Compare commits

..

31 commits

Author SHA1 Message Date
Matt Caswell
fb55383c65 Move the Handshake read secret change earlier in the process for QUIC 0-RTT
On the server side we were changing the handshake rx secret a little late.
This meant the application was forced to call SSL_do_handshake() again
even if there was nothing to read in order to get the secret. We move it
a little earlier int the process to avoid this.

Fixes the issue described in:
https://github.com/ngtcp2/ngtcp2/pull/1582#issuecomment-2735950083

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27101)

(cherry picked from commit 95051052b3)
2025-03-20 20:22:53 +01:00
Daniel Van Geest
c3d43037b4 Fix use of SHAKE as a digest in CMS
draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as
the message digest algorithm for SLH-DSA-SHAKE-* in CMS.
SHAKE doesn't have a default digest length, so this adds
a SHAKE-specific kludge in CMS.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27087)

(cherry picked from commit c1d27789e9)
2025-03-20 12:20:58 +01:00
Viktor Dukhovni
ac20f5c90c Avoid erroneous legacy code path when provided
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27075)

(cherry picked from commit 27b88364e4)
2025-03-20 11:33:43 +01:00
Ankit Kekre
195d67780e apps/cms.c, apps/ocsp.c: Added NULL pointer checks
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27059)

(cherry picked from commit 952d9b83b2)
2025-03-20 11:31:39 +01:00
Matt Caswell
6e4ddabd98 Fix the use of CCM ciphersuites with QUIC TLS API
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 207cd5bb97)
2025-03-20 11:25:01 +01:00
Matt Caswell
4c80bf56bb Add a test for using CCM ciphersuites with QUIC TLS API
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 366b2643cb)
2025-03-20 11:25:00 +01:00
Matt Caswell
688cea710d Always use NULL BIOs when using the QUIC TLS API
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 228a26fde4)
2025-03-20 11:24:59 +01:00
Matt Caswell
c25f0780a5 Test that using the QUIC TLS API does not require BIOs to be set
When using the QUIC TLS API it does not make sense to require BIOs to be
set.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 445c0942cd)
2025-03-20 11:24:58 +01:00
Matt Caswell
d8ce455a3d Ensure SSL_get_app_data() continues to work even in SSL_free()
During SSL_free() we may get a QUIC TLS callback being called to clean up
any remaining record data. We should ensure that SSL_get_app_data()
continues to work, even in this scenario.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 2100cf2ee0)
2025-03-20 11:24:57 +01:00
Matt Caswell
81789a05b7 Don't decrement the unreleased counter if we failed to release a record
In a failure situation we may incorrectly decrement the amount of data
released. Only decrement the counter if we successfully released.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 4ad45969b0)
2025-03-20 11:24:57 +01:00
Matt Caswell
a9b87830c9 Check SSL_get_app_data() from QUIC cb in a failure situation
Ensure SSL_get_app_data() works even in a failure situation from SSL_free()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit f2488a567b)
2025-03-20 11:24:56 +01:00
Matt Caswell
948c776ba7 Add a test for calling SSL_get_app_data() from QUIC TLS callbacks
Check that we get the expected app data when using the QUIC TLS callbacks.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)

(cherry picked from commit 2ebae654d5)
2025-03-20 11:24:54 +01:00
Bernd Edlinger
3e9790a255 Remove workaround for an old ppc64le compiler bug
Lowering the optimization level is no longer needed,
since the old compiler bug from ubuntu-20.04 has been
fixed meanwhile.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27033)

(cherry picked from commit c658a60aae)
2025-03-20 11:17:46 +01:00
Dmitry Misharov
2a6d875c90 correctly mark the release as prerelease
release must be marked as prerelease if "alpha" or "beta" is in tag name

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27092)

(cherry picked from commit 1bf328edf9)
2025-03-20 11:15:28 +01:00
Viktor Dukhovni
d46923327f Tolerate PKCS#8 V2 with optional public keys
- Presently any included public key is unused.
- We don't check that v1 PKCS#8 structures omit the public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27076)

(cherry picked from commit 064bb16454)
2025-03-19 12:03:02 +01:00
Jon Spillett
0615d3afc1 Use text compare for PEM and text files
- Fix ml_dsa_codecs test
- Fix ml_kem_codecs test
- Fix pkey test
- Fix dsaparam test
- Fix dhparam test
- Fix pkcs8 test

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27082)

(cherry picked from commit 58d548d84e)
2025-03-19 11:50:31 +01:00
Ingo Franzki
50debdf12c Doc fix in EVP_PKEY-ML-DSA/KEM.pod files
Fix the references to OSSL_PROVIDER_add_conf_parameter in the 'SEE ALSO'
section.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27077)

(cherry picked from commit 05c05d43bf)
2025-03-19 11:47:36 +01:00
Martin Oliveira
0639c3618c Fix gettable_params() for ECX
The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the
ed25519_get_params() and ed448_get_params(). The x25519 and x448
versions of get_params() always ignore that parameter, so it should not
be in the list of gettable params.

Fixes: 1a7328c882 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest")

cla: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27043)

(cherry picked from commit 482d3f9338)
2025-03-19 10:55:51 +01:00
ak4153
e08d6e9338 Fix missing OSSL_FUNC_DIGEST_GET_PARAMS in provider-digest.pod
Fixes #26626
CLA: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27009)

(cherry picked from commit 978e23a472)
2025-03-19 10:42:05 +01:00
sashan
4a1d897190 require GNU assembler 2.30 or higher to build aesni-xtx-avx512.pl
The peralsm in aesni-xts-avx512 currently checks for GNU assembler 2.26
or higher. According to reporters it looks like we need 2.30.

This PR just attempts fix version check so people with older
tool chains can  build OpenSSL.

Fixes #27049

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27078)

(cherry picked from commit 108079fcbb)
2025-03-19 08:07:40 +11:00
Nicola Tuveri
fd1faa0ec7 docs(provider-base): Add HISTORY note for OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS (and MAX)
This commit adds a small note about
definitions for
`OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS` and
`OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS`
being first added in OpenSSL 3.5.

PR #26975 added these definitions for OpenSSL 3.5, but the documentation
update omitted a history note for the addition.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27063)

(cherry picked from commit 2d50cb660c)
2025-03-18 18:59:26 +01:00
Bernd Edlinger
126d3209b3 Do some more cleanup in the RCU code
Only a minimum of 2 qp's are necessary: one for the readers,
and at least one that writers can wait on for retirement.
There is no need for one additional qp that is always unused.
Also only one ACQUIRE barrier is necessary in get_hold_current_qp,
so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED.
And finally clarify some comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27012)

(cherry picked from commit a532f2302d)
2025-03-18 18:52:48 +01:00
Bernd Edlinger
82f7dbbf38 Fix a memory order issue with weakly ordered systems
this adds a dummy atomic release operation to update_qp, which
should make sure that the new value of reader_idx is visible in
get_hold_current_qp, directly after incrementing the users count.

Fixes: #26875

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26964)

(cherry picked from commit 4a1a7fe5ce)
2025-03-17 08:22:57 -04:00
Neil Horman
7c9829053d Fix interop ci yaml
Somehow I mistakenly listed clients in the exlude list, when it should
have been servers, resulting in an invalid yml file

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27066)

(cherry picked from commit 5db7b99914)
2025-03-15 06:37:40 -04:00
Danny Tsen
080c6be0b1 Fix Minerva timing side-channel signal for P-384 curve on PPC
1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6()
   for Montgomery multiplication.
2. ecp_nistp384-ppc64.pl:
   - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with
     minumum perl wrapper.
   - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce.
   - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly.
3. ecp_nistp384.c:
   - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce.

Signed-off-by: Danny Tsen <dtsen@us.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26709)

(cherry picked from commit 85cabd9495)
2025-03-14 17:22:19 +01:00
Tomas Mraz
cb286b6e09 Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26976)

(cherry picked from commit c8654f79f4)
2025-03-14 17:10:17 +01:00
Andrew Dinh
3cd8141715 Fix RCU TODOs
- Update allocate_new_qp_group to take unsigned int
- Move id_ctr in rcu_lock_st for better stack alignment

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26972)

(cherry picked from commit 7097d2e00e)
2025-03-14 17:04:31 +01:00
Randall S. Becker
dbb5c73f90 Wrap use of poll.h to prevent including on NonStop.
Fixes: #26724

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26726)

(cherry picked from commit ff030ad5bd)
2025-03-14 07:49:48 -04:00
Neil Horman
97fbbc2f1f Exclude retry test with msquic server from interop
With the addition of larger ml-kem keys in our tls handshake, we've
uncovered a interop failure, as described here:
https://github.com/microsoft/msquic/issues/4905

In short, when we send a client hello that spans multiple datagrams, the
servers sends an ACK frame in a datagram prior to sending its server
hello.  msquic however, recomputes a new SCID always when sending its
sserver hello, which is fine nominally, but because in this test the
server sends a retry frame to update the SCID, followed by an ACK using
that SCID (which is an initial packet), msquic violates the RFC in
section 7.2 which states:

Once a client has received a valid Initial packet from the server, it MUST
discard any subsequent packet it receives on that connection with a
different Source Connection ID

Because msquic sent an initial packet with that ACK frame, we are
required to discard subsequent frames on the connection containing a
different SCID.

Until msquic fixes that in their implementation we are going to fail the
retry interop test, so for now, lets exclude the test.

Also, while we're at it, re-add chrome into the client list for our
server tests, as that seems to have been lost during the merge.

Fixes openssl/project#1132

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27014)

(cherry picked from commit 2fb4cfe143)
2025-03-12 10:39:06 -04:00
openssl-machine
156e0f345c Prepare for 3.5 alpha 2
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
2025-03-12 13:37:29 +00:00
openssl-machine
8fabfd8109 Prepare for release of 3.5 alpha 1
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
2025-03-12 13:37:20 +00:00
3 changed files with 2 additions and 10 deletions

View file

@ -28,10 +28,6 @@ OpenSSL Releases
OpenSSL 3.5
-----------
### Changes between 3.5 and 3.6 [xx XXX xxxx]
* none yet
### Changes between 3.4 and 3.5 [xx XXX xxxx]
* Added server side support for QUIC

View file

@ -23,10 +23,6 @@ OpenSSL Releases
OpenSSL 3.5
-----------
### Major changes between OpenSSL 3.5 and OpenSSL 3.6 [under development]
* none
### Major changes between OpenSSL 3.4 and OpenSSL 3.5 [under development]
OpenSSL 3.5.0 is a feature release adding significant new functionality to

View file

@ -1,7 +1,7 @@
MAJOR=3
MINOR=6
MINOR=5
PATCH=0
PRE_RELEASE_TAG=dev
PRE_RELEASE_TAG=alpha2-dev
BUILD_METADATA=
RELEASE_DATE=""
SHLIB_VERSION=3