aboutsummaryrefslogtreecommitdiffstats
path: root/demos
Commit message (Collapse)AuthorAgeFilesLines
* EVP_MD_demo.c, tls13secretstest.c: avoid signed-to-unsigned integer conversionJan Schaumann2026-10-091-2/+4
| | | | | | | | | | | | | | | | | | Should EVP_MD_size() return -1, the size_t len variable would wrap, causing any subsequent error checks to not trigger. Change to type int (which is what EVP_MD_size() returns). While this is just in test/demo code, that's the kind of code that people might copy and reuse elsewhere, and that AI vuln scanners trigger on, so might as well try to eliminate that noise. Fixes: 7a7fbeb924a0 "fix all the warnings in our demos and make them enableable" Fixes: 134bfe56c4fe "Add a test for the TLS1.3 secret generation" Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 19:19:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31222
* dtls: honour SSL_OP_COOKIE_EXCHANGE for DTLS 1.3Jakub Zelenka2026-10-061-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Setting SSL_OP_COOKIE_EXCHANGE on a server connection only ever produced a HelloVerifyRequest, so once the peer negotiated DTLS 1.3 the option was silently ignored and the client was accepted without any address validation. The HelloRetryRequest cookie code was gated purely on the internal stateless flag, which only SSL_stateless() and the DTLS listener set, leaving no way for an application driving its own per-peer SSL objects with SSL_accept() to get a cookie exchange. Treat the option as "a cookie is required" for DTLS 1.3 as well. A ClientHello without a valid cookie is answered with a HelloRetryRequest carrying one, and the handshake continues only once it is echoed back. The stateless cookie callbacks are used for the application part of the cookie, falling back to the HelloVerifyRequest callbacks so existing servers written for DTLS 1.2 keep working unchanged. A client that repeats its ClientHello after the HelloRetryRequest and still presents no valid cookie now gets an illegal_parameter alert rather than tripping an internal error. The listener is unaffected since it sets both the flag and the option. s_server always sets the option for DTLS, so teach the TLSProxy handshake checker that every DTLS handshake now starts with a cookie round trip. Add a test covering the 1.2 and 1.3 paths, the callback fallback, the missing-callback failure and the PSK-only resumption, and make the dtlsecho demo server validate its peer this way. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 14:46:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33093
* Bring recent comments into line with the STYLE.md comment rulesBob Beck2026-10-022-6/+6
| | | | | | | | | | | | | | | | Comments added by AI-assisted commits over the last three months often narrate the change rather than describe the code: the behaviour being replaced, the alternative not taken, or the bug the test was written for. STYLE.md now says that a comment states what the code does and the constraint it satisfies, and that the reasoning behind a change does not belong in one. Reword those comments to that standard. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Fri Oct 2 08:06:12 2026 Merged-from: https://github.com/openssl/openssl/pull/32779
* Re-format code after TypenameMacros and ForEachMacros additionsEugene Syromiatnikov2026-09-241-8/+5
| | | | | | | | | | | | | | | Re-formatting was done using the following command: for i in `git grep -l 'OSSL_LIST\|PRIORITY_QUEUE_OF\|SPARSE_ARRAY_OF' \ -- '*.c' '*.h' '*.c.in' '*.h.in'`; do \ clang-format-21 --style=file:.clang-format -i "$i"; \ done Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 24 09:01:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32304
* Copyright year updatesopenssl-machine2026-09-0917-17/+17
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* dtls: BIO_snprintf() to snprintf() in the DTLS echo demosJakub Zelenka2026-08-262-4/+4
| | | | | | | | | | | | | | The BIO_snprintf() deprecation series was not rebased over the DTLS demos before merging, which breaks no-deprecated builds with an implicit-function-declaration error. Convert the port formatting calls to snprintf() as done for the other callers in that series. Assisted-by: Claude:claude-fable-5 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Wed Aug 26 22:21:52 2026 (Merged from https://github.com/openssl/openssl/pull/32533)
* DTLS SSL Listener default address validationRyan Hooper2026-08-251-2/+5
| | | | | | | | | | | | | | | | | | | Replace SSL_LISTENER_FLAG_REQUIRE_HVR and SSL_LISTENER_FLAG_REQUIRE_HRR with a single SSL_LISTENER_FLAG_ADDRESS_VALIDATION, and make address validation the default. A DTLS listener now validates (HVR for DTLS 1.0/1.2, HRR cookie for DTLS 1.3) unless SSL_LISTENER_FLAG_NO_VALIDATE is set. If both NO_VALIDATE and ADDRESS_VALIDATION are given, the listener fails safe and validates. Update the tests, the dtlslistenerecho demo, util/other.syms and the listener documentation to match. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Thu Aug 20 09:50:39 2026 Merged-from: https://github.com/openssl/openssl/pull/31983
* DTLS 1.3 Set the listener demo to non-blocking modeRyan Hooper2026-08-252-0/+16
| | | | | | | | | | | | | | | | | | A DTLS listener, and the connections it accepts, now default to blocking mode. The dtlslistenerecho demo drives the listener and its connections with SSL_poll() and uses SSL_ACCEPT_CONNECTION_NO_BLOCK, so call SSL_set_blocking_mode() on the listener to put it back into non-blocking mode. The accepted connections inherit that mode. Also update the DTLS 1.3 guide (ossl-guide-dtlsv13) to mention SSL_set_blocking_mode() and SSL_get_blocking_mode() for DTLS listeners and to note that a listener is blocking by default. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Thu Aug 20 09:50:38 2026 Merged-from: https://github.com/openssl/openssl/pull/31983
* DTLS 1.3 SSL Listener DemoRyan Hooper2026-08-257-41/+1333
| | | | | | | | | | | | | | | | | | Demo utilizing the SSL Listener for DTLS. It runs in multiple threads that will echo what a client sends. Currently up to 10 clients can make a connection. A client can close the connection by sending kill. If a client sends killall the server will close all the connections and free up all the resources being used. Fixes: openssl/project#1957 Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Thu Aug 20 09:50:36 2026 Merged-from: https://github.com/openssl/openssl/pull/31983
* DTLS 1.3 Fix CI failuresRyan Hooper2026-08-252-22/+29
| | | | | | | | | | Need to fix a deprecated API in dtlsecho. Also updated the sslecho usage information since it is no longer correct. Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 16 07:29:15 2026 (Merged from https://github.com/openssl/openssl/pull/31935)
* DTLS 1.3 Demo and Bug FixRyan Hooper2026-08-257-0/+530
| | | | | | | | | | | | | | | | | | Added a DTLS 1.3 demo based off of the SSL echo demo. The client takes input from the user and sends it to the server. The server echos that input back. There was a bug if the server retransmitted New Session tickets cause it didn't receive the ACK for the first set of New Session tickets. The changes outside of the demo application are to fix that bug. Fixes: openssl/project#1943 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed May 27 08:02:57 2026 (Merged from https://github.com/openssl/openssl/pull/31042)
* Remove remaining atoi()/atol() callsMounir IDRASSI2026-07-292-2/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the remaining direct atoi()/atol() uses across apps, libcrypto, libssl, providers, demos and tests, and route the replacements through checked helpers instead of open-coding the conversion at each call site: - apps use the existing opt_int()/opt_long()/opt_int_arg() parsers; - libcrypto and provider code use the new internal ossl_strtol()/ ossl_strtoint() helpers, a checked (and, for ossl_strtoint(), narrowing) signed counterpart to the public OPENSSL_strtoul(); - libssl, demos and tests use OPENSSL_strtoul(); the test code shares a single test_strtoint() helper rather than repeating the bound check and cast per file; - unsigned values use OPENSSL_strtoul(), with call-site-specific range checks before narrowing where the destination type requires it. Reject conversion failures and narrow through the helpers rather than acting on garbage, and preserve the signed RSA-PSS saltlen sentinels while rejecting invalid numeric strings. Add regression coverage for the invalid RSA-PSS saltlen string path. Fixes #8216 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 29 17:02:18 2026 (Merged from https://github.com/openssl/openssl/pull/31731)
* demos: wire up echechoEugene Syromiatnikov2026-07-202-0/+10
| | | | | | | | | | | Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Reported-by: Frederik Wedel-Heinen <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:19:04 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: apply Windows-specific changesEugene Syromiatnikov2026-07-201-26/+44
| | | | | | | | | | | | Similar to the ones present in demos/sslecho/main.c. Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:19:03 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: check return values of SSL_* callsEugene Syromiatnikov2026-07-201-3/+15
| | | | | | | | | | | | | As otherwise it triggers -Werror=unused-result when built with --strict-warnings. Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:19:01 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: use SSL_set1_ipaddr() instead of SSL_set1_host()Eugene Syromiatnikov2026-07-201-1/+1
| | | | | | | | | | | | | As the latter was deprecated in commit f584ae959cbc "Let's support multiple names for certificate verification". Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:19:00 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: declare locally used functions as staticEugene Syromiatnikov2026-07-201-5/+5
| | | | | | | | | | | | | Otherwise it triggers -Werror=missing-prototypes when built with --strict-warnings. Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:59 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: use <stdbool.h>Eugene Syromiatnikov2026-07-201-4/+1
| | | | | | | | | | | | ...instead of defining it (incorrectly). Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:58 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/sslecho/echecho.c: reflow overly long linesEugene Syromiatnikov2026-07-201-10/+19
| | | | | | | | | | Complements: 50580382caca "Documents initial agreed APIs for Encrypted Client Hello (ECH) and includes a minimal demo for some of those APIs." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:57 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos: add PKCS#12 reading and writing demos to the primary build systemEugene Syromiatnikov2026-07-202-1/+17
| | | | | | | | | | | | | | | For some reason, demos in the pkcs12 directory were omitted during the initial conversion done in commit 2000281dad31 "Convert demos to primary build system". Rescind this omission. Complements: 2000281dad31 "Convert demos to primary build system" Reported-by: Frederik Wedel-Heinen <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:55 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/pkcs12/pkwrite.c: drop deprecated init callsEugene Syromiatnikov2026-07-201-2/+0
| | | | | | | | | Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:54 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/README.txt: mention quic-server-block.c and quic-server-non-block.cEugene Syromiatnikov2026-07-201-0/+2
| | | | | | | | | | | Complements: dad45ea769dc "Adds a new demo blocking QUIC server for use with the existing demo QUIC clients" Complements: d9d4d84ceb01 "Add demo QUIC non-blocking server" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:53 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos: wire up tls-server-blockEugene Syromiatnikov2026-07-202-0/+6
| | | | | | | | | | | | | | | | | | | The blocking TLS server demo code was added f4b4a185b546 "MVP demo TLS server", which, while was applied after 2000281dad31 "Convert demos to primary build system", was authored before, and hasn't been updated accordingly. Rescind that omission by add the relevant introes to build.info. Also, while at it, mention tls-server-block in demos/README.txt. Complements: f4b4a185b546 "MVP demo TLS server" Reported-by: Frederik Wedel-Heinen <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:52 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* demos/guide/tls-server-block.c: check results of __owur API callsEugene Syromiatnikov2026-07-201-2/+9
| | | | | | | | | | | | | | Check results of SSL_CTX_set_session_id_context() and SSL_CTX_set_timeout() calls, as these functions are marked with __owur, leading to compilation error when compiled with -Werror=unused-result. Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 11:18:51 2026 (Merged from https://github.com/openssl/openssl/pull/31751)
* Remove parentheses around return argumentsDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | | | | Since return is an operator and not a function, parentheses are not required. Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:13 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Eliminate/fix repeated word usageDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:11 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* demo: fix fips-version Makefile so it loads the FIPS provider correctlyPauli2026-07-011-2/+5
| | | | | | | | Fixes #31760 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/31762)
* demo: add program that shows how to query the FIPS provider versionPauli2026-06-296-1/+106
| | | | | | Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> (Merged from https://github.com/openssl/openssl/pull/31654)
* demos/http3: fix missing NUL terminator on h3ssl->urlShmael132026-06-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | In the HTTP/3 demo server's :path handler, when the path value does not begin with '/', the value is copied into the fixed-size url[MAXURL] buffer with memcpy(h3ssl->url, vvalue.base, len) and no terminator is written. len is capped at MAXURL, so a :path value of MAXURL or more bytes fills the entire buffer, overwriting the zeroes from the preceding memset and leaving url without a NUL terminator. The buffer is later used as a C string by strcat() and strcmp() when building the file name, resulting in a heap out-of-bounds read and a possible overflow of the filename[PATH_MAX] buffer. This is reachable from a client-supplied :path header. Cap the length at MAXURL - 1 so that the trailing byte zeroed by the memset always remains, guaranteeing url is NUL-terminated in every branch. The '/'-prefixed branches are unaffected as they already write an explicit terminator within the smaller bound. Fixes #31516 Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Sun Jun 21 16:19:08 2026 (Merged from https://github.com/openssl/openssl/pull/31520)
* Use %zu for printing size_t valuesAndrew Dinh2026-06-152-8/+8
| | | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Mon Jun 15 19:24:43 2026 (Merged from https://github.com/openssl/openssl/pull/31454)
* Fix broken hex data by reformattingNorbert Pocs2026-06-037-2529/+260
| | | | | | | | | | | | | | | | The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jun 3 07:46:14 2026 (Merged from https://github.com/openssl/openssl/pull/31350)
* demos/guide: switch clients to HTTP/1.1Eugene Adell2026-05-037-20/+20
| | | | | | | | | | | The Host Header comes with HTTP/1.1, not 1.0, and some Web Server now doesn't want to answer to such requests. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Sun May 3 15:21:35 2026 (Merged from https://github.com/openssl/openssl/pull/30981)
* Use INVALID_SOCKET in SSLEcho demoMilan Broz2026-04-301-8/+9
| | | | | | | | | | | | | | | | On Windows, SOCKET type is unsigned. All comparison with negative value produces signed/unsigned warnings, moreover the code is incorrect in error path. Use INVALID_SOCKET define that should work on all platforms to detect error. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Apr 30 11:42:31 2026 (Merged from https://github.com/openssl/openssl/pull/30941)
* Remove unused warnx from QUIC demosMilan Broz2026-04-303-28/+0
| | | | | | | | | | It only produces missing prototype warnings. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Apr 30 11:42:30 2026 (Merged from https://github.com/openssl/openssl/pull/30941)
* Remove redefined progname from QUIC demosMilan Broz2026-04-301-2/+0
| | | | | | | | | | The global progname is already defined above. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Apr 30 11:42:28 2026 (Merged from https://github.com/openssl/openssl/pull/30941)
* Update manuals and demos to consider OSSL_PARAM_clear_free() vs ↵Emmalee Carpenter2026-04-031-2/+2
| | | | | | | | | OSSL_PARAM_free() Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Fri Apr 3 15:14:25 2026 (Merged from https://github.com/openssl/openssl/pull/30506)
* Copyright year updatesopenssl-machine2026-03-1011-11/+11
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* Let's support multiple names for certificate verificationBob Beck2026-02-248-8/+8
| | | | | | | | | | | | | | | | | | | This adds the functionality to VERIFY_PARAM to separately add multiple ip's and email addresses for verification purposes. We then mark the unfortunate SSL_add1_host API which unfortunately aquired a confusing "maybe add an IP address" behaviour as deprecated. We replace this with SSL_set1_<dnsname, email, ip, ip_asc> and SSL_add1_<dnsname, email, ip, ip_asc> to set the things in the SSL corresponding to the VERIFY_PARAM funcitons. Fixes: https://github.com/openssl/openssl/issues/28418 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> MergeDate: Tue Feb 24 14:03:42 2026 (Merged from https://github.com/openssl/openssl/pull/29612)
* ECH external APIssftcd2026-02-201-1/+1
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25663)
* ECH build artefacts and a bit of codeStephen Farrell2026-02-202-1/+48
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25193)
* Documents initial agreed APIs for Encrypted Client Hello (ECH)Stephen Farrell2026-02-201-0/+406
| | | | | | | | | and includes a minimal demo for some of those APIs. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24738)
* Make X509_ATTRIBUTE accessor functions const-correctkovan2026-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The X509_ATTRIBUTE accessor functions were not const-correct, preventing callers from usefully interacting with a const X509_ATTRIBUTE pointer. Update the following functions to accept const X509_ATTRIBUTE * and return const pointers where appropriate: - X509_ATTRIBUTE_get0_object: returns const ASN1_OBJECT * - X509_ATTRIBUTE_get0_type: returns const ASN1_TYPE * - X509_ATTRIBUTE_get0_data: returns const void * Also update dependent PKCS12 functions: - PKCS12_get_attr_gen: returns const ASN1_TYPE * - PKCS12_get_attr: returns const ASN1_TYPE * (deprecated) - PKCS8_get_attr: returns const ASN1_TYPE * Update all callers to use const pointers for the return values. Fixes #29811 Co-Authored-By: Claude Opus 4.5 <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tim Hudson <[email protected]> MergeDate: Fri Feb 13 14:46:26 2026 (Merged from https://github.com/openssl/openssl/pull/29813)
* Update ossl-http3-demo to support multiple requestsNeil Horman2026-02-062-53/+173
| | | | | | | | | | | | | | | | | | | | | In order to use our http3 demo to do interop testing, said demo needs to be able to handle multiple requests and responses written to specific output files. Add that code here, allowing us to specify optionally a list of requests on the command line to send to the server, as well as a download directory, so that requests made get written locally to the same name as the request in the specified download directory. while we're at it, also clean up the code infrastructure to use SSL_poll to do read-ready checking, rather than iterating/mutating the internal hash table, which is questionable to do (i.e. we shouldn't be removing elements from the hash table while iterating over it). Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Feb 6 12:46:24 2026 (Merged from https://github.com/openssl/openssl/pull/29922)
* demos/bio/sconnect.c: Add check for BIO_new()Jiasheng Jiang2025-12-281-0/+8
| | | | | | | | | | | | Add check for the return value of BIO_new() to guarantee the success. Fixes: 0f113f3ee4 ("Run util/openssl-format-source -v -c .") Signed-off-by: Jiasheng Jiang <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27919)
* 4.0-POST-CLANG-FORMAT-WEBKIT4.0-POST-CLANG-FORMAT-WEBKITBob Beck2025-12-0970-1078/+3427
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29242)
* clang deprecates sprintf on macosNikola Pajkovsky2025-10-211-3/+3
| | | | | | | | | | | | | | test/threadstest.c:1376:9: error: 'sprintf' is deprecated. The same issues is in the ossl-nghttp3-demo. Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28903)
* Make eyeballs happy again for ossl-nghttp3-demoAlexandr Nedvedicky2025-10-144-86/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | Adjust the http3 demo client so it works better on dual stack hosts. This fixes the case when DNS returns both IPv4 and IPv6 addresses for host we try to reach. The current code just uses the first address found in DNS answer. If things are unfortunate and the service (port number) demo client tries to reach does not listen on the address then demo gives up and exits. Demo can do better. The RFC 6555 suggests application should try to reach the service on the next address returned by DNS, when the first attempt fails for the first address returned by DNS. This change helps with situation when DNS prefers, let' say, IPv6 address, but the service is reachable via IPv4 only. In that case application sees the failure on the first attempt to connect to remote server over IPv6, but the second attempt that uses IPv4 is going to succeed. This extra handling is required for QUIC which uses UDP protocol. For TLS client which uses TCP all this happens inside BIO layer which tries to establish TCP connection. There is no TCP-handshake on UDP protocol so BIO can not see the service is not reachable on requested address. Fixes: #28331 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28802)
* Add util/codespell-check.sh and run itBob Beck2025-09-261-2/+2
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28639)
* demos/certs: properly handle "$@"Eugene Syromiatnikov2025-09-033-4/+4
| | | | | | | | | | | | | | | There is little reason $@ should be used unquoted; also, "$@" should be used instead of $* in order to pass the script arguments to a function. Fixes: bcd92754d56a "demos: fix cert scripts" Fixes: 79b184fb4b65 "Extend certificate creation examples to include CRL generation and sample" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28405)
* Copyright year updatesopenssl-machine2025-09-0226-26/+26
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Release: yes
generated by cgit (git 2.51.2) at 2026-10-25 13:21:21 +0100