aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
...
* test/run_tests.pl: avoid quadratic time on long test outputMounir IDRASSI2026-10-061-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With failure buffering enabled, the ALL callback appends nonempty output lines that it does not recognize as plans or test results to $output_buffer. Without an explicit return, that branch returns the accumulated buffer. TAP::Base::_make_callback() invokes callbacks in list context, even when TAP::Parser calls it in void context, so the buffer is copied. Each append then costs time proportional to the output accumulated so far, making processing quadratic for a growing sequence of such lines. run_tests.pl merges recipe stderr into the stream it reads. While the harness copies, a command writing enough stderr can fill that pipe and block. On Linux, with command stderr restored to this stream and the radix recipe from before #32395, test_quic_radix took 9.9 seconds without the fix and 2.3 seconds with it. Setting glibc's mmap threshold to a fixed 128 KiB increased the former to 85 seconds, while the fixed run took 2.3 seconds. The command blocked writing stderr while the harness kept a CPU busy, reproducing the signature reported in #32128. These measurements do not establish the cause of the historical OpenBSD and macOS stalls. Return no values from the callback; the parser does not use its result. V=1 disables failure buffering and avoids this accumulation path. Assisted-by: Claude Code:claude-opus-5-5 Assisted-by: Codex:gpt-6-astra Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 16:04:01 2026 Merged-from: https://github.com/openssl/openssl/pull/33078
* dtls: honour SSL_OP_COOKIE_EXCHANGE for DTLS 1.3Jakub Zelenka2026-10-064-2/+157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Setting SSL_OP_COOKIE_EXCHANGE on a server connection only ever produced a HelloVerifyRequest, so once the peer negotiated DTLS 1.3 the option was silently ignored and the client was accepted without any address validation. The HelloRetryRequest cookie code was gated purely on the internal stateless flag, which only SSL_stateless() and the DTLS listener set, leaving no way for an application driving its own per-peer SSL objects with SSL_accept() to get a cookie exchange. Treat the option as "a cookie is required" for DTLS 1.3 as well. A ClientHello without a valid cookie is answered with a HelloRetryRequest carrying one, and the handshake continues only once it is echoed back. The stateless cookie callbacks are used for the application part of the cookie, falling back to the HelloVerifyRequest callbacks so existing servers written for DTLS 1.2 keep working unchanged. A client that repeats its ClientHello after the HelloRetryRequest and still presents no valid cookie now gets an illegal_parameter alert rather than tripping an internal error. The listener is unaffected since it sets both the flag and the option. s_server always sets the option for DTLS, so teach the TLSProxy handshake checker that every DTLS handshake now starts with a cookie round trip. Add a test covering the 1.2 and 1.3 paths, the callback fallback, the missing-callback failure and the PSK-only resumption, and make the dtlsecho demo server validate its peer this way. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 14:46:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33093
* apps: set cookie callbacks on s_server SNI contextJakub Zelenka2026-10-061-1/+22
| | | | | | | | | | | | | | | | | | s_server only installed the DTLS and stateless cookie callbacks on its main SSL_CTX. When -servername matched, the connection was switched to the second context before the cookie was generated, so a DTLS 1.2 client sending that name failed the handshake with a cookie generation callback failure instead of getting a HelloVerifyRequest. Install the callbacks on the SNI context as well and cover the case with a (D)TLSv1.2 server name handshake in the TLSProxy message test. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 14:46:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33093
* test_cipher_reinit(): Reinit is not supported with CCM on old providersTomas Mraz2026-10-061-3/+9
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Tue Oct 6 08:58:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33114
* Allow EVP_SKEY_get0_raw_key() to return only the key lengthIva Marinova2026-10-051-0/+72
| | | | | | | | | | | | | | | | | | | | There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035
* Add pairwise AEAD tag retrieval testBilly Brumley2026-10-051-0/+79
| | | | | | | | | | | Read the tag from an AEAD encrypt context via both the ctrl and params interfaces and check they agree. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:24:04 2026 Merged-from: https://github.com/openssl/openssl/pull/32885
* Allow the CCM tag to be fetched more than once after AEAD encryptionBilly Brumley2026-10-051-18/+12
| | | | | | | | | | | | | Reading the tag out of a CCM context currently resets the context, so a second fetch of the same tag failed. The reset now happens when the encryption completes rather than when the tag is read, so the tag remains available, matching the other AEAD modes. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:24:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32885
* Fix flaky check_pc_flood testAndrew Dinh2026-10-051-1/+6
| | | | | | | | | | | | The 16 injected PATH_CHALLENGE frames are coalesced into a single packet, so under loss/PTO the sender can retransmit it, making the receiver observe more than 16 raw PATH_CHALLENGE frames. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:48 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Port script_69Andrew Dinh2026-10-052-68/+19
| | | | | | | | Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:47 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Port script_68Andrew Dinh2026-10-053-57/+186
| | | | | | | | Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:47 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Port script_67Andrew Dinh2026-10-052-59/+18
| | | | | | | | Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Port script_66Andrew Dinh2026-10-052-18/+55
| | | | | | | | Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:45 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Port script_65Andrew Dinh2026-10-052-53/+49
| | | | | | | | Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Mon Oct 5 10:18:44 2026 Merged-from: https://github.com/openssl/openssl/pull/32786
* Limit proxy pathlen to 0..255Bob Beck2026-10-052-0/+85
| | | | | | | | | | | Treat an out-of-range pcPathLengthConstraint as invalid, as already done for basicConstraints. X509_set_proxy_pathlen() now rejects out-of-range values, failing closed to 0. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Mon Oct 5 10:17:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32471
* Limit certificate path length to a reasonable value.Bob Beck2026-10-052-0/+222
| | | | | | | | | | | | | | | | In theory, this can be the limit of an ASN1 integer, in practice that's utterly silly, as setting no limit already means it is unlimited, and large chains are already ridiculously expensive. While a practical limit likely never to be seen might be 64, There seems to be precedent in other places (Chromium and others) to limit this to the range of 0-255. Let's do that. Nothing non-synthetic will ever hit this. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Mon Oct 5 10:17:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32471
* Change all files with OpenSSL License to ASL 2.0 LicenseTomas Mraz2026-10-051-2/+2
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Oct 5 09:34:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33070
* add provider load_unload / doall testNeil Horman2026-10-051-0/+88
| | | | | | | | | | Add a test to torture loading/unloading of a provider while we run parallel calls to OSSL_DECODER_do_all Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Oct 5 09:31:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33056
* Add NCONF_load_bio() mfail testGreensi72026-10-021-0/+27
| | | | | | | | | | Test loading duplicate fields in NCONF_load_bio() overwrites the original value with the duplicate. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Fri Oct 2 08:45:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32792
* Enforce the supported_groups/key_share pairing in TLS 1.3 ClientHellosPaul Grubbs2026-10-021-4/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 8446, section 9.2, lists the requirements a ClientHello that offers TLS 1.3 must meet, including: If containing a "supported_groups" extension, it MUST also contain a "key_share" extension, and vice versa. An empty KeyShare.client_shares vector is permitted. Servers receiving a ClientHello which does not conform to the requirements in this section MUST abort the handshake with a "missing_extension" alert. The server only enforced half of this: tls_parse_ctos_key_share() rejects a key_share without supported_groups (except when resuming with the psk_dhe_ke mode not offered, where it returns early), but nothing checked the other direction. A PSK resumption ClientHello that carries supported_groups and psk_key_exchange_modes = {psk_ke, psk_dhe_ke} but no key_share was therefore accepted, and resumed with psk_ke, whenever the server allows non-DHE PSK key exchange (SSL_OP_ALLOW_NO_DHE_KEX). Check both directions at the start of the server branch of final_key_share(), which runs for every TLS 1.3 ClientHello (including the one following a HelloRetryRequest) after all extensions have been parsed, using the extension presence recorded in the pre-processed ClientHello like final_psk() already does for psk_key_exchange_modes. A ClientHello with neither extension is still accepted, as permitted for a PSK-only ClientHello. The rule in section 4.2.9 that a client offering psk_dhe_ke supply a key_share is deliberately not enforced here since that text is about the mode the server selects rather than a well-formedness requirement. Add two cases to 70-test_tls13kexmodes.t: a resumption ClientHello with both kex modes and supported_groups but no key_share must now fail with a missing_extension alert, and one with psk_ke only and neither extension must still resume. Fixes #25124 Assisted-by: Claude:claude-fable-5 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:40:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32529
* srtpkdf: avoid NULL dereference in size queriesmzfr2026-10-021-0/+32
| | | | | | | | | | | | | Return an error when the cipher has not been configured instead of passing NULL to EVP_CIPHER_get_key_length(). Add regression coverage for fresh, configured, and reset contexts. Fixes #32945 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 08:12:15 2026 Merged-from: https://github.com/openssl/openssl/pull/32959
* Bring recent comments into line with the STYLE.md comment rulesBob Beck2026-10-0214-290/+117
| | | | | | | | | | | | | | | | Comments added by AI-assisted commits over the last three months often narrate the change rather than describe the code: the behaviour being replaced, the alternative not taken, or the bug the test was written for. STYLE.md now says that a comment states what the code does and the constraint it satisfies, and that the reasoning behind a change does not belong in one. Reword those comments to that standard. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Fri Oct 2 08:06:12 2026 Merged-from: https://github.com/openssl/openssl/pull/32779
* Add an mfail test for rsa_multiprime_keygen()ndossche2026-10-021-0/+29
| | | | | | | | | | Sampled rather than exhaustive because a single key generation performs a few thousand allocations. Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 08:02:55 2026 Merged-from: https://github.com/openssl/openssl/pull/32739
* Provide ossl_asprintf() and friends.Bob Beck2026-10-023-1/+115
| | | | | | | | | | From BoringSSL Fixes: https://github.com/openssl/project/issues/1914 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Oct 2 07:18:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31550
* Add AVX2 base64 decoder for EVP_DecodeUpdate/EVP_DecodeBlockkrk2026-10-023-1/+1277
| | | | | | | | | Fixes #29739 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Fri Oct 2 07:13:32 2026 Merged-from: https://github.com/openssl/openssl/pull/30115
* DTLS 1.3: Retain the previous read epoch to recover from lost ACKsRyan Hooper2026-10-022-0/+873
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After processing the client's Finished or a peer KeyUpdate, the read record layer advanced to the new epoch and the old one was freed immediately. If the ACK we sent for that message was lost, the peer's retransmission arrived at the now-discarded epoch: it could not be authenticated, so no replacement ACK was ever produced and the peer exhausted its retransmission budget. RFC9147 section 5.8.1 requires the finished peer to ACK retransmissions of the other side's final flight, and section 8 requires receive keys from before a KeyUpdate to be retained until decryption with the new keys succeeds. Retain exactly one prior read epoch's record layer instead of freeing it, add a record-layer dispatch hook so the DTLS method can take ownership of it, and authenticate a record at that epoch with its own retained keys and replay window when the current epoch's epoch-bits check would otherwise just drop it. This isn't limited to replacing lost ACKs: a previous *application* epoch (from KeyUpdate recovery) can also legitimately supply application data that arrives reordered relative to the epoch change. Successful authentication with the retained keys doesn't by itself prove a record is a retransmission, so let it reach the handshake layer instead of deciding that here: the DTLS 1.2-only Finished special case (retransmit our own flight) is skipped for DTLS 1.3, and the existing out-of-sequence duplicate-ACK path is widened from post-handshake epochs only to include the epoch a Finished is sent at -- the sequence and epoch checks in that path are what actually decide whether a retained-epoch record can be acknowledged. Fixes: #32891 Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 06:36:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32963
* Increase BIO_dgram_pair ring buffer size on AIX for quic testsNeil Horman2026-10-011-1/+11
| | | | | | | | | | | | | | | | | | | | | | AIX has a unique definition of struct sockaddr_un (AF_UNIX addresses). Whereas most unixes define the structure to have a sun_path field of 108 bytes, AIX defines sun_path to be an array of 1023 bytes. Because BIO_dgram_pairs use two BIO_ADDR's (which are a union containing sockaddr_un) to define a pseudo UDP header, any dgram pair with a fixed ring buffer size is likely to be unable to transmit a complete frame if the ring buffer is sized with less than sizeof(BIO_ADDR)*2 + 1200 bytes allocated on AIX. Fix it by increasing the ring buffer size for such tests Fixes #32506 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Thu Oct 1 19:13:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32838
* check that AEADs reject Update after FinalBilly Brumley2026-10-011-0/+92
| | | | | | | | | | | | | Once Final has run, feeding more data to the same context must fail in both directions. This was only checked for a handful of ciphers in evp_extra_test.c; run it against every AEAD exposed by the lib. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Thu Oct 1 19:07:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32875
* test AEAD cipher parameters against the providerBilly Brumley2026-10-011-23/+93
| | | | | | | | | | | | Add a test that checks the EVP accessors for key length, IV length, mode and tag length agree with the provider's own parameters, and use the values to drive the other tests. Covers all AEAD ciphers. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Thu Oct 1 14:56:41 2026 Merged-from: https://github.com/openssl/openssl/pull/32833
* DTLS 1.3: Track sent message ACKs by byte range across retransmitsRyan Hooper2026-10-011-3/+732
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dtls1_retransmit_message() cleared a message's record numbers right before resending it, keeping only the most recent transmission round's numbers. If the ACK for an earlier round's copy of that record arrived after a retransmission had already happened, it no longer matched anything: the message never retired and its retransmit timer kept running, even though the peer already had it. rfc9147 section 7.2 requires treating a record as acknowledged if it appears in any ACK, and a message can need more than one record per round (a fragmented NewSessionTicket), so matching by record identity alone is not enough either: acking one fragment of one round must not retire a message the peer is still missing other fragments of. Track each sent record's byte range alongside its record number, and stop clearing that list on retransmit so it accumulates across every round instead of only the most recent one. dtls_process_ack() marks the matched range covered in a bitmask mirrored from the receive-side reassembly code, and once a message's full range is covered, drains every remaining record number for it, regardless of which round produced them or whether they were ever individually matched. Fixes: #32975 Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Oct 1 14:18:19 2026 Merged-from: https://github.com/openssl/openssl/pull/32996
* BIO: make Windows datagram socket timeouts retryableMounir IDRASSI2026-10-011-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | BIO_dgram_recv_timedout already expects WSAETIMEDOUT on Windows, but dgram_read only saves errors accepted by BIO_dgram_non_fatal_error. The missing case leaves the read retry flag clear and prevents the timeout query from reporting the error. Since ebb188f0, a fatal record read without an alert also puts the connection into the error state, preventing DTLS from handling its retransmission timer after a socket timeout. Accept WSAETIMEDOUT as retryable, matching the existing EAGAIN case. Datagram writes use the same classifier, so send timeouts become retryable too. Add a socket test for timeout reporting and successful reads afterwards. Fixes #32979 Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Thu Oct 1 08:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/32999
* test: Check return value of SSL_CONNECTION_FROM_SSLNorbert Pocs2026-10-011-0/+3
| | | | | | | | | | | | | This might return NULL and would cause dereference issue later. Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1701001 Complements: bfa50e13f857 "statem: test tls_construct_client_key_exchange" Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Merge-date: Thu Oct 1 08:09:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32737
* apps: cover the ecparam no_seed option in the test recipeJakub Zelenka2026-09-302-2/+53
| | | | | | | | | | | | | | Strip the seed from the secp384r1-explicit.pem reference parameters with -no_seed and check that the output is smaller, no longer prints a seed in text form and matches a new checked-in reference file. Also check that generating explicit parameters by curve name with -no_seed produces the same encoding, covering the generated parameters code path, and that the option leaves named curve parameters unchanged. Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 12:52:57 2026 Merged-from: https://github.com/openssl/openssl/pull/32598
* GCM: reject out-of-order update callsBilly Brumley2026-09-302-128/+95
| | | | | | | | | | | | | | | | For GCM, AAD must precede the payload. The lib was already rejecting late AAD, but this allows distinguishing the error PROV_R_UPDATE_CALL_OUT_OF_ORDER from the generic error PROV_R_CIPHER_OPERATION_FAILED. Follow-up to #31906 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Wed Sep 30 12:10:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32011
* Accept multi-digit version components in the qlog verifierGeorgy Karataev2026-09-301-1/+1
| | | | | | | Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 10:01:42 2026 Merged-from: https://github.com/openssl/openssl/pull/33050
* DTLS: Expose dtls_listener_cookie_hmac() and add a regression testRyan Hooper2026-09-301-0/+56
| | | | | | | | | | | | | | | | | | Drop static from dtls_listener_cookie_hmac() and declare it in ssl_local.h, alongside its sibling listener cookie callbacks, so it can be exercised directly from test/dtlsssllistenertest.c. Add test_dtls_listener_cookie_hmac_long_addr(), which sets a DTLS1.3 server connection's peer_addr to an AF_UNIX address with a sun_path longer than 64 bytes. dtls_listener_cookie_hmac() currently sizes its address scratch buffers with a hardcoded 64 instead of sizeof(BIO_ADDR), so BIO_ADDR_rawaddress() overflows those stack buffers for such a peer. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 08:23:10 2026 Merged-from: https://github.com/openssl/openssl/pull/32982
* Bound DTLS 1.3 ACK bookkeeping and fit ACKs to recordsMounir IDRASSI2026-09-301-0/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Repeated fragments of an incomplete handshake message can arrive in fresh records without making reassembly progress. Each record adds an ACK entry and scans all previous entries, allowing unbounded storage and quadratic work. Limit the list to 1023 record numbers, the capacity of a maximum-sized plaintext ACK, and check this limit before the duplicate scan. Even a bounded list may exceed the current MTU or configured fragment limit. dtls1_do_write() currently splits the encoded ACK vector without updating its length prefix, so a valid fragmented ticket can cause the peer to abort with SSL_R_LENGTH_TOO_LONG when it reads the ACK. Send complete ACK vectors containing whole 16-byte record numbers within the existing output limits. Reuse two already-sent bytes for each next vector's length prefix, preserving progress across write retries. Report each emitted ACK through the message callback. All retained record numbers are sent, without requiring a state-machine change. Add regressions for repeated fragments while reassembly stays incomplete, and completed ticket exchanges at a small MTU, under a configured fragment limit, and with a write retry between ACK records. The growth test fails on the original code; all three output cases also fail with only the storage cap applied. Validation: 12 DTLS and bad-DTLS test recipes, strict warning compilation of both changed files, and clang-format checks. Additional local diagnostics verified padding, per-record callbacks, and retransmission recovery after ACK-list saturation and completion of a valid ticket. Fixes #32957 Assisted-by: Codex:gpt-6-astra Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 08:19:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32958
* Reset only verify_result across all CMS SignerInfos on failureSergio C.C.2026-09-301-0/+438
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #32612. CMS_verify() fails with CMS_R_SIGNER_CERTIFICATE_NOT_FOUND when a signer certificate can't be found for one of several SignerInfos, and in that case 'scount' ends up smaller than the total number of SignerInfos. The err: cleanup loop only reset verify_result for the first 'scount' SignerInfos, so the trailing ones -- never reached by the per-signer verification loops -- kept the verify_result = 1 ("so far, fine") value set by the initialization loop earlier in the function, and were reported as verified even though their certificates were never looked at. Fixed by iterating the reset over all SignerInfos instead of just the first 'scount'. CMS_verify() can also fail before any per-signer verification is attempted, when check_content() fails on a CMS_ContentInfo that a previous call already fully verified: in that case verify_result, cert_verified, attr_verified and content_verified all still hold that earlier call's genuine results and must be cleared in full. That reset already happens separately, at the top of the function. During review the err: cleanup loop was changed to also clear cert_verified/attr_verified/content_verified for every SignerInfo whenever the overall result was 0, to address the same kind of staleness for the early-exit path above. That was too broad: those three fields are per-signer facts established during the current call, and clearing them for every signer whenever CMS_verify()'s overall result is 0 makes one signer's certificate/attribute/content result depend on whether other signers, or the all-vs-partial policy, also succeeded. With CMS_VERIFY_PARTIAL and two independently trusted signers, breaking the first signer's signature while the second still verifies correctly must not disturb the second signer's fields; if the second signer's signature is also later broken, so the whole call now fails, both signers' cert_verified must still reflect that their certificates genuinely re-verified during that call. The err: loop now resets only verify_result. Adds test_CMS_verify_result_partial_independence, covering exactly that scenario, alongside the test_CMS_verify_result_no_signer_cert, test_CMS_verify_result_partial_signer_cert and test_CMS_verify_reused_after_check_content_failure regression tests added earlier during review. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 30 08:15:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32643
* use proper loop index when building new cid in packetNeil Horman2026-09-291-1/+1
| | | | | | | | | | | | | | | | | | | commit 596baa5b032dc4bc3f89f97f4b57ae63c56d5f93 added a test that builds a series of packets with connection ids in them, using the index i for the outer packet loop, and index j for the inner WPACKET_memcpy_u8 loop to copy the cid into the packet. However the i index was used to index the cid id array, and so after 8 packets (the length of a connection id), we started indexing off the end of the array, which triggered an msan issue in CI. Use the proper loop index j for the copy loop of the cid. Fixes openssl/project#2066 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Tue Sep 29 20:39:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33040
* Migrate test_evp_oneshot_aead_zerolen to new evp_aead_test.cTrust-Worthy2026-09-294-255/+394
| | | | | | | | | | | | | | | | | Introduces evp_aead_test.c, modeled on evp_xof_test.c, with a dynamically-populated aead_list (mirroring cipher_list in evp_extra_test.c) scoped to AEAD ciphers only. Unlike cipher_list, EVP_CIPH_SIV_MODE is not excluded here. Migrates test_evp_oneshot_aead_zerolen and its prepare_ccm_no_payload helper out of evp_extra_test.c as the first test in an incremental, one-test-per-PR migration. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Tue Sep 29 18:45:50 2026 Merged-from: https://github.com/openssl/openssl/pull/32803
* Dealing with symmetric keys in pkcs12 command-line utilityDmitry Belyavskiy2026-09-291-1/+207
| | | | | | | | | | This is a follow-up to #30937 Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Tue Sep 29 18:34:13 2026 (Merged from https://github.com/openssl/openssl/pull/32978)
* Fix NULL dereference in SSL_get0_group_name() before a handshakeAlberto Maschietto2026-09-291-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_get0_group_name() falls back to sc->session->kex_group whenever the connection is not a TLSv1.3 one that has already done a key exchange. On a connection that has not started (or completed) a handshake yet, sc->session is still NULL, so the fallback crashes instead of returning NULL as the manual page promises. This is the same problem that was fixed for SSL_get_negotiated_group() in commit 4ca80d3941, and the fix here mirrors it: only consult the session when there is one, and report "no group" otherwise. It affects TLS, DTLS and QUIC connections, and every branch since the accessor was added in 3.2. The RETURN VALUES section said a NULL return meant an error occurred. That is not accurate: NULL simply means no group is available, which is the normal answer before a handshake or after one that used no key agreement group. Reword it accordingly. Add a regression test that calls both group accessors on a fresh SSL object. Without the fix it segfaults; with it, SSL_get0_group_name() returns NULL and SSL_get_negotiated_group() returns NID_undef. Fixes #32379 Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 17:04:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32437
* Add scalar/vector NTT comparison test for ML-DSATimo Keller2026-09-292-0/+70
| | | | | | | | | | | | | Add a test that compares the results of the ML-DSA scalar and the s390x vectorized NTT for 2^16 random input values. Compile it if the vectorized s390x function is compiled and run it if VX is enabled. Signed-off-by: Timo Keller <[email protected]> Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:47:14 2026 Merged-from: https://github.com/openssl/openssl/pull/31929
* test: normalize PEM line endings in ecparam comparisonsMounir IDRASSI2026-09-291-13/+21
| | | | | | | | | | | | | | | | | PEM output uses text mode on Windows and has CRLF line endings. The ecparam app recipe compares five generated PEM files with source fixtures using a binary comparison, which fails when the fixtures use LF. Extract the existing newline normalization into compare_pem() and use it for those comparisons. Keep the binary comparison that checks whether rewriting a generated file changes its bytes. Fixes: #32977 Assisted-by: Codex:gpt-6-astra Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Tue Sep 29 16:42:07 2026 Merged-from: https://github.com/openssl/openssl/pull/32980
* Fix TLS 1.3 ticket age decoding when the offset wrapsMounir IDRASSI2026-09-291-0/+122
| | | | | | | | | | | | | | | | | | | | | | | Subtract the ticket age offset modulo 2^32 before converting to OSSL_TIME. Saturating subtraction turns a wrapped age into zero, which can reject valid early data or let an incorrect age pass the freshness check. Restore modular ticket age subtraction lost in f0131dc04a when libssl moved to OSSL_TIME. This regression first shipped in 3.2.0; 3.0 and 3.1 retain modular subtraction and are not affected. Add TLS and DTLS tests with controlled ages and offsets, checking acceptance and rejection with both stateful and stateless tickets. After rejecting early data, verify that both peers complete session resumption and can exchange ordinary application data. Fixes: https://github.com/openssl/openssl/issues/32834 Assisted-by: Codex:gpt-6-astra Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:38:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32889
* test: add unit test for the buffering BIOJakub Zelenka2026-09-292-0/+1173
| | | | | | | | | | | | | | | Test BIO_f_buffer through a fake next BIO whose callbacks are cmocka mocks, covering the partial-write and retry handling on flush, the direct read/write paths for oversized requests, the ctrl operations, and the datagram peer recording and sendmmsg-based flushing used by DTLS listener connections. Wrapping the address allocation functions additionally covers the peer recording failure branches. Assisted-by: Claude:claude-fable-5 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:36:57 2026 Merged-from: https://github.com/openssl/openssl/pull/32642
* Fix DTLS listener reset racesmzfr2026-09-293-6/+293
| | | | | | | | | | | | | | | | | | | | | Keep listener drive guards and the RX queue alias in SSL_CONNECTION so concurrent listener threads do not access resettable DTLS state during SSL_clear(). Check stable state before d1 and clear the RX alias before freeing its queue. Add focused multithreaded coverage for both SSL_clear() paths and run the race tests in ThreadSanitizer CI. Incorporates changes from #32962. Fixes #32948 Fixes #32949 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Merge-date: Tue Sep 29 16:24:45 2026 Merged-from: https://github.com/openssl/openssl/pull/32964
* Add a test to check for quic unvalidated creditNeil Horman2026-09-291-0/+342
| | | | | | | | | | | Adds a test to ensure that, when sending a coalesced frame that should drive more than the available unvalidated credit that a server has, we stop sending when we reach that limit. Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Tue Sep 29 11:52:15 2026
* CVE-2026-84784 QUIC: unbounded RETIRE_CONNECTION_ID backlog (memory DoS)Alexandr Nedvedicky2026-09-291-0/+78
| | | | | | | | | | | | connection must fail when remote peer attempts to retire more than 10 connection IDs. The point is to send more than 10 NEW_CONNECTION_ID frames. Each frame is retiring earlier connection id. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 11:30:44 2026
* Add regression tests for the SSL_set_SSL_CTX() sigalg stateMatt Caswell2026-09-291-0/+416
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix for CVE-2026-72897 made SSL_set_SSL_CTX() refresh the connection's signature algorithm state so that it describes the context being installed. Cover it. That state is sized from the SSL_CTX SSL_new() was called on, and a provider sigalg's sig_idx is its position in the list of whichever SSL_CTX a peer codepoint is resolved against, so the two have to describe the same context. The test provider makes them differ: a context created before it is loaded lacks the two slots it adds, and one created afterwards has them. Three routes an application can switch context from are covered, and they do not behave alike. test_sigalg_ctx_switch() switches from the servername and client_hello callbacks, both of which run before tls1_set_server_sigalgs() allocates valid_flags. A stale slot count undersized that allocation, and tls1_process_sigalgs() then read and wrote past its end. The two callbacks run at different points - the client_hello callback before the ClientHello extensions are parsed at all, the servername callback from the final pass over them - so they are checked separately. The extra provider sigalgs are TLSv1.3 only, so only those cases reached past the end of the buffer; the TLSv1.2 cases pin the invariant. test_sigalg_ctx_switch_cert_cb() switches from the certificate callback, which runs after valid_flags has been sized and filled in. Nothing recomputes the shared sigalgs later in the same handshake, so nothing read out of bounds on that route, but the state left behind was inconsistent. It also checks the built-in slots survive the switch, which is the only coverage of that part of the change. test_sigalg_ctx_switch_reneg() switches during a TLSv1.2 renegotiation with a changed servername. valid_flags is allocated by the initial handshake and not freed in between, so this is the case where the buffer has to be replaced rather than merely sized correctly later. Each test checks the premise it depends on rather than risk becoming vacuous: that the replacement context really does have more slots, that the renegotiation really was a full handshake, and that the flags being compared across the switch were non-zero to begin with. Assisted-by: Claude Code:claude-opus-5[1m] Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Tue Sep 29 11:20:19 2026
* dtls: reset init_off before retransmitting a messageRyan Hooper2026-09-291-0/+677
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dtls1_retransmit_message() copies a queued message's saved bytes into s->init_buf and sets s->init_num to its length, but left s->init_off untouched. If a different message was still mid-write (suspended on WANT_WRITE, e.g. because the underlying BIO couldn't take any more) when a retransmit fired, s->init_off would still hold whatever offset that suspended write had reached - and dtls1_do_write() would resume the retransmitted message from that stale, unrelated offset instead of from the start. The result is a corrupted retransmission: the message goes out mislabelled with a bogus fragment offset/length, and its body is whatever bytes happen to sit at that offset in the now-repurposed init_buf - typically leftover content from the other, larger message that was mid-write when the retransmit happened, rather than the message actually meant to be sent. Fix this by always resetting s->init_off to 0 before resending, so every retransmit starts from the beginning of the message being sent, regardless of what any other in-progress write had left behind. dtls1_handle_timeout() also needs a guard: if write_state is anything other than WRITE_STATE_TRANSITION, a write is still parked mid-flight from a previous call into the state machine, so there is nothing valid to retransmit yet. Retransmitting anyway would reconstruct an already-sent message from the retransmit queue into s->init_buf/s->init_off/s->init_num/s->d1->w_msg - the same fields the parked write is still using - corrupting that write's state out from under it. Skip retransmission in that case and let the next SSL_read()/SSL_write()/SSL_accept()/SSL_connect() call resume the parked write normally instead. Add test_dtls_client_retransmit() and test_dtls_server_retransmit() to test/dtlstest.c, covering both directions on DTLS1.2: use a fragment-limiting BIO to suspend a large in-flight write mid-fragment, then fire the retransmit timer several times via DTLSv1_get_timeout()/DTLSv1_handle_timeout() while it stays parked, verifying no retransmission is attempted and the suspended write's state is reproduced unchanged on every timer fire, and that resuming the write afterward completes as an ordinary handshake continuation instead of hitting dtls1_do_write()'s entry assertion. Also add test_dtls_client_retransmit_dtls13() and test_dtls_server_retransmit_dtls13() covering the same guard under DTLS1.3. Both rely on the same write-call-count invariant rather than a byte-for-byte comparison, since only the plaintext portion of the flight (ClientHello on the client side, ServerHello on the server side) is exchanged at epoch zero - everything sent under a non-zero epoch is encrypted and legitimately differs on every retransmit regardless of this fix. Assited-by: Claude:claude-sonnet-5 Fixes: CVE-2026-84782 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 11:17:20 2026
generated by cgit (git 2.51.2) at 2026-10-25 12:52:02 +0100