aboutsummaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* s390x: Disable mod-expo offloading to a crypto card for small exponentsIngo Franzki48 hours2-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new keyword 'cex_min_bits:<bits>' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)
* Fix SSL_poll() multi-reactor cleanup deadlockMounir IDRASSI5 days3-21/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_poll() cleaned up QUIC reactor wait registrations in item-array order. Leaving a reactor can block while its notifier is signalled, so two callers spanning the same reactors could each wait on one reactor while still registered on another. The translation abort path has the same ordering problem. Split QUIC leave into two phases: deregister from every QUIC reactor, then wait for any notification cycles still pending. For QUIC-only poll sets this removes every waiter registration before any notifier wait. DTLS listener cleanup is unchanged. Guard the QUIC drain call for no-quic builds. Phase 2 also prevents an immediate re-registration from keeping the notifier signalled. Capture notify_generation during deregistration so a wait is bounded to the observed cycle. Apply the same generation bound to the combined single-reactor leave operation. Exercise real SSL_poll cleanup on two reactors in both the post-poll and translation-abort paths, including repeated items sharing a reactor. Check that a delayed phase-2 waiter completes while a later notification cycle remains signalled. Fixes #32130 Assisted-by: OpenCode:GLM-5.2 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Tue Oct 20 12:29:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32137
* DTLS listener: bound the demux free listMounir IDRASSI11 days1-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | The demux free list caches released URXEs so a receive burst can be served without allocating, but nothing bounds it: a transient flood raising the per-connection receive queues also raises the free list's retained high-water mark for the remaining lifetime of the listener. Add a per-demux limit, ossl_dgram_demux_set_max_free_urxe(), enforced in ossl_dgram_demux_release_urxe(): a URXE released while the free list is at its limit is freed instead of cached, so the bound is strict and no later trim pass is needed. Freeing there honours the documented contract that no reference may be made to a URXE or its buffer after it is released, and no release caller touches the entry afterwards. The DTLS listener sets the limit to DEMUX_MAX_FREE_URXE, two receive batches, so one full batch can always be cached; QUIC keeps the default unbounded behaviour. Resolves: https://github.com/openssl/openssl/issues/33173 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Oct 14 10:54:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33197
* DTLS listener: bound the per-connection receive queueMounir IDRASSI11 days1-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DTLS listener queues datagrams from a known peer into a per-connection list (DTLS_RX::urxe_pending) with no limit on count or bytes. A reachable peer that completes the ordinary cookie exchange can grow one parked connection's queue without bound as long as the application keeps the shared demux pumped, moving datagrams into userspace past the bound the kernel socket buffer would otherwise provide. Cap the queue at OSSL_DTLS_RX_DEFAULT_MAX_QUEUED (128) datagrams per connection - a datagram count, not a byte cap. Every queued URXE holds a buffer of at least the listener's maximum datagram size whatever the datagram's length, so a full queue costs about 295 KB per connection at the default 2000-byte size, roughly one default kernel socket receive buffer; across a full 256-connection listener budget that is about 75 MB. The queue is consumed FIFO, so on overflow the oldest datagram is evicted rather than the newest: a DTLS flight can span several datagrams, and under overload keeping the newest biases the queue toward the flight the peer just sent instead of stale fragments of an older one. The evicted URXE is unhooked under rx->mutex and released to the demux after dropping it, so demux->mutex is never taken while rx->mutex is held. References: https://github.com/openssl/openssl/issues/33173 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Oct 14 10:54:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33197
* Allow EVP_SKEY_get0_raw_key() to return only the key lengthIva Marinova2026-10-051-0/+4
| | | | | | | | | | | | | | | | | | | | There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035
* Change all files with OpenSSL License to ASL 2.0 LicenseTomas Mraz2026-10-052-2/+3
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Oct 5 09:34:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33070
* Deprecate X509_OBJECT_up_ref_count()Daniel Kubec2026-10-021-0/+3
| | | | | | | | | | | | | | | Despite its name, X509_OBJECT_up_ref_count() does not reference count the X509_OBJECT itself. With X509_OBJECT being opaque there is nothing useful an application can do with it. Assisted-by: Claude:claude-fable-5-1 Fixes #21121 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:09:09 2026 Merged-from: https://github.com/openssl/openssl/pull/32823
* Build the qlog filename with asprintfBob Beck2026-10-021-14/+0
| | | | | | | | | | | | | | | Replaces the length arithmetic and per-byte snprintf hex loop. id_len is asserted against QUIC_MAX_CONN_ID_LEN, which the wire parser already enforces. ossl_determine_dirsep was awkwardly a char, with only one caller being this function - remove it from internal/common.h and make it a static returning a string. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Oct 2 07:18:25 2026 Merged-from: https://github.com/openssl/openssl/pull/31550
* Provide ossl_asprintf() and friends.Bob Beck2026-10-021-0/+36
| | | | | | | | | | From BoringSSL Fixes: https://github.com/openssl/project/issues/1914 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Oct 2 07:18:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31550
* DTLS 1.3: Retain the previous read epoch to recover from lost ACKsRyan Hooper2026-10-021-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After processing the client's Finished or a peer KeyUpdate, the read record layer advanced to the new epoch and the old one was freed immediately. If the ACK we sent for that message was lost, the peer's retransmission arrived at the now-discarded epoch: it could not be authenticated, so no replacement ACK was ever produced and the peer exhausted its retransmission budget. RFC9147 section 5.8.1 requires the finished peer to ACK retransmissions of the other side's final flight, and section 8 requires receive keys from before a KeyUpdate to be retained until decryption with the new keys succeeds. Retain exactly one prior read epoch's record layer instead of freeing it, add a record-layer dispatch hook so the DTLS method can take ownership of it, and authenticate a record at that epoch with its own retained keys and replay window when the current epoch's epoch-bits check would otherwise just drop it. This isn't limited to replacing lost ACKs: a previous *application* epoch (from KeyUpdate recovery) can also legitimately supply application data that arrives reordered relative to the epoch change. Successful authentication with the retained keys doesn't by itself prove a record is a retransmission, so let it reach the handshake layer instead of deciding that here: the DTLS 1.2-only Finished special case (retransmit our own flight) is skipped for DTLS 1.3, and the existing out-of-sequence duplicate-ACK path is widened from post-handshake epochs only to include the epoch a Finished is sent at -- the sequence and epoch checks in that path are what actually decide whether a retained-epoch record can be acknowledged. Fixes: #32891 Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 06:36:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32963
* Add Deprecation Macros for 4.2Bob Beck2026-10-011-0/+12
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Thu Oct 1 08:21:23 2026 Merged-from: https://github.com/openssl/openssl/pull/33039
* Optimize ML-KEM for the s390x architectureTimo Keller2026-09-291-0/+40
| | | | | | | | | | | | | | | | | | | | | | The vectorization is implemented using vector extensions (of gcc/clang) and will work on any architecture with 128 bit vector registers that has suitable builtins like `vec_mulh` for the high part of a multiplication. We also optimize the multiplication in `F_{q^2}` using a twisted Karatsuba multiplication. Bob has only been used for writing the comments based on a formal verification of the code, and for the extraction of the constants at the beginning of `ml_kem_vec128.c`. Enable this for s390x. Signed-off-by: Timo Keller <[email protected]> Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:47:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31929
* Remove VXE from requirements of S390X_VX_CAPABLETimo Keller2026-09-291-3/+3
| | | | | | | | | | | Note that in all instances where we check for VX using S390X_VX_CAPABLE for s390x, we do not need VXE. Signed-off-by: Timo Keller <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:47:12 2026 Merged-from: https://github.com/openssl/openssl/pull/31929
* Fix coding style violation: do not use variable length arraysNicky Mouha2026-09-291-8/+5
| | | | | | | | | Signed-off-by: Nicky Mouha <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:40:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32967
* ec: make ossl_ec_scalar_mul_ladder() scalar padding constant timeIgor Ustinov2026-09-291-0/+1
| | | | | | | | | Fixes CVE-2026-54872 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Tue Sep 29 11:23:53 2026
* Defer computation of relative CRLDP namesViktor Dukhovni2026-09-291-0/+4
| | | | | | | | | | | These are derived just-in-time, during any actual CRL processing. Fixes CVE-2026-35189 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Tue Sep 29 11:11:18 2026
* Enforce final size for streams.Alexandr Nedvedicky2026-09-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | When FIN stream frame is received at particular offset, then the FIN's offset must be the largest offset kept in stream reassembly buffer. Receiving stream frame with offset larger than FIN frame must be reported as protocol violation and connection must be closed. In order to report protocol violation error the stream reassembly module must have a reference to QUIC_CHANNEL object where particular stream belongs to. The refernce to channel is part of QUIC_RSTREAM_QPARAM structure. This change makes stream quality parameter mandatory. Co-authored-by: Jakub Zelenka <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* Limit packet buffer overhead to ~64kB per stream.Alexandr Nedvedicky2026-09-263-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is currently no limit on how many bytes of packet buffers each stream can hold in memory. To monitor and limit the size of packet buffers used by stream the change accounts so called stream chunk overhead which is a delta between actual datagram size of packet delivering the particular stream chunk and chunk itself. As soon as the chunk overhead exceeds ~64kB for all stream chunks kept in receive buffer, the newly received chunks will be moved from packet buffer to stream buffer. The packet buffer overhead limit is held in newly introduced structure QUIC_RSTREAM_QPARAM (RX stream quality parameter). If new additional quality parameters are added, then those should be part of QUIC_RSTREAM_QPARAM structure. this changeset introduces QUIC_RSTREAM_QPARAM the the rsqp (reead stream quality parameter) enables channel to control quality of RX stream. quality currently means the packet buffer overhead. more parameters may be added later. Fixes: CVE-2026-54873 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:32 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* New implementation of stream reassembly for QUIC.Alexandr Nedvedicky2026-09-263-178/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new implementation makes clear distinction between stream chunk and stream range. The strem chunk is defined by its `start` and `end` offset with respect to offset 0 (the start of the stream). The `start` < `end`. The lenght of the stream chunk is `end - start`. The stream chunks are delivered as QUIC stream frames. The stream range is list of stream chunks which together create one continuous range of stream. The range is also deined by `start` and `end` offset. The ranges are kept in R/B tree. The chunks which are arriving in order are kept in list which forms one node of R/B tree. If newly arriving stream chunk can not be inserted to existing stream range for example because chunk.start > range.end (there is a gap between existing range and new chunk), then the new range is created and inserted to R/B tree. If the newly arriving chunk closes the gap between two existing ranges, the ranges are merged to single tree node. The join proces uses list join operation with O(1) complexity to make the new continuous range of stream chunks. In a nutshell: stream reassembly process is R/B tree look up/insert with tail/head insertion to list. There is also a preparatory work that will allow us to deal with memory hog issue. Currently the QUIC stack keeps all stream frame data on packet buffers until data is moved to application. On hone hand, this saves one copy opration between on the other hand it may cause receiver to hold lot more memory than currently needed. Consider situation where QUIC stack needs to hold reference to whole packet buffer, just because of sinle 1byte stream chunk. The 1byte stream chunk (at let's say offset 10) can not be moved to application yet, because QUIC stack is waiting for data at offset 0 - 9. Such buffer might be waiting in reassembly queue for a long time holding a reference to whole packet. To mitigate this we need to allow the QUIC stack to move data from packet buffers to stream buffers. The logic which decides when data should be moved from packet buffers is missing in this change. Here we just bring the code that supports improved buffer handling. The data for short stream frames/chunks (16B) are kept inside the stream chunk structure itself (this is referred as direct storage, or dstorage). The code coalesces data from adjacent stream frames into dstorage until it fill up. Once dstorage is full the new stream chunk is allocated and added to range. Larger stream chunks (size > 16B) get buffer from the heap. It is then linked to stream buffer. This commit just brings the quic_strm_reas.c in. It is not currently hooked to build. Fixes: CVE-2026-42772 Co-authored-by: Tomáš Mráz <[email protected]> Co-authored-by: Jakub Zelenka <[email protected]> Co-authored-by: Mounir IDRASSI <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:31 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* Re-format code after TypenameMacros and ForEachMacros additionsEugene Syromiatnikov2026-09-243-135/+135
| | | | | | | | | | | | | | | Re-formatting was done using the following command: for i in `git grep -l 'OSSL_LIST\|PRIORITY_QUEUE_OF\|SPARSE_ARRAY_OF' \ -- '*.c' '*.h' '*.c.in' '*.h.in'`; do \ clang-format-21 --style=file:.clang-format -i "$i"; \ done Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 24 09:01:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32304
* Provide metadata for symmetric keys when parsing pkcs#12 filesDmitry Belyavskiy2026-09-241-1/+2
| | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:27 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* Add support for Java keytool PKCS#12 files with symmetric secret keysDmitry Belyavskiy2026-09-242-0/+31
| | | | | | | | | | | | | | | Introduce PKCS12_PARSE_CTX opaque context for PKCS12_parse_ex(), replacing the growing parameter list pattern. Add PKCS12_decrypt_secretbag() for decrypting secret bags and PKCS12_SAFEBAG_get1_skey() for converting decrypted PKCS8 data to EVP_SKEY, following the existing private key pattern (PKCS12_decrypt_skey_ex + EVP_PKCS82PKEY_ex). Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:22 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* ML-KEM-512 hybrid TLS KEMsViktor Dukhovni2026-09-231-0/+2
| | | | | | | | | | Per the new codepoints assigned by IANA for draft-rosomakho-tls-ecdhe-mlkem512-00. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Mon Sep 21 11:52:03 2026 (Merged from https://github.com/openssl/openssl/pull/32670)
* aes-ctr-avx512: disable the VAES-512 CTR path for MSVCMadan mohan Manokar2026-09-211-0/+18
| | | | | | | | | | | | | | | | | | | | | | MSVC 14.51 builds of the VAES-512 CTR kernel return a wrong keystream for AES-192 and AES-256 whenever the block count leaves a 4-block (single-zmm) step. The default CTR-DRBG runs on AES-256-CTR, so this also corrupts random byte generation and makes unrelated tests fail. The same code is correct on VAES hardware built with gcc, so keep the hook enabled there and off for MSVC until the code generation issue is found. AES-CBC decryption is unaffected and stays enabled. Hosted runners rarely have AVX-512, so whether CI exercises this path at all depends on which host a job lands on. Run evp_extra_test under Intel SDE as well, where -icx always reports VAES. Refs #32873 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 21 09:57:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32883
* DTLS: preserve outstanding flights after incomplete ACKsMounir IDRASSI2026-09-211-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not finish reading after a DTLS 1.3 ACK while sent records remain unacknowledged. Finishing reading stops the retransmit timer and clears the entire sent queue, even for an empty or partial ACK. Restore the preceding handshake state when ACK processing continues. This preserves application-data handling and allows the expected post-handshake authentication response to follow an incomplete ACK. Limit the ACK epoch restriction to the initial handshake. Subsequent sending and receiving epochs can differ, and the old restriction produced empty ACKs for repeated unilateral KeyUpdates. Those exchanges previously depended on the receive-side coverage bug to complete. Exercise empty, nonmatching, partial and duplicate ACKs on both peers, followed by application data and complete acknowledgement. Correct two existing KeyUpdate tests which relied on unrelated ACKs clearing the sent queue. The regression fails on the parent. All 15 selected DTLS and SSL recipes pass with --strict-warnings, including the default and FIPS SSL API runs. Fixes openssl#32853 Assisted-by: Codex:gpt-6-astra Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Merge-date: Mon Sep 21 09:48:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32854
* refcount: declare Windows CRYPTO_REF_COUNT as volatile longNikola Pajkovsky2026-09-211-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | _InterlockedExchangeAdd() is prototyped as LONG _InterlockedExchangeAdd(volatile LONG *, LONG) but CRYPTO_REF_COUNT held a volatile int. The MSVC branch passed &refcnt->val straight in, which does not compile: refcount.h(189): note: 'LONG _InterlockedExchangeAdd(volatile LONG *,LONG)': cannot convert argument 1 from 'volatile int *' to 'volatile LONG *' refcount.h(189): note: Types pointed to are unrelated Declare val as volatile long in both the __ICL/_WIN32 and the _MSC_VER variants and drop the cast, so the object type matches what the intrinsic operates on. Fixes: https://github.com/openssl/openssl/issues/21080 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Merge-date: Mon Sep 21 09:35:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32754
* NUL-terminate ASN1_STRING data built inside libcryptoBob Beck2026-09-181-0/+22
| | | | | | | | | | | | | | | Add ossl_asn1_string_set1_data() and ossl_asn1_string_set1_string(), copies of the public setters that also write a NUL byte after the data, and switch all libcrypto callers to them. The ecosystem still treats ASN1_STRING data as C strings; this keeps it working while it is fixed. Removing the terminator later is a one-argument change in one function. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Sep 18 09:05:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32829
* Use SipHash for the internal fingerprintBob Beck2026-09-171-12/+34
| | | | | | | | | | | | | Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Compute X509_get_signature_info() on demand, not in the cacheBob Beck2026-09-171-2/+0
| | | | | | | | | | | | | | | The signature info was computed once by ossl_x509v3_cache_extensions() and stored in X509::siginf. Its security bits depend on a digest fetch under the certificate's libctx/propq, so the cached answer was frozen to the context the certificate was parsed in. Compute it in X509_get_signature_info() instead. The siginf field and ossl_x509_init_sig_info() are removed. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:34 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Make the cached SHA-1 fingerprint internal-onlyBob Beck2026-09-171-3/+27
| | | | | | | | | | | | | | | | | | | X509::sha1_hash exists only so X509_cmp() can compare certificates by identity, yet X509_digest() handed it to callers when asked for SHA-1, and it was computed under the certificate's libctx/propq, tying an internal value to the context the certificate was parsed in. Compute it with the built-in SHA-1 over the DER encoding instead, via the new ossl_x509_internal_fingerprint(), so it is the same in every library context; the only remaining failure mode is an allocation failure. Drop the X509_digest() shortcut so the cached value is never visible to callers, and rename the field to fingerprint in X509 and X509_CRL. The CRL side gets the same treatment in a following commit. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* aes-ctr-avx512: add VAES-512 AES-CTR encryptionMadan mohan Manokar2026-09-171-0/+9
| | | | | | | | | | | | | | | | | | | | | | | Add a VAES-512 accelerated AES-CTR encryption path built on the shared 512-bit primitives. Counter blocks are generated and encrypted 4/8/16 at a time; the low 64-bit counter word is clamped so that a 64-bit carry is handled by a scalar step before VAES resumes, and payloads below the provider threshold fall back to the existing aesni CTR path. The provider gains a CTR hook that routes eligible payloads to the VAES implementation, and aes_platform.h exposes VAES_CTR_ELIGIBLE (aliased to VAES512_ELIGIBLE) with the ossl_aes_ctr_vaes prototypes. The existing CTR known-answer vectors were all below the provider threshold that dispatches to the VAES path, so that code was never exercised. Add NIST SP800-38A 64-byte CTR KATs (AES-128/192/256) and a parametrized C test spanning 64B-5000B across all key sizes and counter-carry boundaries, validated against an independent ECB-based CTR reference. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:26:00 2026 Merged-from: https://github.com/openssl/openssl/pull/30755
* aes: factor out shared VAES-512 primitivesMadan mohan Manokar2026-09-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The VAES-512 AES implementation file will host more than one mode. Rename it to a mode-neutral name ahead of adding the AES-CTR implementation and factoring out the shared VAES-512 primitives. This commit is a pure rename with no content change. Refactor the VAES-512 CBC decryption code to sit on top of a small set of shared 512-bit primitives so that additional AES modes can reuse them: - portable compiler abstractions for ISA targeting and inlining, - OSSL_VAES512_DEFINE_ROUNDS, a macro emitting the 1x/2x/4x parallel 512-bit AES round functions for any round count and direction, - OSSL_VAES512_LOAD_ROUNDKEYS / OSSL_VAES512_CLEAR_ROUNDKEYS helpers, - ossl_vaes512_cpu_capable(), a shared runtime capability check. The generated machine code for CBC decryption is byte-identical to the previous version. aes_platform.h grows a VAES512_ELIGIBLE base guard with VAES_CBC_ELIGIBLE kept as an alias. Rename the assembly cleanup helper and perlasm module from CBC-specific names to shared aes-vaes symbols so additional modes can reuse the same stack scrub routine. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:25:59 2026 Merged-from: https://github.com/openssl/openssl/pull/30755
* Removes unused foreign member of evp_pkey_stFrederik Wedel-Heinen2026-09-161-1/+0
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Sep 16 14:34:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32820
* Add ASCON-AEAD128 cipher implementation per NIST SP 800-232evil-cry2026-09-161-0/+57
| | | | | | | | | | | | | | | | | | | | | | Integrate ASCON-AEAD128 authenticated encryption cipher into OpenSSL's default provider and libcrypto. ASCON-AEAD128 is specified in NIST SP 800-232 and provides authenticated encryption with associated data (AEAD) using a 128-bit key and 128-bit nonce. Implementation details: - Add cleanroom crypto/ascon implementation - Add provider cipher implementation following OpenSSL stream cipher patterns with generated parameter dispatch tables - Support standard AEAD operations including AAD handling, tag generation/verification, and context reinitialization Fixes: #28271 Co-authored-by: Billy Brumley <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Wed Sep 16 14:25:19 2026 Merged-from: https://github.com/openssl/openssl/pull/29934
* rand: prevent recursive seed source constructionshin41412026-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Strict on-demand seed source construction can re-enter itself when the configured RAND requests entropy or a nonce through provider upcalls. This recursively constructs the same seed source until the process exhausts its stack. Track active construction by logical execution so true recursion fails with a RAND error while independent ASYNC jobs on the same thread and library context can proceed. Keep the guard active during provider lookup, context creation, and instantiation. Add regression coverage for clean strict failure, independent and paused ASYNC jobs, non-strict error propagation, and no-err builds. Fixes #32683 Assisted-by: Codex:gpt-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 16 14:15:40 2026 Merged-from: https://github.com/openssl/openssl/pull/32685
* Dont have dgram_pairs track bios, track bio_dgram_pair_st insteadNeil Horman2026-09-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @ifanzki reported an asan issue with the quic_radix_test in: https://github.com/openssl/openssl/issues/32420 And we've tried fixing it a few different ways, with varying amounts of success This commit represents an alternative approach which I think is more general to the bio_dgram_pair bio type. The problem: We have a race condition as reported above in which freeing one side of a BIO dgram pair results in a use after free The root cause: BIO_new_bio_dgram_pair creates 2 dgram BIOS, each with a reference count of one (which is sensible, as each bio has a single owner). However, after creating the bios, it calls BIO_make_bio_pair(), which links the two together. Under the covers in the bio_dgram_pair implementation, each bio stores the pointer of its peer bio _without_ taking an additional reference on the bio. This means that, once the first bio is freed, the second bio may be doing subsequent io, which requires dereferencing of the peer bio , which is already release, leading to the use after free case observed. Nominally this isn't an issue, as most code that uses BIO_dgram_pairs are single threaded, and freeing of the component bios only occurs after any i/o is already terminated, avoiding the observed UAF. However, the QUIC radix test exercises the thread assisted mode of the quic stack, and in so doing passes each half of a bio dgram pair to a separate thread. The fix: Nominally we could resolve this by increasing the reference count on each of the peer bios, and dropping that ref count when each is freed, so that only the last to free actually deallocates both instances, but this creates a chicken and egg issue. Since the the stored reference to each bio lives in the dgram pair implementation, upping the refcount of the bios prevents either bio from ever reaching the implementation free code (dgram_pair_free) So instead I'm proposing the following in this commit: 1) Instead of having the internal bio data track the peer bio, instead have the internal data track a shared bio_dgram_peer_st structure which is reference counted 2) When creating a pair, the pair only uses the data (ring buffers, locks, etc), from the shared data, as its guaranteed to live until the last owner of the pair either frees itself BIO_free, or destroys the pair vi BIO_dgram_destroy_pair 3) If either side of the pair disconnects via the calls in (3), the shared data state is updated to reflect that, and the remaining peer triggers on that to get BROKEN_PIPE return codes Also added tests from @bukka, as they provide more coverage than the test I had in mind. Fixes #32420 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Fri Sep 11 20:50:58 2026 (Merged from https://github.com/openssl/openssl/pull/32498)
* Add public API for IPAddrBlocks (RFC 3779)herbenderbler2026-09-101-0/+1
| | | | | | | | | | | | | Fixes #18528 - Add IPAddrBlocks_new(), IPAddrBlocks_free(), d2i_IPAddrBlocks(), i2d_IPAddrBlocks(), and IPAddrBlocks_it to the public API. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Thu Sep 10 21:09:33 2026 (Merged from https://github.com/openssl/openssl/pull/30430)
* ossl_store_register_loader_int(): refactor by extracting the macro ↵Dr. David von Oheimb2026-09-101-0/+8
| | | | | | | | | | OSSL_SKIP_SCHEME() Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 10 13:32:55 2026 (Merged from https://github.com/openssl/openssl/pull/27507)
* Copyright year updatesopenssl-machine2026-09-0977-77/+77
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* ktls_send_ctrl_message(): Fix parameter name from 'lengthi' to 'length'ohhyunjun2026-09-071-1/+1
| | | | | | | | | | | | | | | | | | | In include/internal/ktls.h, the variable/parameter lengthi is used in Kernel TLS (KTLS) helper declarations and macros, whereas all related functions across the codebase consistently use length. This naming inconsistency triggers static analysis warnings (including potential CWE-467 flags regarding parameter/pointer evaluation in macro expansions) and creates confusion during maintenance. The identifier lengthi appears to be an unintended typo introduced during the original KTLS interface definition. CLA: trivial Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Sep 7 18:42:31 2026 Merged-from: https://github.com/openssl/openssl/pull/32568
* ec: accept duplicate instances of the point format parameterPauli2026-09-071-1/+1
| | | | | | | | | | | | The first value is kept. This is done for compatibility with old FIPS providers from <=4.0 branches. They export two point format parameters with different values. Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 7 18:14:55 2026 Merged-from: https://github.com/openssl/openssl/pull/32675
* Add metadata support to EVP_SKEY objectsDmitry Belyavskiy2026-09-053-0/+22
| | | | | | | | | Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Sat Sep 5 17:06:55 2026 (Merged from https://github.com/openssl/openssl/pull/32644)
* PKCS7 and SMIME: improve documentation w.r.t. untrusted and signer certificatesDr. David von Oheimb2026-09-031-0/+2
| | | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Thu Sep 3 09:26:56 2026 Merged-from: https://github.com/openssl/openssl/pull/22285
* Move SSL3_RT_MAX_PLAIN_LENGTH to prov_ssl.hPauli2026-09-032-2/+3
| | | | | | | Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Thu Sep 3 02:17:16 2026 Merged-from: https://github.com/openssl/openssl/pull/32536
* quic: collect rejected incoming streams and return their stream creditJakub Zelenka2026-09-011-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | A stream rejected by the incoming stream policy is never placed on the accept queue, so it is never retired for the purposes of MAX_STREAMS RXFC and the peer is never granted credit for another stream. After the initial limit of 100 streams has been reached, the peer cannot open any further stream for the lifetime of the connection. Such a stream is also never garbage collected. Rejecting a stream resets its send part, which frees the send stream, and the acknowledgement handler skips a chunk whose send stream is already gone before it confirms the STOP_SENDING and RESET_STREAM frames. The stream therefore never records that its STOP_SENDING was acknowledged, never becomes ready for garbage collection and remains in the stream map until the connection is torn down. Confirm both frames even when the send stream has already been freed, and retire the stream for MAX_STREAMS RXFC when it is rejected. The two changes belong together: returning the stream credit on its own would replace a leak bounded by the stream limit with an unbounded one. Assisted-by: Claude:claude-fable-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:30:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32557
* QUIC: complete SSL_listen_ex() hierarchy adoptionMounir IDRASSI2026-09-012-1/+4
| | | | | | | | | | | | | | | | | | | | | Treat domain flags as a property of the QUIC object hierarchy so explicitly configured domains remain effective for listeners, accepted connections and their streams. Keep the queued channel in place until TLS attachment is committed, configure deferred qlog state before the channel runs, install the listener message callbacks, and reset the adopted shell to accepted-connection mode, blocking and event-handling defaults. Extend the public API regression to cover explicit-domain ancestry, differing context flags and modes, callback identity, stream inheritance, and listener lifetime. Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Tue Sep 1 14:19:18 2026 Merged-from: https://github.com/openssl/openssl/pull/32491
* QUIC: fix deferred SSL_listen_ex() connection adoptionMounir IDRASSI2026-09-012-2/+5
| | | | | | | | | | | | | | | | | | | | | SSL_listen_ex() could attach a deferred incoming channel without binding its QUIC TLS layer or fully adopting the caller-provided connection into the listener hierarchy. The resulting connection could not complete its handshake and retained stale port and ownership state. Keep deferred channels idle until TLS is attached, bind the handshake layer during peeloff, reparent the connection, and drain unpeeled deferred channels during listener teardown. Make the regression test require handshake completion and stream I/O. Fixes #32490 Assisted-by: Pi:Kimi-k3 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Tue Sep 1 14:19:16 2026 Merged-from: https://github.com/openssl/openssl/pull/32491
* Generate the error headers and tables at build timeBob Beck2026-09-0169-3620/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* Generate the committed generator-output headers at build timeBob Beck2026-09-011-6709/+0
| | | | | | | | | | | | | | | | | | | | Move charmap.h, bn_prime.h, conf_def.h, obj_mac.h, obj_dat.h and obj_xref.h from committed generator output to GENERATE rules with DEPENDs on their consumers; obj_mac.h joins the mandatory generated headers built before everything else. objects.pl learns -a to append the obj_compat.h aliases itself, replacing the sed step, and obj_dat.pl reads only the guarded body of obj_mac.h so the appended aliases cannot pollute its tables. obj_mac.num remains the curated NID registry in git; the generate_crypto_objects developer target shrinks to maintaining it, generate_fuzz_oids now depends on the build-generated obj_dat.h, and the other generate_* developer targets for these files are retired. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* Deprecate CMS_stream() and PKCS7_stream()Bob Beck2026-09-012-2/+6
| | | | | | | | | | | | | These set up the indefinite length streaming used by BIO_new_NDEF(), which now obtains the content octet string through the ASN.1 callback, so they no longer return a streaming boundary and have no use outside the library. Neither has ever been documented, so there is no manual page to update. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 13:56:43 2026 Merged-from: https://github.com/openssl/openssl/pull/32242
generated by cgit (git 2.51.2) at 2026-10-25 16:12:17 +0100