https://github.com/openssl/openssl/pull/33296
* Document DTLS listener error-reporting known issuesRyan Hooper3 days1-0/+12
| | | | | | | | | | | | | | Add OpenSSL 4.1.0 release notes for permanent receive failures reported as retries and retryable writes reported as fatal errors on connections accepted from DTLS listeners. Refs: #33277 Refs: #33278 Assisted-by: OpenAI:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Thu Oct 22 14:56:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33295
* DTLS listener: do not drive idle pending connections every tickMatt Caswell3 days4-16/+867
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Every listener tick called SSL_accept() on every pending connection, whether or not anything had arrived for it, and each such call pumped the demux with another recvmmsg(). SSL_poll() ticks the listener once per item, so 256 one-byte datagrams from distinct source ports, which fill the pending table for 30 s, made every SSL_poll() over N connections cost (N + 1) * 256 futile SSL_accept() calls. Record whether the last drive left a pending connection waiting for its peer, and skip it until a datagram is queued for it or its retransmission timer expires. Driving one connection pumps the demux, which can queue a datagram for a connection the tick skipped or has already driven while emptying the socket the caller then waits on. Drive again when that happens, up to DTLS_LISTENER_MAX_DRIVE_PASSES times, and do not let a wait on the listener or on its connections sleep while such input remains. Discovered by Anthropic's OSS Scanner (finding ANT-2026-EFVK6J4Z). Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Thu Oct 22 14:38:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33265
* DTLS listener: free a pending connection that fails after HVRMatt Caswell3 days2-1/+103
| | | | | | | | | | | | | | | | | | | | dtls_listener_conn_needs_retry() reported a DTLS 1.2 connection as waiting for its second ClientHello whenever its handshake state was DTLS_ST_SW_HELLO_VERIFY_REQUEST, even if the connection had since entered the error state, e.g. on receiving a fatal alert from the peer. The listener then kept it in its pending table, and called SSL_accept() on it every tick, until the pending timeout expired instead of freeing it as a failed connection. Check ossl_statem_in_error() as the DTLS 1.3 HRR case already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Thu Oct 22 14:38:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33265
* CI: install Debian 11 packages from archive.debian.orgDmitry Misharov3 days1-9/+4
| | | | | | | | | | | | | bullseye, bullseye-updates and bullseye-security are now on archive.debian.org, so the snapshot repos and the Valid-Until override are no longer needed. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Thu Oct 22 10:02:43 2026 Merged-from: https://github.com/openssl/openssl/pull/33314
* CI: inline the package install retry in os-zoo containersDmitry Misharov3 days1-1/+11
| | | | | | | | | | | | | The distro images have no git, so actions/checkout downloads a GitHub archive, which leaves out .github/ because of export-ignore. The install step then failed with ".github/retry: not found" in every linux job. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Thu Oct 22 10:02:43 2026 Merged-from: https://github.com/openssl/openssl/pull/33314
* DTLS 1.3: Fix WANT_READ while awaiting ServerHelloRyan Hooper3 days2-3/+207
| | | | | | | | | | | | | | | | | | | | | After HelloRetryRequest, buffering records from a later epoch can request a retry without reading the BIO. Supply missing read-retry flags so SSL_get_error() reports SSL_ERROR_WANT_READ rather than SSL_ERROR_SYSCALL. Preserve existing retry conditions and handle listener connections without a read BIO. Add regression tests for delayed ServerHello delivery and permanent loss followed by timeout-driven retransmission. Check WANT_READ and an empty error queue after every retry, then verify handshake completion and bidirectional application data. Fixes: #33241 Assisted-by: Claude Code:claude-sonnet-5-5 Assisted-by: OpenCode:github-copilot/gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Thu Oct 22 06:08:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33268
* ci: bump actions/upload-artifact to v6Nikola Pajkovsky4 days12-33/+33
| | | | | | | | | | | | upload-artifact v4 and v5 run on the deprecated Node.js 20 runtime, which makes GitHub Actions print a deprecation warning. v6 runs on Node.js 24 by default. Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Wed Oct 21 17:15:18 2026 Merged-from: https://github.com/openssl/openssl/pull/33247
* Fix wrong alignment in tho allocator used in quic_stream test.rainerjung4 days1-2/+16
| | | | | | | | | | | | | | | Wrong alignment observed on Solaris Sparc 10 (bus error). THO_ALLOC_HDR has size 20 and memory for structures gets allocated at addresses directly following a THO_ALLOC_HDR. Backport needed for the 4.1 branch. Fixes https://github.com/openssl/openssl/issues/33187 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Wed Oct 21 17:10:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33204
* CI: retry environment steps before failing the jobDmitry Misharov4 days10-69/+104
| | | | | | | | | | | | | | | The VS2013 toolchain image pull, the cross-compile apt installs and the DJGPP PPA fail transiently and turn a push red with nothing in the log about the change. Try each up to three times, 30 seconds apart. When all attempts fail, report it as an environment failure in an error annotation and the job summary, so it is not mistaken for a test failure. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Wed Oct 21 17:07:51 2026 Merged-from: https://github.com/openssl/openssl/pull/33198
* Add test for an update with no inputTrust-Worthy4 days1-0/+90
| | | | | | | | | | | | An update with no input and a nonzero length must fail, except for the CCM message length. test_evp_aead_update_null_input checks this for every AEAD, and that a rejected update writes no output. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157
* Reject a NULL input to update in the other AEADsTrust-Worthy4 days6-0/+31
| | | | | | | | | | | | | An update with no input buffer and a nonzero length was accepted by the GCM, CCM, SIV, GCM-SIV, ChaCha20-Poly1305 and ASCON implementations. Reject it, except for the CCM message length, which is passed with no input and no output. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157
* AES-OCB: reject a NULL input to updateTrust-Worthy4 days1-0/+5
| | | | | | | | | | | | EVP_EncryptUpdate() with a NULL input buffer and a nonzero length read from the NULL pointer in CRYPTO_ocb128_aad(), a NULL-pointer dereference detected by ASan. Reject the call instead. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157
* CI: run zero-yield jobs nightly instead of on every pushDmitry Misharov4 days7-180/+232
| | | | | | | | | | | | | | | | | | | These jobs build configurations that, from May to October 2026, never failed on master when the other push jobs passed, so they cost runner time on every push and pull request without adding signal. Run the whole compiler-zoo workflow, and the moved ci.yml, run-checker-merge and windows.yml jobs, once a day; the latter in a new Nightly CI workflow. mingw64 is a primary platform, so the MSYS2 UCRT64 build stays on every pull request. Drop the run-checker-merge options and the plain libFuzzer leg that other jobs already cover, and the duplicate no-shared option in run-checker-daily. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Wed Oct 21 16:56:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33125
* CI: give the cross-compile matrix jobs stable namesDmitry Misharov4 days3-0/+37
| | | | | | | | | | | | | | GitHub names a matrix job after all its matrix values and cuts the name at 100 characters, so the aarch64 and riscv legs report identical names. Nothing reading job results by name can then tell whether every leg ran or which one failed. Name the jobs after a short per-entry label instead, as interop-tests.yml already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Wed Oct 21 16:48:12 2026 Merged-from: https://github.com/openssl/openssl/pull/33121
* TLS: Generate the server random before processing ClientHello extensionsDaniel Kubec4 days6-24/+660
| | | | | | | | | | | | | | | | | | | | | | | The server random was only generated after all of the ClientHello extensions had been processed. In (D)TLSv1.3 the PSK callbacks are invoked while the pre_shared_key extension is being parsed, so a call to SSL_get_server_random() from within them returned all zeros. The TLSv1.2 psk_server_callback runs during ClientKeyExchange processing and so already observed the real value, making the behaviour inconsistent between protocol versions. Move the generation of the server random to immediately after the protocol version has been selected and before any of the remaining ClientHello processing. As a result the server random is also visible from the other callbacks invoked during ClientHello processing, such as the session ticket and servername callbacks. Fixes #26404 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Wed Oct 21 16:45:34 2026 Merged-from: https://github.com/openssl/openssl/pull/33102
* Cache decoded certs on client in CTX to avoid multiple asn1 parsingNeil Horman4 days3-13/+143
| | | | | | | | | | | | | | | | | our TLS client path has to do an ASN1 decode on every new connection it establishes. Other TLS stacks (notably rustls) seems to not do this decode, opting instead to to do just enough der parsing to verify the certificate chain. We can't really do that, but we can maybe do some things to speed up this path. Most notably we can cache the received certificate der string in the SSL_CTX along with a previously decoded X509 certificate to avoid the overhead of additional ASN1 parsings in future connections Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Wed Oct 21 16:44:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33085
* CHANGES.md: formatting fixesEugene Syromiatnikov4 days1-3/+3
| | | | | | | | | | | | Apply minor formatting fixes to X509_OBJECT_up_ref_count() deprecation change log entry, to avoid naked underscores in the Markdown markup, and add a missing comma. Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Wed Oct 21 16:41:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33052
* CHANGES.md, NEWS.md: 4.0.3 fixupsEugene Syromiatnikov4 days2-5/+17
| | | | | | | | | | | | | | | Fix CVE-2026-54872 title wording, fix typos in CVE-2026-35191, CVE-2026-75804, and PR #31610[1] descriptions, mention the FIPS indicator change in NEWS.md. [1] https://github.com/openssl/openssl/pull/31610 Co-Authored-by: Mounir IDRASSI <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Wed Oct 21 16:41:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33052
* CHANGES.md, NEWS.md: update for 4.0.3Eugene Syromiatnikov4 days2-9/+404
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4.0.3 CHANGES.md includes the following: * CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784 * https://github.com/openssl/openssl/pull/31000 "Fix 4.0 regression: retain pending base64 BIO output on retry" * https://github.com/openssl/openssl/pull/31610 "siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure." * https://github.com/openssl/openssl/pull/32694 "http: reject HTTPS downgrades after relative redirects" * https://github.com/openssl/openssl/pull/32872 "Remove /Gs0 windows compiler flag" * https://github.com/openssl/openssl/pull/32941 "FIPS[4.0]: Change FIPS indicators so that all approved algorithms have a gettable indicator" 4.0.3 NEWS.md includes the following: * CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784 * https://github.com/openssl/openssl/pull/31000 "Fix 4.0 regression: retain pending base64 BIO output on retry" * https://github.com/openssl/openssl/pull/31610 "siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 12:00:20 2026 Reviewed-by: Milan Broz <[email protected]> Merged-from: https://github.com/openssl/openssl/pull/33052
* Add changes entry for AVX2 ML-KEM implementationPauli4 days1-0/+5
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33023
* ml_kem: add AVX2 base multiplication and accumulationPaul Dale4 days3-24/+241
| | | | | | | | | | | | | | Use AVX2 NTT-domain multiplication and accumulation for ML-KEM inner products, matrix products, and the transposed matrix product used in key generation. Rename the x86_64 perlasm source to reflect its wider scope. Assisted-by: ChatGPT:gpt-6-Sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33023
* ml_kem: add AVX2 NTT and inverse NTTPaul Dale4 days3-2/+497
| | | | | | | | | | Implement the FIPS 203 transforms in x86_64 perlasm with AVX2 runtime dispatch. Assisted-by: ChatGPT:gpt-6-Sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33023
* Add updated Wycheproof test vectors to aes-gcm-siv test fileishamistry034 days1-0/+1767
| | | | | | | | | Assisted-by: Claude Sonnet 5 Signed-off-by: rkselvam-hub <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Wed Oct 21 16:33:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32830
* Fix TLS 1.3 alert for missing key_shareAnuj Ramesh4 days2-5/+37
| | | | | | | | | | | Fixes #30818 Co-authored-by: Anuj Ramesh <[email protected]> Assisted-by: Claude:claude-fable-5 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Wed Oct 21 16:29:21 2026 Merged-from: https://github.com/openssl/openssl/pull/32527
* ssl: handle session ID cache lock failureMounir IDRASSI4 days6-11/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_has_matching_session_id() returns 0 both when no matching session exists and when the cache lock cannot be acquired. Its use in the built-in generator's retry loop and the final uniqueness check can therefore treat a lock failure as proof that no conflict exists. Add an internal tri-state lookup. The final uniqueness check uses it as a backstop for IDs produced by both built-in and application callbacks, recording an internal fatal error when the cache cannot be checked. The retry loop also uses it to prevent the built-in generator from returning an ID after its own lookup failed, through the existing callback failure path. Preserve the public API's boolean contract. Correct the callback-selection cache lock failure reason from SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED to ERR_R_INTERNAL_ERROR. Remove a redundant caller-side SSLfatal() that appended a generic ERR_R_INTERNAL_ERROR after the specific error already recorded. Add a deterministic unit test for final cache lookup failure. Fixes #32358 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Oct 21 16:25:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32359
* Adds a test that tests missing integrity only ciphers effect on TLS cipher ↵Frederik Wedel-Heinen4 days2-1/+91
| | | | | | | | | | suites. Co-authored-by: Mounir Idrassi <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Oct 21 16:22:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32051
* Removes clean DES and RC2 as encryption methods for TLS ciphersuites and ↵Frederik Wedel-Heinen4 days4-135/+85
| | | | | | | | | refactors the fetching of NULL cipher to be consistent. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Oct 21 16:22:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32051
* aes: fix riscv64 constant-time fallback selectionpeter9412214 days2-1712/+5
| | | | | | | Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080
* aes: remove unused riscv64 assembly generationpeter9412214 days1-1/+0
| | | | | | | Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080
* aes: make riscv64 no-Zkn fallback constant timepeter9412214 days1-2/+4
| | | | | | | Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080
* x509: key the duplicate-extension hash with SipHash to resist floodingDaniel Kubec4 days2-13/+122
| | | | | | | | | | | | | | | | | | | | | | | | scan_ext_flags() deduplicates certificate extensions. Standard extensions have an assigned NID and are handled by an O(1) bitset, but unknown or dynamically registered OIDs fall back to an hash table. Hash the OID with SipHash under a random key drawn once per scan, so the bucket an OID lands in is unpredictable to an attacker. This mirrors the existing defense for attacker-controlled keys in ssl/quic/quic_lcidm.c. If the table cannot be set up or an insert fails, fail closed with EXFLAG_INVALID, as ossl_x509v3_cache_extensions() does for any other extension it cannot process. Leaving the loop silently would skip not only the duplicate check but also the unsupported-critical check for this and every later extension. Discovered by Anthropic's OSS Scanner (finding ANT-2026-7UKRZ2MY). Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Wed Oct 21 15:58:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33281
* DTLS 1.3: discard forbidden plaintext before replay checksMounir IDRASSI4 days2-7/+24
| | | | | | | | | | | | | | | | After the hellos, rejected plaintext records mustn't advance the epoch 0 replay window. The existing check runs after record processing updates that window, so a rejected record can affect a later plaintext alert. Move the check ahead of replay processing, while keeping next epoch records eligible for buffering. Extend the existing rejection test to verify that the bitmap stays unchanged before completing the handshake. Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Wed Oct 21 15:56:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33271
* Fix DTLS listener waiter cleanup in SSL_pollMounir IDRASSI4 days4-104/+860
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A blocking SSL_poll can register several objects on one DTLS listener. A single thread using DTLS can trigger this when a connection translator demultiplexes a datagram after an earlier listener item registers. Cleanup can then wait for a notification which only a later registration in the same call can clear. A finite poll timeout does not bound that cleanup wait. Overlapping polls can also wait on each other's registrations across distinct listeners. Track one registration per DTLS listener in the poll's wait context and separate deregistration from waiting for notification completion. Record the notification generation during deregistration so a later signal cannot prolong the wait for an earlier cycle. Cleanup still depends on the other registered waiters making progress. Extend the QUIC two-phase cleanup from PR #32137 to DTLS. Release every DTLS and QUIC registration before waiting for any notification cycle to finish. The QUIC translator's early deregistration remains nonblocking, so readiness rechecks and failures obey the same ordering in mixed arrays. The DTLS wait context records registrations as they are acquired, so partial setup failures and translation aborts release each exactly once. No public API changes are needed. Add coverage for shared listeners, repeated items, forced two-listener and mixed-protocol cleanup ordering, readiness rechecks, translation and allocation failures, single-thread controls, and notification generations. Use queued datagrams for the natural single-thread triggers and raise synthetic notifications only after registration. Guard cleanup and notification-generation regression tests with watchdogs. Fixes #33230 Assisted-by: Codex:gpt-6-astra Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Merge-date: Wed Oct 21 15:51:43 2026 Merged-from: https://github.com/openssl/openssl/pull/33237
* DTLS: Fix listener cleanup after failed SSL_clearRyan Hooper4 days3-43/+191
| | | | | | | | | | | | | | | | | | | | | | | | | | SSL_clear() temporarily detaches an accepted connection's listener association while replacing its DTLS state. If initialization fails, unregister the saved peer before releasing the receive queue and listener reference. Otherwise, freeing the connection leaves a stale entry in the listener's established-connection table. Build the temporary unregister key in stack storage so removal does not depend on a successful allocation during cleanup. Share the key serialization with registration and lookup, preserving the existing peer-address matching and SipHash inputs. Add allocation-failure tests for SSL_clear() on an accepted DTLS 1.2 connection. Cover both single failures and sustained allocation failure through reset cleanup. Check that detached connections are removed, while connections retaining their listener association stay registered. Fixes: #32974 Assisted-by: OpenCode:github-copilot/gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Wed Oct 21 15:41:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33270
* CMS_get0_signers() returns only the signers that passed verificationIgor Ustinov4 days4-3/+21
| | | | | | | | | | | | | | | | | | | | With CMS_VERIFY_PARTIAL, CMS_verify() succeeds as long as at least one SignerInfo verifies, but CMS_get0_signers() still returned the certificate of every SignerInfo, defeating "signed by X" or "signed by N signers" policies. The same applied to the certificates written by "openssl cms -verify -verify_partial -signer". This commit fixes CMS_get0_signers() behaviour returning only certificates of signers that passed verification. Nothing changes if CMS_VERIFY_PARTIAL isn't set. Reported-by: Anthropic OSS scan id ANT-2026-GF4OIPVH Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Wed Oct 21 15:39:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33279
* CMS_verify() stops at the first failure without CMS_VERIFY_PARTIALIgor Ustinov4 days2-4/+37
| | | | | | | | | | | | | | | | | | | | When CMS_VERIFY_PARTIAL was added, every "goto err" on a failed certificate, signed attributes, CAdES or content check was replaced by "continue", so that the remaining SignerInfos are still checked. Without the flag one failure already makes the whole call fail, yet CMS_verify() went on checking all the other signers and reading the content, which only wastes time. Goto err on the first failure unless CMS_VERIFY_PARTIAL is set again. Fixes: 5af9dbf12832 "Implement partial verification for CMS with multiple signatures" Reported-by: Anthropic's OSS Scanner, ANT-2026-D12JMUYJ Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Wed Oct 21 15:36:24 2026 Merged-from: https://github.com/openssl/openssl/pull/33283
generated by cgit (git 2.51.2) at 2026-10-25 07:51:48 +0100