public/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: public:openssl-3.4.1
Branches Tags
public:master
public:openssl-3.5
public:openssl-3.0
public:openssl-3.2
public:openssl-3.3
public:openssl-3.4
public:feature/dtls-1.3
public:openssl-3.1
public:feature/evp_skey
public:feature/hss
public:feature/ech
public:feature/acert-cli
public:OpenSSL_1_1_1-stable
public:OpenSSL_1_0_2-stable
public:OpenSSL_1_1_0-stable
public:OpenSSL-fips-2_0-stable
public:OpenSSL-fips-2_0-dev
public:tls1.3-draft-18
public:tls1.3-draft-19
public:OpenSSL_1_0_1-stable
public:OpenSSL_1_0_0-stable
public:OpenSSL_0_9_8-stable
public:OpenSSL-fips-1_2-stable
public:OpenSSL-fips-0_9_8-stable
public:OpenSSL_0_9_7-stable
public:OpenSSL_0_9_8fg-stable
public:OpenSSL-fips2-0_9_7-stable
public:OpenSSL_0_9_6-stable
public:OpenSSL-engine-0_9_6-stable
public:OpenSSL-fips-0_9_7-stable
public:SSLeay
public:openssl-3.5.0-alpha1
public:openssl-3.0.16
public:openssl-3.1.8
public:openssl-3.2.4
public:openssl-3.3.3
public:openssl-3.4.1
public:openssl-3.4.0
public:openssl-3.4.0-beta1
public:openssl-3.4.0-alpha1
public:openssl-3.0.15
public:openssl-3.1.7
public:openssl-3.2.3
public:openssl-3.3.2
public:openssl-3.0.14
public:openssl-3.1.6
public:openssl-3.2.2
public:openssl-3.3.1
public:openssl-3.3.0
public:openssl-3.3.0-beta1
public:openssl-3.3.0-alpha1
public:openssl-3.0.13
public:openssl-3.1.5
public:openssl-3.2.1
public:openssl-3.2.0
public:openssl-3.2.0-beta1
public:openssl-3.0.12
public:openssl-3.1.4
public:openssl-3.2.0-alpha2
public:openssl-3.0.11
public:openssl-3.1.3
public:OpenSSL_1_1_1w
public:openssl-3.2.0-alpha1
public:OpenSSL_1_1_1v
public:openssl-3.0.10
public:openssl-3.1.2
public:OpenSSL_1_1_1u
public:openssl-3.0.9
public:openssl-3.1.1
public:openssl-3.1.0
public:openssl-3.0.8
public:OpenSSL_1_1_1t
public:openssl-3.1.0-beta1
public:openssl-3.1.0-alpha1
public:openssl-3.0.7
public:OpenSSL_1_1_1s
public:OpenSSL_1_1_1r
public:openssl-3.0.6
public:OpenSSL_1_1_1q
public:openssl-3.0.5
public:OpenSSL_1_1_1p
public:openssl-3.0.4
public:OpenSSL_1_1_1o
public:openssl-3.0.3
public:OpenSSL_1_1_1n
public:openssl-3.0.2
public:openssl-3.0.1
public:OpenSSL_1_1_1m
public:openssl-3.0.0
public:OpenSSL_1_1_1l
public:openssl-3.0.0-beta2
public:openssl-3.0.0-beta1
public:openssl-3.0.0-alpha17
public:openssl-3.0.0-alpha16
public:openssl-3.0.0-alpha15
public:openssl-3.0.0-alpha14
public:OpenSSL_1_1_1k
public:openssl-3.0.0-alpha13
public:openssl-3.0.0-alpha12
public:OpenSSL_1_1_1j
public:openssl-3.0.0-alpha11
public:openssl-3.0.0-alpha10
public:OpenSSL_1_1_1i
public:openssl-3.0.0-alpha9
public:openssl-3.0.0-alpha8
public:openssl-3.0.0-alpha7
public:OpenSSL_1_1_1h
public:openssl-3.0.0-alpha6
public:openssl-3.0.0-alpha5
public:openssl-3.0.0-alpha4
public:openssl-3.0.0-alpha3
public:openssl-3.0.0-alpha2
public:openssl-3.0.0-alpha1
public:OpenSSL_1_1_1g
public:OpenSSL_1_1_1f
public:OpenSSL_1_1_1e
public:OpenSSL_1_0_2u
public:OpenSSL_1_0_2t
public:OpenSSL_1_1_0l
public:OpenSSL_1_1_1d
public:OpenSSL_1_1_1c
public:OpenSSL_1_1_0k
public:OpenSSL_1_0_2s
public:OpenSSL_1_0_2r
public:OpenSSL_1_1_1b
public:OpenSSL_1_0_2q
public:OpenSSL_1_1_0j
public:OpenSSL_1_1_1a
public:OpenSSL_1_1_1
public:OpenSSL_1_1_1-pre9
public:OpenSSL_1_0_2p
public:OpenSSL_1_1_0i
public:OpenSSL_1_1_1-pre8
public:OpenSSL_1_1_1-pre7
public:OpenSSL_1_1_1-pre6
public:OpenSSL_1_1_1-pre5
public:OpenSSL_1_1_1-pre4
public:OpenSSL_1_0_2o
public:OpenSSL_1_1_0h
public:OpenSSL_1_1_1-pre3
public:OpenSSL_1_1_1-pre2
public:OpenSSL_1_1_1-pre1
public:OpenSSL_1_0_2n
public:OpenSSL_1_0_2m
public:OpenSSL_1_1_0g
public:OpenSSL-fips-2_0_16
public:OpenSSL-fips-2_0_15
public:OpenSSL_1_0_2l
public:OpenSSL_1_1_0f
public:OpenSSL-fips-2_0_14
public:OpenSSL_1_1_0e
public:OpenSSL_1_0_2k
public:OpenSSL_1_1_0d
public:OpenSSL-fips-2_0_13
public:OpenSSL_1_1_0c
public:OpenSSL_1_0_2j
public:OpenSSL_1_1_0b
public:OpenSSL_1_0_1u
public:OpenSSL_1_0_2i
public:OpenSSL_1_1_0a
public:OpenSSL_1_1_0
public:OpenSSL_1_1_0-pre6
public:OpenSSL_1_0_1t
public:OpenSSL_1_0_2h
public:OpenSSL_1_1_0-pre5
public:OpenSSL_1_1_0-pre4
public:OpenSSL_1_0_1s
public:OpenSSL_1_0_2g
public:OpenSSL_1_1_0-pre3
public:OpenSSL-fips-2_0_12
public:OpenSSL-fips-2_0_11
public:OpenSSL-fips-2_0_10
public:OpenSSL_1_0_1r
public:OpenSSL_1_0_2f
public:OpenSSL_1_1_0-pre2
public:OpenSSL_1_1_0-pre1
public:OpenSSL_0_9_8zh
public:OpenSSL_1_0_0t
public:OpenSSL_1_0_1q
public:OpenSSL_1_0_2e
public:OpenSSL_1_0_1p
public:OpenSSL_1_0_2d
public:OpenSSL_1_0_1o
public:OpenSSL_1_0_2c
public:OpenSSL_0_9_8zg
public:OpenSSL_1_0_0s
public:OpenSSL_1_0_1n
public:OpenSSL_1_0_2b
public:OpenSSL-fips-2_0_9
public:OpenSSL_0_9_8zf
public:OpenSSL_1_0_0r
public:OpenSSL_1_0_1m
public:OpenSSL_1_0_2a
public:OpenSSL_0_9_8-pre-reformat
public:OpenSSL_0_9_8-pre-auto-reformat
public:OpenSSL_0_9_8-post-auto-reformat
public:OpenSSL_0_9_8-post-reformat
public:OpenSSL_1_0_0-pre-reformat
public:OpenSSL_1_0_0-pre-auto-reformat
public:OpenSSL_1_0_0-post-auto-reformat
public:OpenSSL_1_0_0-post-reformat
public:OpenSSL_1_0_1-pre-reformat
public:OpenSSL_1_0_1-pre-auto-reformat
public:OpenSSL_1_0_1-post-auto-reformat
public:OpenSSL_1_0_1-post-reformat
public:OpenSSL_1_0_2-pre-reformat
public:OpenSSL_1_0_2-pre-auto-reformat
public:OpenSSL_1_0_2-post-auto-reformat
public:OpenSSL_1_0_2-post-reformat
public:master-pre-reformat
public:master-pre-auto-reformat
public:master-post-auto-reformat
public:master-post-reformat
public:OpenSSL_1_0_2
public:OpenSSL_0_9_8ze
public:OpenSSL_1_0_0q
public:OpenSSL_1_0_1l
public:OpenSSL_0_9_8zd
public:OpenSSL_1_0_0p
public:OpenSSL_1_0_1k
public:OpenSSL-fips-2_0_8
public:OpenSSL_1_0_1j
public:OpenSSL_1_0_0o
public:OpenSSL_0_9_8zc
public:OpenSSL_1_0_2-beta3
public:OpenSSL_0_9_8zb
public:OpenSSL_1_0_0n
public:OpenSSL_1_0_1i
public:OpenSSL_1_0_2-beta2
public:OpenSSL-fips-2_0_7
public:OpenSSL_1_0_1h
public:OpenSSL_1_0_0m
public:OpenSSL_0_9_8za
public:OpenSSL-fips-2_0_6
public:OpenSSL_1_0_1g
public:OpenSSL_1_0_2-beta1
public:OpenSSL_1_0_0l
public:OpenSSL_1_0_1f
public:OpenSSL-fips-2_0_4
public:OpenSSL-fips-2_0_5
public:OpenSSL-fips-2_0_3
public:OpenSSL-fips-2_0_2
public:OpenSSL_1_0_1e
public:OpenSSL_1_0_0k
public:OpenSSL_1_0_1d
public:OpenSSL_0_9_8y
public:OpenSSL-fips-2_0-pl1
public:OpenSSL-fips-2_0_1
public:OpenSSL_1_0_1c
public:OpenSSL_1_0_0j
public:OpenSSL_0_9_8x
public:OpenSSL_1_0_1b
public:OpenSSL_0_9_8w
public:OpenSSL_1_0_1a
public:OpenSSL_0_9_8v
public:OpenSSL_1_0_0i
public:OpenSSL_1_0_1
public:OpenSSL_1_0_0h
public:OpenSSL_0_9_8u
public:OpenSSL_1_0_1-beta3
public:OpenSSL_1_0_1-beta2
public:OpenSSL-fips-2_0-rc9
public:OpenSSL-fips-2_0
public:OpenSSL_1_0_0g
public:OpenSSL_0_9_8t
public:OpenSSL_0_9_8s
public:OpenSSL_1_0_0f
public:OpenSSL-fips-2_0-rc8
public:OpenSSL_1_0_1-beta1
public:OpenSSL-fips-2_0-rc7
public:OpenSSL-fips-2_0-rc6
public:OpenSSL-fips-2_0-rc5
public:OpenSSL-fips-2_0-rc4
public:OpenSSL-fips-2_0-rc3
public:OpenSSL-fips-2_0-rc2
public:OpenSSL-fips-2_0-rc1
public:OpenSSL-fips-1_2_3
public:OpenSSL-fips-1_2_2
public:OpenSSL-fips-1_2_1
public:OpenSSL_1_0_0e
public:OpenSSL_1_0_0d
public:OpenSSL_0_9_8r
public:OpenSSL_0_9_8q
public:OpenSSL_1_0_0c
public:OpenSSL_0_9_8p
public:OpenSSL_1_0_0b
public:OpenSSL_0_9_8o
public:OpenSSL_1_0_0a
public:OpenSSL_1_0_0
public:OpenSSL_0_9_8n
public:OpenSSL_0_9_8m
public:OpenSSL_0_9_8m-beta1
public:OpenSSL_1_0_0-beta5
public:OpenSSL_1_0_0-beta4
public:OpenSSL_0_9_8l
public:OpenSSL_1_0_0-beta3
public:OpenSSL_1_0_0-beta2
public:OpenSSL_1_0_0-beta1
public:OpenSSL_0_9_8k
public:OpenSSL_0_9_8j
public:OpenSSL_0_9_8i
public:OpenSSL_0_9_8h
public:OpenSSL_0_9_8g
public:OpenSSL_0_9_8f
public:OpenSSL-fips-1_2_0
public:FIPS_098_TEST_8
public:FIPS_098_TEST_7
public:FIPS_098_TEST_6
public:FIPS_098_TEST_5
public:FIPS_098_TEST_4
public:FIPS_098_TEST_3
public:FIPS_098_TEST_2
public:FIPS_098_TEST_1
public:OpenSSL_0_9_7m
public:OpenSSL_0_9_8e
public:OpenSSL_0_9_7l
public:OpenSSL_0_9_8d
public:OpenSSL_0_9_8c
public:OpenSSL_0_9_7k
public:OpenSSL_0_9_7j
public:OpenSSL_0_9_8b
public:OpenSSL_FIPS_1_0
public:OpenSSL_0_9_7i
public:OpenSSL_0_9_8a
public:OpenSSL_0_9_7h
public:OpenSSL_0_9_8
public:FIPS_TEST_10
public:OpenSSL_0_9_8-beta6
public:OpenSSL_0_9_8-beta5
public:FIPS_TEST_9
public:OpenSSL_0_9_8-beta4
public:OpenSSL_0_9_8-beta3
public:BEN_FIPS_TEST_8
public:OpenSSL_0_9_8-beta2
public:OpenSSL_0_9_8-beta1
public:OpenSSL_0_9_7g
public:OpenSSL_0_9_7f
public:BEN_FIPS_TEST_7
public:BEN_FIPS_TEST_6
public:OpenSSL_0_9_7e
public:OpenSSL_0_9_7d
public:OpenSSL-engine-0_9_6m
public:OpenSSL_0_9_6m
public:LEVITTE_after_const
public:LEVITTE_before_const
public:BEN_FIPS_TEST_5
public:BEN_FIPS_TEST_4
public:OpenSSL-engine-0_9_6l
public:OpenSSL_0_9_6l
public:BEN_FIPS_TEST_3
public:BEN_FIPS_TEST_2
public:BEN_FIPS_TEST_1
public:OpenSSL-engine-0_9_6k
public:OpenSSL_0_9_6k
public:OpenSSL_0_9_7c
public:OpenSSL-engine-0_9_6j
public:OpenSSL_0_9_7b
public:OpenSSL_0_9_6j
public:OpenSSL-engine-0_9_6i
public:OpenSSL_0_9_6i
public:OpenSSL_0_9_7a
public:OpenSSL_0_9_7
public:OpenSSL_0_9_7-beta6
public:STATE_after_zlib
public:STATE_before_zlib
public:OpenSSL_0_9_7-beta5
public:OpenSSL-engine-0_9_6h
public:OpenSSL_0_9_6h
public:OpenSSL_0_9_7-beta4
public:OpenSSL-engine-0_9_6g
public:OpenSSL_0_9_6g
public:OpenSSL-engine-0_9_6f
public:OpenSSL_0_9_6f
public:OpenSSL_0_9_7-beta3
public:OpenSSL-engine-0_9_6e
public:OpenSSL_0_9_6e
public:OpenSSL_0_9_7-beta2
public:OpenSSL_0_9_7-beta1
public:AFTER_COMPAQ_PATCH
public:BEFORE_COMPAQ_PATCH
public:OpenSSL-engine-0_9_6d
public:OpenSSL_0_9_6d
public:OpenSSL-engine-0_9_6d-beta1
public:OpenSSL_0_9_6d-beta1
public:OpenSSL-engine-0_9_6c
public:OpenSSL_0_9_6c
public:OpenSSL-engine-0_9_6b
public:OpenSSL_0_9_6b
public:OpenSSL_0_9_6a
public:OpenSSL-engine-0_9_6a
public:OpenSSL-engine-0_9_6a-beta3
public:OpenSSL_0_9_6a-beta3
public:OpenSSL-engine-0_9_6a-beta2
public:OpenSSL_0_9_6a-beta2
public:OpenSSL-engine-0_9_6a-beta1
public:OpenSSL_0_9_6a-beta1
public:rsaref
public:BEFORE_engine
public:OpenSSL_0_9_6-beta2
public:OpenSSL_0_9_6-beta1
public:OpenSSL_0_9_6
public:OpenSSL-engine-0_9_6
public:OpenSSL-engine-0_9_6-beta3
public:OpenSSL_0_9_6-beta3
public:OpenSSL-engine-0_9_6-beta2
public:OpenSSL-engine-0_9_6-beta1
public:OpenSSL_0_9_5
public:OpenSSL_0_9_5a
public:OpenSSL_0_9_5a-beta2
public:OpenSSL_0_9_5a-beta1
public:OpenSSL_0_9_5beta2
public:OpenSSL_0_9_5beta1
public:OpenSSL_0_9_4
public:OpenSSL_0_9_3a
public:OpenSSL_0_9_3
public:OpenSSL_0_9_3beta2
public:OpenSSL_0_9_3beta1
public:OpenSSL_0_9_2b
public:OpenSSL_0_9_1c
public:SSLeay_0_9_1b
public:SSLeay_0_9_0b
public:SSLeay_0_8_1b
...
compare: public:master
Branches Tags
public:openssl-3.5
public:master
public:openssl-3.0
public:openssl-3.2
public:openssl-3.3
public:openssl-3.4
public:feature/dtls-1.3
public:openssl-3.1
public:feature/evp_skey
public:feature/hss
public:feature/ech
public:feature/acert-cli
public:OpenSSL_1_1_1-stable
public:OpenSSL_1_0_2-stable
public:OpenSSL_1_1_0-stable
public:OpenSSL-fips-2_0-stable
public:OpenSSL-fips-2_0-dev
public:tls1.3-draft-18
public:tls1.3-draft-19
public:OpenSSL_1_0_1-stable
public:OpenSSL_1_0_0-stable
public:OpenSSL_0_9_8-stable
public:OpenSSL-fips-1_2-stable
public:OpenSSL-fips-0_9_8-stable
public:OpenSSL_0_9_7-stable
public:OpenSSL_0_9_8fg-stable
public:OpenSSL-fips2-0_9_7-stable
public:OpenSSL_0_9_6-stable
public:OpenSSL-engine-0_9_6-stable
public:OpenSSL-fips-0_9_7-stable
public:SSLeay
public:openssl-3.5.0-alpha1
public:openssl-3.0.16
public:openssl-3.1.8
public:openssl-3.2.4
public:openssl-3.3.3
public:openssl-3.4.1
public:openssl-3.4.0
public:openssl-3.4.0-beta1
public:openssl-3.4.0-alpha1
public:openssl-3.0.15
public:openssl-3.1.7
public:openssl-3.2.3
public:openssl-3.3.2
public:openssl-3.0.14
public:openssl-3.1.6
public:openssl-3.2.2
public:openssl-3.3.1
public:openssl-3.3.0
public:openssl-3.3.0-beta1
public:openssl-3.3.0-alpha1
public:openssl-3.0.13
public:openssl-3.1.5
public:openssl-3.2.1
public:openssl-3.2.0
public:openssl-3.2.0-beta1
public:openssl-3.0.12
public:openssl-3.1.4
public:openssl-3.2.0-alpha2
public:openssl-3.0.11
public:openssl-3.1.3
public:OpenSSL_1_1_1w
public:openssl-3.2.0-alpha1
public:OpenSSL_1_1_1v
public:openssl-3.0.10
public:openssl-3.1.2
public:OpenSSL_1_1_1u
public:openssl-3.0.9
public:openssl-3.1.1
public:openssl-3.1.0
public:openssl-3.0.8
public:OpenSSL_1_1_1t
public:openssl-3.1.0-beta1
public:openssl-3.1.0-alpha1
public:openssl-3.0.7
public:OpenSSL_1_1_1s
public:OpenSSL_1_1_1r
public:openssl-3.0.6
public:OpenSSL_1_1_1q
public:openssl-3.0.5
public:OpenSSL_1_1_1p
public:openssl-3.0.4
public:OpenSSL_1_1_1o
public:openssl-3.0.3
public:OpenSSL_1_1_1n
public:openssl-3.0.2
public:openssl-3.0.1
public:OpenSSL_1_1_1m
public:openssl-3.0.0
public:OpenSSL_1_1_1l
public:openssl-3.0.0-beta2
public:openssl-3.0.0-beta1
public:openssl-3.0.0-alpha17
public:openssl-3.0.0-alpha16
public:openssl-3.0.0-alpha15
public:openssl-3.0.0-alpha14
public:OpenSSL_1_1_1k
public:openssl-3.0.0-alpha13
public:openssl-3.0.0-alpha12
public:OpenSSL_1_1_1j
public:openssl-3.0.0-alpha11
public:openssl-3.0.0-alpha10
public:OpenSSL_1_1_1i
public:openssl-3.0.0-alpha9
public:openssl-3.0.0-alpha8
public:openssl-3.0.0-alpha7
public:OpenSSL_1_1_1h
public:openssl-3.0.0-alpha6
public:openssl-3.0.0-alpha5
public:openssl-3.0.0-alpha4
public:openssl-3.0.0-alpha3
public:openssl-3.0.0-alpha2
public:openssl-3.0.0-alpha1
public:OpenSSL_1_1_1g
public:OpenSSL_1_1_1f
public:OpenSSL_1_1_1e
public:OpenSSL_1_0_2u
public:OpenSSL_1_0_2t
public:OpenSSL_1_1_0l
public:OpenSSL_1_1_1d
public:OpenSSL_1_1_1c
public:OpenSSL_1_1_0k
public:OpenSSL_1_0_2s
public:OpenSSL_1_0_2r
public:OpenSSL_1_1_1b
public:OpenSSL_1_0_2q
public:OpenSSL_1_1_0j
public:OpenSSL_1_1_1a
public:OpenSSL_1_1_1
public:OpenSSL_1_1_1-pre9
public:OpenSSL_1_0_2p
public:OpenSSL_1_1_0i
public:OpenSSL_1_1_1-pre8
public:OpenSSL_1_1_1-pre7
public:OpenSSL_1_1_1-pre6
public:OpenSSL_1_1_1-pre5
public:OpenSSL_1_1_1-pre4
public:OpenSSL_1_0_2o
public:OpenSSL_1_1_0h
public:OpenSSL_1_1_1-pre3
public:OpenSSL_1_1_1-pre2
public:OpenSSL_1_1_1-pre1
public:OpenSSL_1_0_2n
public:OpenSSL_1_0_2m
public:OpenSSL_1_1_0g
public:OpenSSL-fips-2_0_16
public:OpenSSL-fips-2_0_15
public:OpenSSL_1_0_2l
public:OpenSSL_1_1_0f
public:OpenSSL-fips-2_0_14
public:OpenSSL_1_1_0e
public:OpenSSL_1_0_2k
public:OpenSSL_1_1_0d
public:OpenSSL-fips-2_0_13
public:OpenSSL_1_1_0c
public:OpenSSL_1_0_2j
public:OpenSSL_1_1_0b
public:OpenSSL_1_0_1u
public:OpenSSL_1_0_2i
public:OpenSSL_1_1_0a
public:OpenSSL_1_1_0
public:OpenSSL_1_1_0-pre6
public:OpenSSL_1_0_1t
public:OpenSSL_1_0_2h
public:OpenSSL_1_1_0-pre5
public:OpenSSL_1_1_0-pre4
public:OpenSSL_1_0_1s
public:OpenSSL_1_0_2g
public:OpenSSL_1_1_0-pre3
public:OpenSSL-fips-2_0_12
public:OpenSSL-fips-2_0_11
public:OpenSSL-fips-2_0_10
public:OpenSSL_1_0_1r
public:OpenSSL_1_0_2f
public:OpenSSL_1_1_0-pre2
public:OpenSSL_1_1_0-pre1
public:OpenSSL_0_9_8zh
public:OpenSSL_1_0_0t
public:OpenSSL_1_0_1q
public:OpenSSL_1_0_2e
public:OpenSSL_1_0_1p
public:OpenSSL_1_0_2d
public:OpenSSL_1_0_1o
public:OpenSSL_1_0_2c
public:OpenSSL_0_9_8zg
public:OpenSSL_1_0_0s
public:OpenSSL_1_0_1n
public:OpenSSL_1_0_2b
public:OpenSSL-fips-2_0_9
public:OpenSSL_0_9_8zf
public:OpenSSL_1_0_0r
public:OpenSSL_1_0_1m
public:OpenSSL_1_0_2a
public:OpenSSL_0_9_8-pre-reformat
public:OpenSSL_0_9_8-pre-auto-reformat
public:OpenSSL_0_9_8-post-auto-reformat
public:OpenSSL_0_9_8-post-reformat
public:OpenSSL_1_0_0-pre-reformat
public:OpenSSL_1_0_0-pre-auto-reformat
public:OpenSSL_1_0_0-post-auto-reformat
public:OpenSSL_1_0_0-post-reformat
public:OpenSSL_1_0_1-pre-reformat
public:OpenSSL_1_0_1-pre-auto-reformat
public:OpenSSL_1_0_1-post-auto-reformat
public:OpenSSL_1_0_1-post-reformat
public:OpenSSL_1_0_2-pre-reformat
public:OpenSSL_1_0_2-pre-auto-reformat
public:OpenSSL_1_0_2-post-auto-reformat
public:OpenSSL_1_0_2-post-reformat
public:master-pre-reformat
public:master-pre-auto-reformat
public:master-post-auto-reformat
public:master-post-reformat
public:OpenSSL_1_0_2
public:OpenSSL_0_9_8ze
public:OpenSSL_1_0_0q
public:OpenSSL_1_0_1l
public:OpenSSL_0_9_8zd
public:OpenSSL_1_0_0p
public:OpenSSL_1_0_1k
public:OpenSSL-fips-2_0_8
public:OpenSSL_1_0_1j
public:OpenSSL_1_0_0o
public:OpenSSL_0_9_8zc
public:OpenSSL_1_0_2-beta3
public:OpenSSL_0_9_8zb
public:OpenSSL_1_0_0n
public:OpenSSL_1_0_1i
public:OpenSSL_1_0_2-beta2
public:OpenSSL-fips-2_0_7
public:OpenSSL_1_0_1h
public:OpenSSL_1_0_0m
public:OpenSSL_0_9_8za
public:OpenSSL-fips-2_0_6
public:OpenSSL_1_0_1g
public:OpenSSL_1_0_2-beta1
public:OpenSSL_1_0_0l
public:OpenSSL_1_0_1f
public:OpenSSL-fips-2_0_4
public:OpenSSL-fips-2_0_5
public:OpenSSL-fips-2_0_3
public:OpenSSL-fips-2_0_2
public:OpenSSL_1_0_1e
public:OpenSSL_1_0_0k
public:OpenSSL_1_0_1d
public:OpenSSL_0_9_8y
public:OpenSSL-fips-2_0-pl1
public:OpenSSL-fips-2_0_1
public:OpenSSL_1_0_1c
public:OpenSSL_1_0_0j
public:OpenSSL_0_9_8x
public:OpenSSL_1_0_1b
public:OpenSSL_0_9_8w
public:OpenSSL_1_0_1a
public:OpenSSL_0_9_8v
public:OpenSSL_1_0_0i
public:OpenSSL_1_0_1
public:OpenSSL_1_0_0h
public:OpenSSL_0_9_8u
public:OpenSSL_1_0_1-beta3
public:OpenSSL_1_0_1-beta2
public:OpenSSL-fips-2_0-rc9
public:OpenSSL-fips-2_0
public:OpenSSL_1_0_0g
public:OpenSSL_0_9_8t
public:OpenSSL_0_9_8s
public:OpenSSL_1_0_0f
public:OpenSSL-fips-2_0-rc8
public:OpenSSL_1_0_1-beta1
public:OpenSSL-fips-2_0-rc7
public:OpenSSL-fips-2_0-rc6
public:OpenSSL-fips-2_0-rc5
public:OpenSSL-fips-2_0-rc4
public:OpenSSL-fips-2_0-rc3
public:OpenSSL-fips-2_0-rc2
public:OpenSSL-fips-2_0-rc1
public:OpenSSL-fips-1_2_3
public:OpenSSL-fips-1_2_2
public:OpenSSL-fips-1_2_1
public:OpenSSL_1_0_0e
public:OpenSSL_1_0_0d
public:OpenSSL_0_9_8r
public:OpenSSL_0_9_8q
public:OpenSSL_1_0_0c
public:OpenSSL_0_9_8p
public:OpenSSL_1_0_0b
public:OpenSSL_0_9_8o
public:OpenSSL_1_0_0a
public:OpenSSL_1_0_0
public:OpenSSL_0_9_8n
public:OpenSSL_0_9_8m
public:OpenSSL_0_9_8m-beta1
public:OpenSSL_1_0_0-beta5
public:OpenSSL_1_0_0-beta4
public:OpenSSL_0_9_8l
public:OpenSSL_1_0_0-beta3
public:OpenSSL_1_0_0-beta2
public:OpenSSL_1_0_0-beta1
public:OpenSSL_0_9_8k
public:OpenSSL_0_9_8j
public:OpenSSL_0_9_8i
public:OpenSSL_0_9_8h
public:OpenSSL_0_9_8g
public:OpenSSL_0_9_8f
public:OpenSSL-fips-1_2_0
public:FIPS_098_TEST_8
public:FIPS_098_TEST_7
public:FIPS_098_TEST_6
public:FIPS_098_TEST_5
public:FIPS_098_TEST_4
public:FIPS_098_TEST_3
public:FIPS_098_TEST_2
public:FIPS_098_TEST_1
public:OpenSSL_0_9_7m
public:OpenSSL_0_9_8e
public:OpenSSL_0_9_7l
public:OpenSSL_0_9_8d
public:OpenSSL_0_9_8c
public:OpenSSL_0_9_7k
public:OpenSSL_0_9_7j
public:OpenSSL_0_9_8b
public:OpenSSL_FIPS_1_0
public:OpenSSL_0_9_7i
public:OpenSSL_0_9_8a
public:OpenSSL_0_9_7h
public:OpenSSL_0_9_8
public:FIPS_TEST_10
public:OpenSSL_0_9_8-beta6
public:OpenSSL_0_9_8-beta5
public:FIPS_TEST_9
public:OpenSSL_0_9_8-beta4
public:OpenSSL_0_9_8-beta3
public:BEN_FIPS_TEST_8
public:OpenSSL_0_9_8-beta2
public:OpenSSL_0_9_8-beta1
public:OpenSSL_0_9_7g
public:OpenSSL_0_9_7f
public:BEN_FIPS_TEST_7
public:BEN_FIPS_TEST_6
public:OpenSSL_0_9_7e
public:OpenSSL_0_9_7d
public:OpenSSL-engine-0_9_6m
public:OpenSSL_0_9_6m
public:LEVITTE_after_const
public:LEVITTE_before_const
public:BEN_FIPS_TEST_5
public:BEN_FIPS_TEST_4
public:OpenSSL-engine-0_9_6l
public:OpenSSL_0_9_6l
public:BEN_FIPS_TEST_3
public:BEN_FIPS_TEST_2
public:BEN_FIPS_TEST_1
public:OpenSSL-engine-0_9_6k
public:OpenSSL_0_9_6k
public:OpenSSL_0_9_7c
public:OpenSSL-engine-0_9_6j
public:OpenSSL_0_9_7b
public:OpenSSL_0_9_6j
public:OpenSSL-engine-0_9_6i
public:OpenSSL_0_9_6i
public:OpenSSL_0_9_7a
public:OpenSSL_0_9_7
public:OpenSSL_0_9_7-beta6
public:STATE_after_zlib
public:STATE_before_zlib
public:OpenSSL_0_9_7-beta5
public:OpenSSL-engine-0_9_6h
public:OpenSSL_0_9_6h
public:OpenSSL_0_9_7-beta4
public:OpenSSL-engine-0_9_6g
public:OpenSSL_0_9_6g
public:OpenSSL-engine-0_9_6f
public:OpenSSL_0_9_6f
public:OpenSSL_0_9_7-beta3
public:OpenSSL-engine-0_9_6e
public:OpenSSL_0_9_6e
public:OpenSSL_0_9_7-beta2
public:OpenSSL_0_9_7-beta1
public:AFTER_COMPAQ_PATCH
public:BEFORE_COMPAQ_PATCH
public:OpenSSL-engine-0_9_6d
public:OpenSSL_0_9_6d
public:OpenSSL-engine-0_9_6d-beta1
public:OpenSSL_0_9_6d-beta1
public:OpenSSL-engine-0_9_6c
public:OpenSSL_0_9_6c
public:OpenSSL-engine-0_9_6b
public:OpenSSL_0_9_6b
public:OpenSSL_0_9_6a
public:OpenSSL-engine-0_9_6a
public:OpenSSL-engine-0_9_6a-beta3
public:OpenSSL_0_9_6a-beta3
public:OpenSSL-engine-0_9_6a-beta2
public:OpenSSL_0_9_6a-beta2
public:OpenSSL-engine-0_9_6a-beta1
public:OpenSSL_0_9_6a-beta1
public:rsaref
public:BEFORE_engine
public:OpenSSL_0_9_6-beta2
public:OpenSSL_0_9_6-beta1
public:OpenSSL_0_9_6
public:OpenSSL-engine-0_9_6
public:OpenSSL-engine-0_9_6-beta3
public:OpenSSL_0_9_6-beta3
public:OpenSSL-engine-0_9_6-beta2
public:OpenSSL-engine-0_9_6-beta1
public:OpenSSL_0_9_5
public:OpenSSL_0_9_5a
public:OpenSSL_0_9_5a-beta2
public:OpenSSL_0_9_5a-beta1
public:OpenSSL_0_9_5beta2
public:OpenSSL_0_9_5beta1
public:OpenSSL_0_9_4
public:OpenSSL_0_9_3a
public:OpenSSL_0_9_3
public:OpenSSL_0_9_3beta2
public:OpenSSL_0_9_3beta1
public:OpenSSL_0_9_2b
public:OpenSSL_0_9_1c
public:SSLeay_0_9_1b
public:SSLeay_0_9_0b
public:SSLeay_0_8_1b

1217 commits
openssl-3. ... master

Author SHA1 Message Date
Matt Caswell
95051052b3 Move the Handshake read secret change earlier in the process for QUIC 0-RTT 
On the server side we were changing the handshake rx secret a little late.
This meant the application was forced to call SSL_do_handshake() again
even if there was nothing to read in order to get the secret. We move it
a little earlier int the process to avoid this.

Fixes the issue described in:
https://github.com/ngtcp2/ngtcp2/pull/1582#issuecomment-2735950083

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27101)
 2025-03-20 20:22:39 +01:00
Daniel Van Geest
c1d27789e9 Fix use of SHAKE as a digest in CMS 
draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as
the message digest algorithm for SLH-DSA-SHAKE-* in CMS.
SHAKE doesn't have a default digest length, so this adds
a SHAKE-specific kludge in CMS.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27087)
 2025-03-20 12:20:37 +01:00
Viktor Dukhovni
27b88364e4 Avoid erroneous legacy code path when provided 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27075)
 2025-03-20 11:33:23 +01:00
Ankit Kekre
952d9b83b2 apps/cms.c, apps/ocsp.c: Added NULL pointer checks 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27059)
 2025-03-20 11:30:57 +01:00
Matt Caswell
207cd5bb97 Fix the use of CCM ciphersuites with QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
366b2643cb Add a test for using CCM ciphersuites with QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
228a26fde4 Always use NULL BIOs when using the QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
445c0942cd Test that using the QUIC TLS API does not require BIOs to be set 
When using the QUIC TLS API it does not make sense to require BIOs to be
set.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
2100cf2ee0 Ensure SSL_get_app_data() continues to work even in SSL_free() 
During SSL_free() we may get a QUIC TLS callback being called to clean up
any remaining record data. We should ensure that SSL_get_app_data()
continues to work, even in this scenario.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
4ad45969b0 Don't decrement the unreleased counter if we failed to release a record 
In a failure situation we may incorrectly decrement the amount of data
released. Only decrement the counter if we successfully released.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
f2488a567b Check SSL_get_app_data() from QUIC cb in a failure situation 
Ensure SSL_get_app_data() works even in a failure situation from SSL_free()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
2ebae654d5 Add a test for calling SSL_get_app_data() from QUIC TLS callbacks 
Check that we get the expected app data when using the QUIC TLS callbacks.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Bernd Edlinger
c658a60aae Remove workaround for an old ppc64le compiler bug 
Lowering the optimization level is no longer needed,
since the old compiler bug from ubuntu-20.04 has been
fixed meanwhile.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27033)
 2025-03-20 11:17:29 +01:00
Dmitry Misharov
1bf328edf9 correctly mark the release as prerelease 
release must be marked as prerelease if "alpha" or "beta" is in tag name

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27092)
 2025-03-20 11:15:16 +01:00
Viktor Dukhovni
064bb16454 Tolerate PKCS#8 V2 with optional public keys 
- Presently any included public key is unused.
- We don't check that v1 PKCS#8 structures omit the public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27076)
 2025-03-19 12:02:31 +01:00
Jon Spillett
58d548d84e Use text compare for PEM and text files 
- Fix ml_dsa_codecs test
- Fix ml_kem_codecs test
- Fix pkey test
- Fix dsaparam test
- Fix dhparam test
- Fix pkcs8 test

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27082)
 2025-03-19 11:48:49 +01:00
Ingo Franzki
05c05d43bf Doc fix in EVP_PKEY-ML-DSA/KEM.pod files 
Fix the references to OSSL_PROVIDER_add_conf_parameter in the 'SEE ALSO'
section.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27077)
 2025-03-19 11:47:07 +01:00
Martin Oliveira
482d3f9338 Fix gettable_params() for ECX 
The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the
ed25519_get_params() and ed448_get_params(). The x25519 and x448
versions of get_params() always ignore that parameter, so it should not
be in the list of gettable params.

Fixes: 1a7328c882 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest")

cla: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27043)
 2025-03-19 10:43:26 +01:00
ak4153
978e23a472 Fix missing OSSL_FUNC_DIGEST_GET_PARAMS in provider-digest.pod 
Fixes #26626
CLA: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27009)
 2025-03-19 10:41:34 +01:00
sashan
108079fcbb require GNU assembler 2.30 or higher to build aesni-xtx-avx512.pl 
The peralsm in aesni-xts-avx512 currently checks for GNU assembler 2.26
or higher. According to reporters it looks like we need 2.30.

This PR just attempts fix version check so people with older
tool chains can  build OpenSSL.

Fixes #27049

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27078)
 2025-03-19 08:03:50 +11:00
Nicola Tuveri
2d50cb660c docs(provider-base): Add HISTORY note for OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS (and MAX) 
This commit adds a small note about
definitions for
`OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS` and
`OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS`
being first added in OpenSSL 3.5.

PR #26975 added these definitions for OpenSSL 3.5, but the documentation
update omitted a history note for the addition.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27063)
 2025-03-18 18:58:55 +01:00
Bernd Edlinger
a532f2302d Do some more cleanup in the RCU code 
Only a minimum of 2 qp's are necessary: one for the readers,
and at least one that writers can wait on for retirement.
There is no need for one additional qp that is always unused.
Also only one ACQUIRE barrier is necessary in get_hold_current_qp,
so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED.
And finally clarify some comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27012)
 2025-03-18 18:52:29 +01:00
Bernd Edlinger
4a1a7fe5ce Fix a memory order issue with weakly ordered systems 
this adds a dummy atomic release operation to update_qp, which
should make sure that the new value of reader_idx is visible in
get_hold_current_qp, directly after incrementing the users count.

Fixes: #26875

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26964)
 2025-03-17 08:01:26 -04:00
Neil Horman
5db7b99914 Fix interop ci yaml 
Somehow I mistakenly listed clients in the exlude list, when it should
have been servers, resulting in an invalid yml file

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27066)
 2025-03-14 16:08:04 -04:00
Danny Tsen
85cabd9495 Fix Minerva timing side-channel signal for P-384 curve on PPC 
1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6()
   for Montgomery multiplication.
2. ecp_nistp384-ppc64.pl:
   - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with
     minumum perl wrapper.
   - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce.
   - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly.
3. ecp_nistp384.c:
   - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce.

Signed-off-by: Danny Tsen <dtsen@us.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26709)
 2025-03-14 17:20:52 +01:00
Randall S. Becker
ff030ad5bd Wrap use of poll.h to prevent including on NonStop. 
Fixes: #26724

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26726)
 2025-03-14 07:40:40 -04:00
Tomas Mraz
c8654f79f4 Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26976)
 2025-03-14 09:44:52 +01:00
Andrew Dinh
7097d2e00e Fix RCU TODOs 
- Update allocate_new_qp_group to take unsigned int
- Move id_ctr in rcu_lock_st for better stack alignment

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26972)
 2025-03-12 12:07:44 -04:00
Neil Horman
2fb4cfe143 Exclude retry test with msquic server from interop 
With the addition of larger ml-kem keys in our tls handshake, we've
uncovered a interop failure, as described here:
https://github.com/microsoft/msquic/issues/4905

In short, when we send a client hello that spans multiple datagrams, the
servers sends an ACK frame in a datagram prior to sending its server
hello.  msquic however, recomputes a new SCID always when sending its
sserver hello, which is fine nominally, but because in this test the
server sends a retry frame to update the SCID, followed by an ACK using
that SCID (which is an initial packet), msquic violates the RFC in
section 7.2 which states:

Once a client has received a valid Initial packet from the server, it MUST
discard any subsequent packet it receives on that connection with a
different Source Connection ID

Because msquic sent an initial packet with that ACK frame, we are
required to discard subsequent frames on the connection containing a
different SCID.

Until msquic fixes that in their implementation we are going to fail the
retry interop test, so for now, lets exclude the test.

Also, while we're at it, re-add chrome into the client list for our
server tests, as that seems to have been lost during the merge.

Fixes openssl/project#1132

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27014)
 2025-03-12 10:28:04 -04:00
openssl-machine
b2762763e9 Prepare for 3.6 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:37:30 +00:00
openssl-machine
2a3fce2274 make update 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:37:18 +00:00
openssl-machine
0c679f5566 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:35:59 +00:00
Neil Horman
2df40ea6ff Adding missed items to NEWS.md prior to release 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27026)
 2025-03-11 09:21:45 -04:00
Michael Schroeder
cad3520bf7 Add support for md-less signature schemes in CMS 
Signature schemes like Ed25519 or ML-DSA use "pure" signing,
i.e. they directly sign the tbs data instead of signing a digest.

This is already supported in the X509 code, but not in CMS.
This commit adds support for such schemes to CMS.

This is a minimalistic set of changes, based in the work done
by David von Oheimb.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26867)
 2025-03-10 14:36:15 +01:00
Viktor Dukhovni
91c6e157c6 Make group names case-insensitive 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26991)
 2025-03-09 23:31:25 +01:00
Viktor Dukhovni
bcff020c36 Refactor sigalg handling 
- The default sigalg list now puts ML-DSA-65 first, then ML-DSA-87
  and then ML-DSA-44.  (87 vs. 44 Subject to bikeshedding).

- The mintls and maxtls versions are now taken into account for
  both built-in and provided algorithms.

- Some algorithms have a separate TLSv1.2-specific name for future
  reporting via openssl-list(1).

- ML-DSA aside, any new provided algorithms go at the end of the
  default list (backwards-compatible inclusion).

- The built-in algorithms now also have min/max DTLS versions.
  Though the provider TLS-SIGALG capability was extended to also report
  the DTLS version range, the minimum supported DTLS is 1.3, which we
  don't yet have, so it is not yet possible to add DTLS sigalgs via a
  provider

- The TLS 1.3 brainpool sigalgs got their correct IANA names, with
  the legacy names as purported TLS 1.2 alternatives, but since
  these are for TLS 1.3 and up those names are for matching only,
  the reported value will still be the 1.3 name.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26975)
 2025-03-09 23:19:37 +01:00
Neil Horman
9a308a89a4 Orphan packets from qrx 
It may occur that the qrx we allocate in port_default_packet handler to
do AEAD validation isn't the one the channel ultimately uses (like if we
turn off address validation).  In that event, we need to ensure that
anything we have on that qrx isn't returned to its free list to avoid
early freeing when we free the qrx at the end of
port_default_packet_handler, while those frames are still pending on the
channel qrx

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27004)
 2025-03-09 18:44:53 +01:00
Neil Horman
0cfbeba8ed Fix a few erroneous double frees in quic-hq-interop 
Uncovered during testing for openssl/project#1130

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27004)
 2025-03-09 18:44:53 +01:00
Neil Horman
8f74d8cee3 If our server channel creates its own qrx, set its initial secret 
With the addition of larger client hellos, stemming from the use of
larger PQC key shares, it may happen that we get a client hello accross
multiple datagrams. Normally this is not a problem as
port_default_packet_handler allocates a qrx and initializes its initial
secret immediately.  But if server address validation is disabled, then
the channel creates the qrx in port_bind_channel itself, without initial
secrets.  As a result, we validate the first datagram in
port_default_packet_handler, but the subsequent datagrams containing the
remaining client hello fragments fail decode.

Fix it by ensuring that we add the initial secret in port_bind_channel
if we don't give it a preconfigured qrx

Fixes openssl/project#1131

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27006)
 2025-03-07 21:56:34 -05:00
RSA-1977
8d6fd6142b Updated SSL_SESSION_get0_hostname() documentation to be consistent with the function 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26559)
 2025-03-05 19:12:45 +01:00
Neil Horman
c0251d7b0f Fix build on windows xp 
Windows XP doesn't support setting socket handles to be non-inheritable,
but the rio_notifier attempts to do so. WSASocketA will there return
an error when the NO_INHERIT flag is set. In that case, just retry the
call without the flag.

Fixes #26943

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26970)
 2025-03-05 17:36:20 +01:00
Bernd Edlinger
6e7be995fd RCU: Ensure that qp's are actually retired in order 
The current retirement code for rcu qp's has a race condition,
which can cause use-after-free errors, but only if more than
3 QPs are allocated, which is not the default configuration.

This fixes an oversight in commit 5949918f9a ("Rework and
simplify RCU code")

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26952)
 2025-03-05 16:04:16 +01:00
Bernd Edlinger
bcb8eae1af Fix support for windows atomics 
Make CRYPTO_atomic_add consistent with
CRYPTO_atomic_load_int and set the
reader_idx under write_lock since there
is no CRYPTO_atomic_store_int.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26963)
 2025-03-05 16:02:47 +01:00
Andrew Dinh
b48145cd18 QUIC server post-rebase nits 
- Apply doc nits suggested by Viktor from https://github.com/openssl/openssl/pull/26762
- Update CHANGES.md & NEWS.md saying there is now support for QUIC server
- Added copyright header in: test/radix/quic_ops.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26944)
 2025-03-05 15:02:17 +01:00
daum3ns
30fbc68dd4 tls_validate_record_header(): Check for all HTTP methods 
The change checks for all HTTP methods in ssl_record, not only GET, POST,
PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE)

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26968)
 2025-03-05 14:58:29 +01:00
Ivan Stanković
e599893a9f x509: allow SAN URIs to contain userinfo 
The way we're currently handling SAN URIs does not allow for userinfo,
meaning the name constraint check on such URIs will fail. Fix this by
skipping over the userinfo component:

      authority   = [ userinfo "@" ] host [ ":" port ]

(per RFC 3986).

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25861)
 2025-03-04 17:30:34 +01:00
Tomas Mraz
4e9b542868 compiler-zoo.yml: Switch to ubuntu-22.04 where possible 
And drop the rest.

The ubuntu-20.04 CI runners are discontinued.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26971)
 2025-03-04 16:33:15 +01:00
Matt Caswell
5eb55ad8a7 Fix a compilation failure in AIX 
AIX (at least for 7.1)  defines some macros for "events" and "revents" which
interferes with our own use of these names.

Fixes #24236

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26933)
 2025-03-04 09:02:15 -05:00
Tomas Mraz
ac80e1e15d doc: Fix type of OSSL_KEM_PARAM_IKME for ML-KEM 
Fixes #26945

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26954)
 2025-03-04 14:06:32 +01:00
Dr. David von Oheimb
1d3da367ab minor doc fixes for CMP and HTTP 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26924)
 2025-03-04 13:58:37 +01:00
Pauli
c1cd6d89a3 run ECX KEM evp_test tests 
The FIPS providers that support ECX (3.0.x & maybe 3.1.x) do not support ECX
KEM so there is little point to testing these algorithms under FIPS.  Consequently,
they are being tested only with the default provider.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
9adf53889b ecx kem: add evp_test data for ECX KEM testing 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
b2f415e0a4 evp_test: fully test RSA 
The evppkey_rsa.txt data were only tested against the default provider.
Change this so that they are tested against the FIPS provider too.
Also add the RSA KEM tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
a7c550ff76 rsa kem: add evp_test data 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
8e874d09d8 evp_test: fix untested errant code paths 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
e0b779098d test: condition SHA1/MD5 tests on default provider in evp_test data file 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:37 +11:00
Pauli
982a9676cf test: remove RSA KEM tests from evp_test data file 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:37 +11:00
Bartel Artem
d3b6b81eab X509v3_addr_canonize(): Check whether addr == NULL 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26583)
 2025-03-03 09:43:22 +01:00
14MM4CH1N3
da44eb2901 Update doc README URLs 
This updates the openssl documentation link to the one currently in use,
and removes the standards.txt section as that URL leads to the normal
documentation page and there is no "standards" page in the openssl
documentation site.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26759)
 2025-03-03 09:40:30 +01:00
Andrew Dinh
2240da83f9 SSL_CTX_set1_curves.pod: Move examples to own section 
Also specify whether server or client preference

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26897)
 2025-03-03 09:37:59 +01:00
Andrew Dinh
493e067f90 doc: Add some clarifications for SSL_CTX_set1_curves() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26897)
 2025-03-03 09:37:44 +01:00
Ondrej Moris
a06d14e8ec Update pkcs11-provider submodule (898b107) 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26899)
 2025-03-03 09:35:16 +01:00
Dmitry Misharov
808a086171 Fix hashsum files in release assets 
We use the coreutils format since 3.4.0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26907)
 2025-03-03 09:33:26 +01:00
Jakub Zelenka
5045712d3d Fix libctx passing for CMS PWRI use 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26937)
 2025-03-03 09:26:44 +01:00
Jean-Frederic Clere
7e431da4d8 http_test.c: Replace snprintf by BIO_snprintf 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26925)
 2025-03-03 09:18:13 +01:00
Tomas Mraz
2411f9b662 apps: Escape control characters in DNs by default 
When displaying distinguished names the control characters
are escaped by default.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)
 2025-03-03 09:08:34 +01:00
Tomas Mraz
624a00ef41 Sync CHANGES.md with 3.4 branch and fix formatting 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)
 2025-03-03 09:08:31 +01:00
Neil Horman
4f2f5179a1 Remove empty buffer check in script_84 of quic_multistream_test 
The quic_multistream_test occasionally fails script_84, specifically
failing on:

OP_CHECK2(check_write_buf_stat, 0, 0)

which fails due to the send stream buffer not reading zero after data is
sent on the stream

However, the send stream is culled of pending data, not after the stream
is sent, but rather only after the peer sends an ack confirming that the
data has been received.  There is no guarantee that ACK will be sent
immediately, so occasionally timing discrepancies result in the test not
getting that ack by the time we check the send stream buffer.

We couldmodify the script to wait longer, or repeatedly tick the quic
stack to wait for that ack to be collected, but since its perfectly
valid for that data to live in the ring buffer for a period, and that
any true erroneous keeping of that data beyond its ack point would
manifest as any number of other duplicate transmissions, it seems more
sane to just remove the check.

Fixes openssl/project#1117

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26939)
 2025-03-02 17:39:38 -05:00
Matt Caswell
aaad33c5ac Move ssl_err.c into libcrypto 
We move ssl_err.c out of libssl and into libcrypto. This file is entirely
self contained and is used to load error strings into the libcrypto error
tables. By moving this file into libcrypto, libssl can be unloaded safely
without having dangling references to this error information.

Fixes #26672

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26931)
 2025-03-01 14:46:03 -05:00
Viktor Dukhovni
31b5f3f382 Further decoder tuning possibly better perf 
- The decoder should consider fewer options based on
  more precise tracking of the desired input type
  (DER, PVK, MSBLOB), algorithm (RSA, EC, ...),
  input structure (SPKI, P8, ...).

How much this affects actual use-cases is harder to estimate, we'll just
have to run before/after perf tests.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26927)
 2025-03-02 02:04:09 +11:00
Geert Hendrickx
89dbc6a62c Fix no-tls-deprecated-ec documentation to match the actual option. 
CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26934)
 2025-03-02 01:55:14 +11:00
Ian Spence
d4430ef9fc Delete include/openssl/asn1_mac.h 
See https://github.com/openssl/openssl/discussions/26886

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26900)
 2025-03-01 09:27:54 -05:00
Hugo Beauzée-Luyssen
c2ab75e30a doc: fix OSSL_WINCTX spelling windows notes 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26567)
 2025-02-28 15:21:12 +01:00
Valerii Krygin
f86acc9434 EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677) 
EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions.

To achieve this:
- Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them.
- Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour.
- Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`.
- Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation.
- Add the HISTORY section to EVP_EncodeInit documentation to describe the fix.

Other changes:
- Update AUTHORS.md
- Update the copyright date in the documentation.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26678)
 2025-02-27 17:38:57 +00:00
Viktor Dukhovni
6ef393b89b Check full ML-KEM encoded key 
When both seed and key are provided compare the full ML-KEM private key
with the seed keygen output, not just the public key.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26905)
 2025-02-27 11:06:29 -05:00
Dr. David von Oheimb
253a380bdb doc/, CHANGES, NEWS: add missing entries and fix existing ones when which CMP feature was added 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26908)
 2025-02-27 16:58:47 +01:00
Andrew Dinh
ecc174065a Update slh_dsa_test.c 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Andrew Dinh
237b761ab4 Update slh_dsa_test.c 
Fix https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1642943

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Andrew Dinh
442f1958e8 QUIC NULL checks 
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643141

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Dan Pittman
9688973596 Add a note about avx-512 support for XTS to CHANGES.md 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
dan pittman
ddc8529e87 fix windows calling convention in aesni-xts-avx512 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
Dan Pittman
b4116b9372 add an AVX-512-optimized ASM XTS implementation for x86_64 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
slontis
c2f4d7aae1 Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called 
twice.

Fixes #26862

This only happens when using the FIPS provider, since it needs to export
the key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26891)
 2025-02-27 12:04:14 +11:00
Andrew Dinh
054f6c0fc1 Optimize ossl_namemap_name2num_n to avoid strndup 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26870)
 2025-02-26 13:32:59 -05:00
Viktor Dukhovni
18f2091ad1 Older FIPS providers require a kemop 
Don't expect success with dated FIPS modules.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26904)
 2025-02-26 15:52:53 +01:00
Viktor Dukhovni
44a64029c3 Use better data type info in decoders 
The decoders in some cases failed to capture or propagate
information about what is being decoded, causing more work
happen to try unrelated decoders as a fallback.

We now try harder to keep track of the expected object (private key or
public key, if known), and the algorithm determined from the OID of a
PKCS8 object or SPKI.  This leads in many cases to fewer decoder
invocations.  With so many more algorithms now, trying every decoder
is increasingly best avoided.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26892)
 2025-02-26 15:13:57 +01:00
SaEvangelista
f11c10d83e Allow 0 length plaintext and aad for aes-siv 
Test vectors taken from wycheproof:

https://github.com/C2SP/wycheproof/blob/master/testvectors/aes_siv_cmac_test.json

Fixes #26580

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26658)
 2025-02-26 12:21:08 +01:00
slontis
20599e480f ML-DSA Add Wycheproof test vectors. 
Added a python script to convert the json files into evp_test data.
Added a EVP_TEST_METHOD "KeyFromData" that can test failures when
loading raw keys. (The existing "PrivateKeyRaw" and "PublicKeyRaw"
were not fit for this purpose).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26885)
 2025-02-26 12:14:58 +01:00
Viktor Dukhovni
fed9be39ff Make RFC8422 deprecated TLS EC curves disablable 
Also move the deprecated curves to the end of the list, and order the
soon most preferred groups first.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26873)
 2025-02-26 12:14:02 +01:00
slontis
69d15b28af FIPS POST: Change PBKDF2 CAST to use less iterations. 
Fixes #26876

The issue here is that the pbkdf2 'lower_bounds_checks' currently errors by default
in FIPS mode if iterations < 1000.
i.e. the "pkcs5" flag = 0 triggers an error..
Turning the flag on means the FIPS indicator is triggered (which is probably correct behaviour)
Not sure testing the fips state here is a good idea (i.e. taking a TSAN hit).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26887)
 2025-02-26 12:13:03 +01:00
Neil Horman
c0eb5c57f7 fix slh-dsa incorrect prediction of result code 
The slh_dsa fuzzer predicts failure in EVP_message_sign_init in the
event we pass a context_string param of more than 255 bytes.  That makes
for an accurate prediction, but only if we actually create  the param.

augment the setting of exepct_rc_init to be determined not only by our
allocation of a > 255 byte message, but also on selector bit 1, which
determines if we create the parameter at all.

Fixes https://oss-fuzz.com/testcase-detail/4807793999937536

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26884)
 2025-02-25 16:04:02 -05:00
Neil Horman
83dbfde6aa Add record overflow test to tlsfuzzer external tests 
Add this to our regression test suite for tlsfuzzer, since it recently
caught an error

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)
 2025-02-25 15:31:58 -05:00
Neil Horman
2ce46ad8ce Change cipher suite alert for 0 length cipher_suites 
From RFC 8446:

Note: TLS defines two generic alerts (see Section 6) to use upon
   failure to parse a message.  Peers which receive a message which
   cannot be parsed according to the syntax (e.g., have a length
   extending beyond the message boundary or contain an out-of-range
   length) MUST terminate the connection with a "decode_error" alert.
   Peers which receive a message which is syntactically correct but
   semantically invalid (e.g., a DHE share of p - 1, or an invalid enum)
   MUST terminate the connection with an "illegal_parameter" alert.

A zero length cipher suite list I think is considered out of range, and
so we should return "decode_error" rather than "illegal_parameter"

Fixes #25309

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)
 2025-02-25 15:31:45 -05:00
Dimitri John Ledkov
a7c0fa601e Add ifndef to seed-src_jitter too 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25930)
 2025-02-25 14:45:57 -05:00
Dimitri John Ledkov
aa5f1b4cf5 fips-jitter: Force use jitter entropy in the FIPS 3.0.9 provider callback 
FIPS 3.0.9 provider does not honor runtime seed configuration, thus if
one desires to use JITTER entropy source with FIPS 3.0.9 provider
something like this needs to be applied to the core (libcrypto) build.

Not sure if this is at all suitable for upstream.

With fips-jitter (3.5+) config, also ensure that core<->provider
callback for entropy uses jitter entropy source, rather than os seed
(getrandom syscall).

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25930)
 2025-02-25 14:45:57 -05:00
Alexandr Nedvedicky
395a83a617 Fix read out of buffer bounds when dealing with BIO_ADDR 
This issue was discoevered while I was testing SSL_new_from_listener()
using a newly created unit test. It has turned out the QUIC stack
at few places contain pattern as follows:
	foo(QUIC_WHATEVER *q, BIO_ADDR *a)
	{
	   q->a = *a;
	}

The problem is that derefencning a that way is risky. If the address `a`
comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR).
Using BIO_ADDR_copy() is the right thing to do here.

Fixes #26241

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26252)
 2025-02-25 15:55:46 +01:00
Niels Dossche
ececabd9ad Fix potential memory leak in policy_section() 
If sk_POLICYQUALINFO_push() fails, qual is not freed.
Fix it by adding POLICYQUALINFO_free() to the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26499)
 2025-02-25 15:52:13 +01:00
Tomas Mraz
be5965acad add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error 
Fixes #26480

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26511)
 2025-02-25 15:50:45 +01:00
Niels Dossche
56160f173d Fix potential leak in error path in cert_response() 
get1_cert_status() returns an object that must be freed,
but the error path does not do that.
Fix it by adding a call to X509_free() in the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26513)
 2025-02-25 15:48:50 +01:00
Andrew Dinh
b4fab70bfb EVP_PKEY_derive_set_peer_ex(): Don't free peer on error 
In EVP_PKEY_derive_set_peer_ex, don't free peer
on error. Revert to existing functionality.

Bug was introduced with
https://github.com/openssl/openssl/pull/26294

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26823)
 2025-02-25 15:47:08 +01:00
Tomas Mraz
87b5aa737d Rename fnv1a_hash() to ossl_fnv1a_hash() 
It is no longer static.

Also add it to libssl only with quic enabled.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26882)
 2025-02-25 15:45:42 +01:00
Niels Dossche
8cdba24cee Fix potential memory leaks in error paths in ossl_rsa_multiprime_derive() 
There are several cases where new BIGNUM instances are created, not
using the context, but not freed when an error occurs.
Fix this by adding the necessary calls to BN_free().

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26515)
 2025-02-25 15:36:43 +01:00
Tomas Mraz
7e80b16776 Add CHANGES.md entry for changed default TLS group list 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
4c69caef48 tls1_set_groups_list(): Update raised errors 
Do not raise ERR_LIB_CONF codes from libssl.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
0b40fac3fb tls_construct_ctos_key_share(): Fix handling of HRR without key share request 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Neil Horman
192f096afd Convert test_bio_ssl to use fake time 
The test_bio_ssl test in quicapitest is failing on windows.  Something
about the timing there is causing wide variance in how long it takes to
establish a handshake (between 130-6500 iterations).

Convert it to use fake time to make it run consistently.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
bcc364896e 28-seclevel.cnf.in: Enable some groups required for high SECLEVELs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
5a9966dd3a 70-test_tls13cookie.t: Change the order of the test cases 
As the COOKIE_ONLY cannot run on no-ecx build.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
sashan
f9aaeacbf9 Tserver must keep fake time ticking to complete a handshake 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
a3143c2400 No valid groups is not an error 
Of course TLS-1.3 won't be usable with such configuration.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
a89c99e04b Have the same default groups list for QUIC and TLS 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Tomas Mraz
b665a13ac0 compare_with_file(): ? at EOL matches any number of characters 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Sasha Nedvedicky
3947982e3a Fix quic multistream test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Viktor Dukhovni
63a70d63e2 Add hybrid ML-KEM based groups to default TLS groups 
- send two key shares by default
- trim down the list of default groups

The default TLS group list setting is now:
?*X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Alexandr Nedvedicky
96075a6a40 Fix AEAD validation of initial packets in port 
The interoperability tests disable client ip address
validation done by RETRY packet. All tests done in CI
take code path which sends a retry packet.

The first initial packet sent by client uses a different
initial encryption level keys to protect packet integrity.
The keys are derived from DCID chosen by client.

When server accepts connection on behalf of initial packet,
the 'DCID' gets changed which means the initial level encryption keys
are changing too. So when server skips sending a retry packet,
it must forget the qrx which was used to validate initial
packet sent by client.

Forgetting qrx is not straightforward, we must salvage the
unencrypted packets left there after they were validated.
Those unencrypted packets must be injected to newly created channel.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26808)
 2025-02-25 12:05:10 +01:00
Alexandr Nedvedicky
c14ae04613 Perform initial AEAD validation before creating a channel 
We let port to create qrx object and use it for
packet validation. If packet validates, we then
create channel and pass pre-created qrx to channel's
constructor.

Co-authored-by: Andrew Dinh <andrewd@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26808)
 2025-02-25 12:04:09 +01:00
daichengrong
7fb4a323f1 riscv: add dl_hwcap for capability detection 
Availability of ZVK* should be determined with dl_hwcap and hwcap.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26811)
 2025-02-25 12:01:59 +01:00
Burkov Egor
6d42072e0b fix: add OOM handler for x509 fuzz test 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26830)
 2025-02-25 11:58:48 +01:00
Viktor Dukhovni
ddd7ecb04b Make the KEM operating mode optional 
There is only one operating mode supported for each of RSA, EC and ECX.
We should not require an explicit setting for the obvious default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26872)
 2025-02-25 10:58:23 +01:00
Pauli
53c54b13ac doc: document that the FIPS provider doesn't support deterministic ECDSA sigs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26880)
 2025-02-25 10:41:40 +01:00
Bernd Edlinger
a6f512a1e6 Revert wrong macos RCU fix 
This reverts #23974 which seems to be no longer needed now,
due to other fixes nearby.  Most likely the change did just
slightly decrease the performance of the reader threads, and
did therefore create the wrong impression that it fixed the issue.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26881)
 2025-02-25 10:38:26 +01:00
Andrew Dinh
cec0659fa4 Coverity fixes 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643042
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643047
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643089
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643091
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643095

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26845)
 2025-02-25 08:55:26 +01:00
Viktor Dukhovni
64a27c24d8 More seed and private key checks for ML-DSA 
- Check seed/key consistency when generating from a seed and the private
  key is also given.
- Improve error reporting when the private key does not match an
  explicit public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26865)
 2025-02-25 12:49:49 +11:00
Neil Horman
1eb5ffcdc8 Fix ci break on building quic with no-siphash 
SHARED_SOURCE doesn't pull in siphash if its disabled in the
configuration leading to undefined symbols, which we need for quic.

If siphash is disabled in the build, then pull it in via a SOURCE
addition, otherwise pull it in via SHARED_SOURCE

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26874)
 2025-02-23 17:16:03 -05:00
Neil Horman
ba90c49125 separate intval into separate variable in OSSL_PARAMS 
construction of int params holds a pointer to an int rather than an int
value, so we need to use separate variables when constructing separate
int params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)
 2025-02-22 14:29:56 -05:00
Neil Horman
3be71de4d9 Fix slh-dsa fuzzer on invalid param inputs 
oss-fuzz issue:
https://issues.oss-fuzz.com/issues/397734693

Fails because the fuzzer occasionaly provides inputs which drives the
fuzzer to create an octet-string for the context_string param which
violates the 255 byte constraint documented on that parameter.

Fix it by detecting that condition, expecting failure in the call to
EVP_sign_message_init, and bailing out when it occurs.

Fixes openssl/project#1109

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)
 2025-02-22 14:29:56 -05:00
Neil Horman
17d2fd0752 Use siphash to implement lcidm hash function 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
7dd821bab5 Add siphash to shared source for quic 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
6a9a9480a7 Update LCIDM lookups to include hash keys 
In preparation for using siphash in our hash function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
3e3942b42f Add random hash key value to lcidm struct 
This is in preparation for using siphash to compute lcidm hash table
values

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Bernd Edlinger
4d16d2f40a Re-enable RCU torture test on MACOSX 
This test was disabled due to "Stochastic failures in
the RCU test on MACOSX" by #23967, which sounds like an
issue that is probably fixed now.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26834)
 2025-02-22 17:43:15 +01:00
slontis
6e770d38c7 SLH-DSA - restrict keygen seed length to exact value of 3*n 
It was allowing the seed to be larger, and then just ignoring the
trailing bytes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26858)
 2025-02-22 22:46:44 +11:00
slontis
5b52a6395c SLH-DSA fixup tests to adjust the private key getter returning the 
public component

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)
 2025-02-22 21:25:03 +11:00
slontis
fa8d70bf75 SLH-DSA Update private key getter to also return public components. 
The private key is defined in FIPS 205 as containing the public key,
so we return this also. This also matches what happens in fromdata.

Updated Documentation for SLH_DSA.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)
 2025-02-22 21:25:03 +11:00
Pauli
0bdd10e407 doc: fixup FIPS self test names 
Missing names and categories in the documentation

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
5fd4ad73f0 fipsinstall: update tests to use corrent key gen test name 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
92a54f4d59 fips: update FIPS self test defines 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
b330d590b4 fips: refactor to unify the ST_KAT_PARAM -> OSSL_PARAM code 
This code was duplicated multiple times throughout the self tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
17b73561d5 fips: refactor ML-KEM tests so that key generation is separate 
Encapsulation and decapsulation remain as their own CAST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
a5cc141bbc fips: add key generation name for ML-KEM CASTs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Bernd Edlinger
51597e2ee6 Use linux-arm64 or the public ubuntu-24.04-arm runner image 
dependent on whether this runs on the openssl/openssl repository
or a clone.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26855)
 2025-02-21 15:36:25 -05:00
Andrew Dinh
704c3d3cd2 Various NULL checks 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643035
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643039
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643041
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643044
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643045
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643046

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26840)
 2025-02-21 15:07:27 -05:00
Dmitry Belyavskiy
17bbc16383 EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26832)
 2025-02-21 17:58:41 +01:00
Michael Baentsch
c535b28baf Update oqsprovider git submodule and start testing with it again 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26848)
 2025-02-21 17:17:54 +01:00
Clemens Lang
c338c89d16 Provide aliases to ML-DSA without dashes 
oqsprovider did not use dashes in the algorithm names for ML-DSA. Make
the transition smoother by also accepting the names without dashes as
aliases.

See also #26326 for the same thing for ML-KEM.

Signed-off-by: Clemens Lang <cllang@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26853)
 2025-02-21 17:04:41 +01:00
Bernd Edlinger
3240427a85 Make CRYPTO_atomic_load/store use the same preprocessor guards 
as the other CRYPTO_atomic_X functions.
All CRYPTO_atomic functions should use the same logic here,
just in case...

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Bernd Edlinger
eacf14594d Cleanup atomic fallbacks in threads_pthread.c 
the unused atomic stub functions make clang issue
unused function warnings -Wunused-function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Bernd Edlinger
00a173af77 Enhance thread sanitizer CI tests 
Related to issue #26798

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Tomas Mraz
347de0ab1f cross-compiles.yml: Disable FIPS for cross compiles 
When running tests things are too slow due to SLH-DSA POST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
03e9718a50 run-checker-daily.yml: Add memory sanitizer run with SLH-DSA enabled 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
5ae74ab47c make-test: No verbose tar output 
This just clutters the logs otherwise.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
612e3e8340 run-checker-daily.yml: Adjust the list of jobs 
Some of the disablables are already disabled by default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
2ecc87fc94 Disable SLH-DSA in memory sanitizer 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Cheng Zhang
db2c54cc92 Added new API to enable 0-RTT for 3rd party QUIC stacks. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26842)
 2025-02-21 12:01:30 +01:00
Andrew Dinh
8d69f4005b Use OPENSSL_strdup instead of strdup 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643038

Also NULL check for the allocation.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26843)
 2025-02-21 11:21:48 +01:00
Pauli
26fc6da358 fips: change SLH-DSA key generation to use a fast algorithm flavour 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26837)
 2025-02-21 12:22:56 +11:00
Pauli
ca26db30a0 slh-dsa: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
5811c0e8cf ml-kem: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
50f995ff8c ml-dsa: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
e36d00e53b fips: add function to detect if the self tests are running 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
slontis
92159b48e9 SLH-DSA coverity fixes. 
Fixes 1643092 and 1643093

Neither of these are major issues, but fixed anyway..

i.e. 1<<hm is bounded by the parameter set so this is not an issue
Not checking an error from WPACKET_memcpy() would also not cause an
issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26835)
 2025-02-21 09:12:02 +11:00
Tomas Mraz
560e586371 Refactor EVP_SKEY initialization 
Enforce that skeymgmt cannot ever be NULL in EVP_SKEY.

Also add missing allocation checks.

Fixes multiple issues found by Coverity.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26795)
 2025-02-20 20:35:59 +01:00
Shakti Shah
c9e56da777 Make org.openssl.winstore: work in openssl-ts 
Fixes #26739

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26833)
 2025-02-20 20:24:45 +01:00
Andrew Dinh
6b662bf0d6 Set op_num to 0 
Here, op_num is just used for logging purposes (number of completed operations), so start it at 0

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643034

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26829)
 2025-02-20 13:10:12 -05:00
Dmitry Belyavskiy
c152a94395 Fix coverity finding 
Coverity ID: 1643094

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26831)
 2025-02-20 16:28:22 +01:00
Andrew Dinh
a1c6e2d1b5 ssl_lib.c: Check for NULL from SSL_CONNECTION_FROM_SSL() 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643027
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643028

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26824)
 2025-02-20 15:30:25 +01:00
otherddn1978
e1a501a433 EC_get_buildin_curves does not return an error, this check is unnecessary. 
Found by Linux Verification Center (linuxtesting.org) with SVACE.

unused code has been removed

delete whitespace

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26719)
 2025-02-20 15:15:46 +01:00
Andrew Dinh
3820f2da7c NULL checks for QUIC code 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643033
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643032
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643031
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26825)
 2025-02-20 08:13:02 -05:00
Tomas Mraz
20ca6d4743 CI: ssl-trace is enabled by default 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)
 2025-02-20 10:48:54 +01:00
Tomas Mraz
9d8b18c74e test/quicapitest.c: Fix build with no-ssl-trace 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)
 2025-02-20 10:48:54 +01:00
Burkov Egor
c5eb70de75 fix: add check for NULL zalloc in tls-provider.c (reverse if statement) 
CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26814)
 2025-02-20 09:40:33 +01:00
Viktor Dukhovni
cab4e7cbd1 Configurable import-time PCT for ML-KEM 
And related cleanup.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26789)
 2025-02-20 18:21:40 +11:00
Pauli
f31b98fefe slh-dsa: use fast flavours for FIPS Power Up Self Test 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26821)
 2025-02-20 12:44:34 +11:00
Pauli
0da8140214 testutil: remove unused buffer from stanza structure 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
11f4eaf197 slh-dsa: update changes authorship 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
2440305e8f slh-dsa: add key generation tests 
These are reasonably fast so are not flagged as extended tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
8c2cc4eea9 slhdsa: add Python script to convert NIST ACVP data to evp_test format 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
73e01df48d slh-dsa: change the seed parameter name from entropy to seed 
This brings it inline with the same parameter for ML-KEM and ML-DSA.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
ac77e0697a evp_test: include signature generation and verification tests for SLH-DSA 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
9531a1de0f slh-dsa: add signature generation tests 
This marks the first use of the extended test feature in evp_test.
The reason behind this is the amount of time the full SLH-DSA tests consume.
The non-extended tests chosen so that they exercise all of the algorithms
at least once and all the varying combinations of features for the fast
algorithms.

On my build machine the full test suite takes: 290 seconds.
With the reduction to a dozen tests it takes: 10.5 seconds.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
8029960bbc slh-dsa: add signature verification failure tests 
These are fast and don't require reduction in number.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
f0417c6ebc evp_test: add a Verify-Message-Public test type 
This is like Verify-Message but accepts a public key instead of a private one.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
4439b8d3cc testutil: increase the line length for reading stanzas 
PQC algorithms and SLH-DSA in particular have very long lines of data.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
de194a6074 coverage: enable extended EVP tests 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
740e43f074 evp_test: add concept of extended tests to evp_test 
These tests are not run by default, instead they run when the EVP_TEST_EXTENDED environment variable
has an integer value other than zero.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Viktor Dukhovni
a4465bf694 More consistent ML-KEM key checks 
- Cross-check seed `z` value on import as well as load.
- In import/load When re-generating from a seed, check hash of any
  explicit private key when both provided.
- Avoid leak of expanded key encoding when load fails.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26812)
 2025-02-20 09:59:22 +11:00
Viktor Dukhovni
ff20db213d Typo fix 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26813)
 2025-02-20 09:50:53 +11:00
Neil Horman
c55114f680 Merge quic client and quic server interop CI 
Now that quic server is merged, we can merge the CI jobs that test the
client and server interop tests

Fixes openssl/project#1105

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26804)
 2025-02-19 15:57:25 -05:00
Cheng Zhang
966c9d3e98 Add the SSL_NO_EOED macro test 
test_no_end_of_early_data

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)
 2025-02-19 17:27:42 +01:00
Cheng Zhang
1b3f27f920 Add the SSL_NO_EOED internal macro 
The TLS EndOfEarlyData message is not applicable in some scenarios (e.g., QUIC).
This adds a macro to handle this message.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)
 2025-02-19 17:27:04 +01:00
Viktor Dukhovni
76e3fdd0f6 ssl3_ctrl(): Fix condition in SSL_CTRL_GET_PEER_SIGNATURE_NAME 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26819)
 2025-02-19 17:23:04 +01:00
Neil Horman
84694d2baa Relax checking of supported-groups/keyshare ordering 
quic interop testing showed that interop with the mvfst client was
failing, due to detecting mis ordering of supported groups and keyshare
extensions

This is strictly a mvfst problem to fix, but RFC 8446 indicates that we
MAY check the ordering but don't strictly have to.

We've opened an issue with the client to fix this, but in the interests
of client compatibility relax the ordering check so that, instead of
issuing a fatal alert, we just log a trace message indicating the
discrepancy

Fixes openssl/project#1106

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26818)
 2025-02-19 17:08:53 +01:00
Neil Horman
20a2f3beba Fix memory leak in ecdsa_keygen_knownanswer_test 
We allocate an EC_POINT with EC_POINT_new here, but in failing a
subsequent check, we don't free it, correct that.

Fixes #26779

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26799)
 2025-02-19 09:30:25 -05:00
slontis
5a1819a150 ML-KEM Add ACVP tests using latest values from 
https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/
Which are parsed using mlkem_parse.py

The existing BoringSSL related .txt files have been left in place.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)
 2025-02-19 11:50:56 +01:00
slontis
1f5ac721e3 ML-KEM: Modify existing ML-KEM keygen tests to not use custom data. 
There are general input and output controls that are used instead.
Also fix a memory leak in keygen.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)
 2025-02-19 11:50:56 +01:00
Pauli
94491369f2 ssl_test: correctly handle ML-DSA being disabled 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)
 2025-02-19 13:38:41 +11:00
Pauli
4ad13c48d7 mldsa: add run-checker workflow for no-ml-dsa option 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)
 2025-02-19 13:38:41 +11:00
Pauli
3230c0526d ml-kem: add ML-KEM to bulk disable cascade 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26807)
 2025-02-19 13:37:19 +11:00
Pauli
0a297bd23d ml-dsa: test ML-DSA under FIPS 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26805)
 2025-02-19 13:35:45 +11:00
Dmitry Belyavskiy
83ced5e6b1 Fix coverity issues 
Fixes coverity issues 1642964, 1642965, 1642966, 1642968, 1642969

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26793)
 2025-02-18 18:12:10 +01:00
Neil Horman
1636ae1a90 Free hashtable prior to freeing atomic worker_lock 
lhash_test uses a hashtable that may not be empty at the end of the test

Given that the free function frees the elements in the list and uses the
atomic worker_lock to do so, we need to free the hash table prior to
freeing the working lock to avoid the use of unallocated memory.

Fixes #26798

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26800)
 2025-02-18 16:40:24 +01:00
Frederik Wedel-Heinen
00fbc96988 Adds missing checks of return from XXX_up_ref(). 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26294)
 2025-02-18 16:32:59 +01:00
Tomas Mraz
e9aac2c2f3 Do not call BIO_printf() from FIPS_MODULE 
Fixes #26743

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26744)
 2025-02-18 16:31:45 +01:00
Dr. David von Oheimb
5cba362909 OSSL_CMP_MSG_http_perform(): support using BIO from OSSL_CMP_CTX_set_transfer_cb_arg() 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26628)
 2025-02-18 12:19:26 +01:00
Neil Horman
75bc132dec Initial slh-dsa fuzzer 
Current preforms the following operations

1) Generates arbitrary key pairs
2) Generates key pairs with parameters (both correct and incorrect)
   based on fuzzer input buffer
3) Exports and re-imports keys, confirming validity
4) Preforms Sign and Verify operations with optional parameters based on
   fuzzer input buffer

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26708)
 2025-02-18 10:24:02 +01:00
slontis
0e43652489 SLH-DSA: Add EVP_PKEY_CTX_dup() support. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26701)
 2025-02-18 10:17:29 +01:00
slontis
3fcefd51a1 SLH_DSA: Make apps.c do_X509_REQ_verify() call work correctly. 
- Added sigid_algs for SLH_DSA such that OBJ_find_sigid_algs() works.
- OBJ_sn2nid() was also being called, so the SN form of SLH_DSA
  algorithms needed to be added to the provider dispatch tables.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)
 2025-02-18 10:17:29 +01:00
slontis
7389cca079 SLH_DSA: Add support for generating X509 certs via the openssl 
command line app.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)
 2025-02-18 10:17:29 +01:00
slontis
67d52a555e SLH-DSA cleanups 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
0f0a836abd SLH-DSA More fixups 
Also added slh_dsa_key_dup()

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
8f86a75fcf SLH-DSA: Remove legacy ASN1 method tables for SLH-DSA. Update to use 
custom encoders for SLH_DSA decode_der2key.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
79e7c83711 SLH-DSA cleanups 
Addressed some review comments.
- Ref counting has been removed from SLH_DSA_KEY (EVP_PKEY is responsible
for the keys ref counting).
- Moved constants and prefetched objects into SLH_DSA_KEY.
- The SLH_DSA_HASH_CTX is still required since there are multiple
  contexts that need to propagate to a lot of functions, but it no
  longer contains the constants. Note that it also holds a pointer to
  the SLH_DSA_KEY.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
eba0e11c39 Add SLH_DSA key validation. 
The pairwise test requires that the computed PK_ROOT key matches the
keys PK_ROOT value. The public and private key tests just require the
key elements to exist.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
b8b67b1907 Add SLH-DSA FIPS self tests 
This requires a keygen test, as well as Sign/Verify tests for at least 1
sha2 algorithm and 1 shake related algorithm.

A pairwise consistency test has also been added to the key generation.

Note that self test datat for the signature is currently stored as a
sha256 digest in order to reduce the memory footprint.
(Since the signature size for sha2/shake using 128s = ~8K, and for 128f = ~17K)

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
a25bcde26a Add SLH-DSA encoder/decoder support. 
This required adding additional EVP_PKEY_ASN1_METHOD methods.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
db5846a7e0 Address style check nits for SLH-DSA 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
148f4d23e1 Update SLH-DSA code to use PACKET and WPACKET. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
ed77201a26 Update SLH-DSAto use EVP_PKEY_sign_message_init() instead of using the 
prehashed variant.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
acdd2c8bff Add SLH-DSA design document 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:26 +01:00
slontis
6de411963f Add SLH-DSA documentation 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:16:04 +01:00
slontis
5c2b404241 SLH-DSA clean ups 
- Make slh_dsa_sign() return the siglen when sig is NULL.
- Remove the ability in fromdata to generate the public key root
  given the private key and public key seed. This was messy and can
  be done by key generation instead.
- Add common EVP_PKEY gettablesto SLH_DSA keys
  (OSSL_PKEY_PARAM_BITS, OSSL_PKEY_PARAM_SECURITY_BITS, and
   OSSL_PKEY_PARAM_MAX_SIZE).
- Update tests based on the above changes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
ce3acbd07e Zeorize some secret values in SLH_DSA 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
30a55b0cf1 Added return code checks to SLH_DSA Hash functions and propogated the 
values thru the calling functions.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
5901ca87ba Add SLH_DSA to the FIPS provider. 
The keygen tests required "entropy" to be added via an additional
parameter for ACVP testing. This is required because TEST_RAND cant be
used to pass entropy to the FIPS provider, due to it not knowing the
lib ctx of the FIPS provider.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
e8457ce077 Add support for all 12 SLH-DSA parameter sets. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
e240d39c6c Add SLH-DSA signing. 
Also updated function comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
8f53b9b59d Add SLH-DSA key generation 
Also made fromdata able to generate the public root key if the private
key seed + prf as well as the public key seed are passed to from data.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
2f9e152d86 Add SLH_DSA signature verification. 
This uses a SLH_DSA_CTX that is passed to most functions.
It contains information related to a parameter set (such as constants,
hash functions, prefetched EVP_MD/EVP_MAC objects, as well as ADDRESS
functions). This context is seperated from the SLH_DSA_KEY since
multiple signature operations could be performed using the same keys.
This only implements functions required for SLH-DSA-SHA2-128s

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
34f4cacc8f Add base code to load a SLH_DSA public key. 
This loads a SLH_DSA public key from data.
A simple SLH_DSA keymanager imports this key.

Initially this only has a parameter set for
SLH-DSA-SHA2-128s

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
16395ee9cc Add SLH_DSA configuration option 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
Viktor Dukhovni
d5a4665a21 Case-insensitive sigalgs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26767)
 2025-02-18 14:24:57 +11:00
Pauli
2b7679b16d fips: omit PCT on key import 
Our lab thinks the IG 10.3.A additional comment 1 is a mistake and that
a PCT on import is not required.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26785)
 2025-02-18 10:11:42 +11:00
Neil Horman
a903be9cae Fixup error ennumeration 
The merge gives us a conflict on SSL_R_MISSING_QUIC_TLS_FUNCTIONS
which conflicted with SSL_R_LISTENER_USE_ONLY.  Move the former to
ordinal 423

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
b684545e73 Fix ssltrace test 
It seems something changed during the merge leading to a slightly longer
frame

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
8b0fbe224a Add ssl_unwrap.h to quic_tls_api.c 
Needed after the macro re-arranging performed on the quic-server branch

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
b360611ad6 Readd the inclusion of quic_record_util.h to quic_tls.c 
Some refactoring on master removed the inclusion of quic_local.h from
ssl_local.h, which quic_tls.c needed on the server branch to pull in the
QRL_SUITE_AES128GCM and simmilar definitions.  Fix it by specifcially
adding quic_record_util.h into quic_tls.c, as we only need a few defines
from that header.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
473e6bcb2c Fixup conflict between 3rd party quic-tls api and quic-server 
Build.info changes between quic-server and master occured here, resolve
them.  Can't do it as a fixup as the conficting changes have already
been merged to master

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Alexandr Nedvedicky
9eee58cce4 Backout validation of initial packet done by port_default_packet_handler() 
QUIC interoperability tests discovered bugs in my earlier commit #59e7c2313b.
This change reverts everything out.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26748)
 2025-02-17 11:27:34 -05:00
Alexandr Nedvedicky
c82c1dbbbb Perform initial AEAD validation before creating a channel 
We let port to create qrx object and use it for
packet validation. If packet validates, we then
create channel and pass pre-created qrx to channel's
constructor.

Co-authored-by: Andrew Dinh <andrewd@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26610)
 2025-02-17 11:27:34 -05:00
Andrew Dinh
029d85869f Add quic-server fuzz test. Also update fuzz corpora submodule. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26514)
 2025-02-17 11:27:34 -05:00
Neil Horman
5177484f19 Fix ossl_quic_trace to fetch connection short conn id len 
ossl_quic_trace currently fails to get the connection id when parsing a
short header.  now that we have an api to get the known length, go ahead
and use that to parse the header properly

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
164d3a6b59 Use the recorded short conn id len in pktsplitbio 
Do the same thing in our pktsplit bio

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
a55b689499 Use reported short conn id len in qtestlib 
Use the new short conn id internal api to record and use the connections
short conn id len when decoding packets in qtestlib

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
5b808e1d80 Add api to fetch short conn id len from a given channel/tserver 
Need an api to fetch the configured conn id len for short headers, add
that in here

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
7d5426c703 Move handling of connection close frames to QUIC FUTURE 
There is a corner case in handling connection close frames for which RFC
guidance is unclear.  Given that, move addressing it to QUIC FUTURE

Fixes openssl/project#1075

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
3f06ebcfe3 Eliminate SSL_LISTENER_FLAG_NO_ACCEPT flag in QUIC 
We've not implemented it yet, and don't need it for MVP, so move the
TODO's to QUIC FUTURE and remove the docs for it.

Fixes openssl/project#1074

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
a6f3110318 Move EAGAIN handling of QUIC retry/verneg frames to QUIC FUTURE 
Fixes openssl/project#1072
Fixes openssl/project#1073

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
a08e9aec1d Move implementation of RETIRE CONN ID frames to QUIC FUTURE 
Fixes openssl/project#1071

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
05ea15261c Move quictestlib TODO to QUIC FUTURE 
Improving handling of packets in tserver doesn't currently make sense,
as we're planning on eliminating it soon.  Move this TODO to QUIC FUTURE

Fixes openssl/project#1070

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
c536754fd0 move token store definition to quic_predef.h 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:34 -05:00
Neil Horman
35fb39da76 de-duplicate fnv1a_hash 
I cloned a copy of fnv1a_hash from hashtable.c.  Deduplicate that so we
have common source code.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:34 -05:00
Neil Horman
9d6e5a69db Remove NEW_TOKEN public api 
@sashan and I were discussing the usefulness of the public facing api
for NEW_TOKEN support, and he has concerns over its usefulness and our
being stuck with it if we need to make changes later.  Given that it is
a convience api for using multiple CTX-es to share a cache, its fine if
we remove it for now, as that seems like a less common use case.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
73b49e65fc init token to ease cleanup 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e732f4456a Remove SSL_TOKEN_STORE_HANDLE type 
Replace it with SSL_TOKEN_STORE and make the structure opaque in the
public api

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
f0e516522c Modify ossl_quic_get_peer_token to return QUIC_TOKEN 
we use this struct internally to track computed tokens, we may as well
use it when fetching those tokens, as it allows the removeal of the QTOK
type

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e521131c60 Rename token_store functions to make them consistent 
we use get0 to get a token store, but set to set it.  Since the latter
takes a refcount, change that to set1.  Also rename the interal quic
functions to match.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e8148315ca Review fixups 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
4f11f520d7 Fix a memory leak on free 
Forgot to free the CRYPTO_REF when freeing a token

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
642fde8616 Reduce our NEW_TOKEN send rate. 
Currently, we send a NEW_TOKEN frame on every new validated connection,
but thats not necessecary.  Since NEW_TOKEN tokens have a lifetime of 1
hour currently, we really only need to send a NEW_TOKEN if:
1) We validated a RETRY token
or
2) We validated a NEW_TOKEN for which the lifetime is nearing its limit

So lets do that.  When we validate a token, only generate a NEW_TOKEN if
the current token is a RETRY token, or if its a NEW_TOKEN, and there is
less than 10% of the tokens lifetime remaining.

This lets clients use NEW_TOKENS repeatedly (as per the RFC), and saves
us some network bandwith.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
c266322bd1 Don't reserve an unused cid for NEW_TOKENS 
Just realized that NEW_TOKEN tokens don't need a reserved rscid.

Because a client might use a received NEW_TOKEN for multiple subsequent
connections, we allocate a cid when we validate the token on new
connection establishment (in fact we just use the one that the client
sends).  As such the allocated rscid never gets used, and just sits
there until it ages out.

Instead, fill the rscid with random data to mutate subsequently
generated NEW_TOKENS's, since it won't ever be part of the validation
process anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
fce82b6ccc Reference count QUIC_TOKENS 
closer reading of RFC 9000 indicates that a NEW_TOKEN token can be
(re)used repeatedly.

so instead of creating a use once and discard pattern in the token api.
Let the tokens stick around until they are replaced with a new token
from the server.  To do this, we need to ref count the tokens so that we
don't accidentally free them while a given client is waiting to send an
initial frame making use of them.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
725074f4e7 Centralize freeing of tokens 
This will make it easier to refcount them in a moment

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
647fdf65c9 Schedule new token frame after handshake complete 
We don't want to schedule the NEW_TOKEN frame until such time as the
handshake is complete, otherwise we risk giving a token to validate a
future connection to a peer we haven't decided to trust yet

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
ebc52f1f02 Add test to confirm new token functionality 
Basically just create two clients and two servers, ensuring that both
clients use the same ctx (to share the token cache).

Connect the first client and server so that the cache gets populated
with a new token, tracing the ssl connection

Connect the second client and server, again tracing the connection with
the same bio

Then sift through the trace, looking for the new token frame in the
first connection, matching it with the token used in the second
connection.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
29e861a5a6 Add lookup for initial token assignment on channel start 
Start assiging initial tokens, and validating them on receipt

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
a2fe6435ca Enhance get_peer_token to not require memcpy 
Instead of copying the token thats store, return a pointer to it
along with a pointer to the token struct to free should we need to

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
38cb9ca1ad Add allocation of token cache on server contexts when needed 
the SSL_new_from_listener api creates a client SSL from a server
SSL_CTX context.  Normally server contexts need no token cache, but once
we start using it as a client, that changes.  Allocate one here when
needed

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
0f71ebec26 Augment client side recieve code to store NEW_TOKENS 
Start storing new tokens in our new cache

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
9a055c8917 extend internal api to allow for add/lookup token ops 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
3649a47f82 Add docs for token store manipulation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
b1828dc23a Add public api to create token cache for QUIC NEW_TOKENS 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e73f330e99 Add new token generation transmission 
When we bind a channel, create a NEW_TOKEN token to be sent on the next
available datagram, once the channel is validated

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
f13ef23371 Clean up a few further TODO(QUIC SERVER) 
These are either already implemented or not relevant for
the QUIC server MVP.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
1ed2ef07b3 Add build.info for QUIC server demo 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
1f23dbb62d We are not handling AEAD at port level for now 
-> TODO(QUIC FUTURE)

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
54dcb3740b ossl_quic_tserver_shutdown(): Remove TODO(QUIC SERVER) 
tserver code is not related to QUIC SERVER

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Neil Horman
c90cd1cfb5 update Dockerfile to pull hq-interop code from new location 
Change the dockerfile to use enable-hqinterop and copy binaries from
their new location

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
8875da1b23 Add hq-interop configure option 
Allow the building of the hq-interop client and server when we are
building our interop container

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
ec6200bf0f Move hq-interop code to test/quic-openssl-docker 
Its the only place we use this code, so put the code in that directory

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
10cd798688 Disable server address validation for resumption test 
The quic-interop runner expects a handshake message and certificate
exchange in the first 3 frames in this test.  The addition of server
address validation retry frames causes the test to fail.  Strictly
speaking this is a shortcoming of the test, but disabling address
validation allows the test to pass, and we have the mechanism, so
disable the feature.

Fixes openssl/project#1061

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26545)
 2025-02-17 11:27:33 -05:00
Neil Horman
b33851eb72 Update doc/man3/SSL_new_stream.pod 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26527)
 2025-02-17 11:27:33 -05:00
Neil Horman
17dc32c51b quic-hq-interop: Allow for retries if we've reached our max stream limit 
Several servers defer the sending of max stream frames.  For instance
quic-go uses a go-routine to do the sending after sufficient existing
streams have finished, while mvfst seems to wait for all outstanding
streams to be closed before issuing a new batch.  This result in the
client, if all streams are in use, getting a transient NULL return from
SSL_new_stream().  Check for the stream limit being reached and allow a
number of retries before giving up to give the server a chance to issue
us more streams.  Also dead-reckon the batch count of streams we use in
parallel to be 1/4 of our total number of available streams (generally
hard coded to 100 for most servers) to avoid using all our streams at
once.  It would be really nice to have an api to expose our negotiated
transport parameters so that the application can know what this limit
is, but until then we have to just guess.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26527)
 2025-02-17 11:27:33 -05:00
Neil Horman
5569e170ee Fix up some nits 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
c85c572206 remove check of pending in ossl_quic_free 
Not strictly needed

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
943b137c2c Remove vestigual accepted flag 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
f60a96a2b4 Fix more typos 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
3e124f4bdd Fix some typos 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
9c189782c9 update docs with reference to SSL_set_ex_data 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
56b6ab094e Attempt to use NULL listeners to avoid use after free 
As per @sashan suggestion, try pre-creating user ssls with a NULL
listener

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
ddfd561f3c Update man page to note limitations of callbacks for QUIC 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
6f38c59850 Fix memory leak in pre-allocated listeners 
We have a chicken and egg problem.

Normally when we create a connection object in quic, we associate it
with a listener, and up the ref on the parent listener, which is fine.

However, now that we are pre-allocating user_ssl objects for incomming
connections we have a situation in which:
1) The pre-alocated connection object holds a ref on the listener
2) The application has no awareness of the quic connection object (and
   so can't free it)
3) The freeing of the listener object never calls into the quic stack,
   because its reference count may hold references from connections that
   haven't been accepted yet

We could require that applications register a function for the
new_pending_conn callback, and track/free these pending connections, but
that seems like alot of extra unneeded work to place on the application

Instead:
a) add a quic_conn_st flag named accepted
b) When pre-allocating connections, clear the flag in (a) and _dont_
   hold a reference to the parent listener
c) in SSL_accept_connection, set the accepted flag and reference the
listener
d) in ossl_quic_free drop the listener reference only if the accepted
flag is set
c) expressly free all user_ssl objects in ossl_quic_port_drop_incoming

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
55f3968a49 Add changes.md entry noting the limitations of recursive SSL calls 
QUIC can't currently make recursive SSL calls, as it potentially results
in deadlock

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
7502df20bc rename new_pending_ssl to new_pending_conn 
Make it clear its only announcing connections, not streams

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
1abc48fae8 Run Make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
016ddac4da Add docs for new callback registration 
Add docs for SSL_CTX_set_new_pending_ssl_cb

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
a477b4ec16 Add a test to validate our new SSL_accept connection objects 
Quick test to validate that:

a) our new pending SSL accept callback works
and
b) That our callback passed SSL objects match those that are returned
by SSL_accept_connection

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
a607146904 Add a callback to announce newly created ssl waiting acceptance 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
57f5af6f4c Return channel tls from ossl_quic_accept_connection 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
f193e0e9fb use internal callback to generate user ssl 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
dc04a11cca Add callback to get user ssl on channel creation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
d79ef118db If server receives NEW_TOKEN frame, respond with PROTOCOL_VIOLATION 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26426)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
db1c857c07 Fix MARSHALLED_TOKEN_MAX_LEN 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26333)
 2025-02-17 11:27:33 -05:00
Hugo Landau
3686d215fe QUIC FUTURE: Add concurrency architecture design document 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26025)
 2025-02-17 11:27:33 -05:00
Neil Horman
15f859403e Fix sizing on variable in ossl-nghttp3-demo-server 
On working on a rebase for the quic-server branch, I noted that the
rebase was failing on the http3 server.  It occurs because the new CI
ubuntu container appears to have FORTIFY_SOURCE enabled and trips over
the call to read here.  Specifically the compiler notes that in passing
an int into the read syscall (which accepts a size_t as the 3rd
argument), may interpret a negative value as a very large unsigned value
that exeeds the size allowed by a read call.

Fix it by converting the size variable to a size_t to ensure that the
signing is correct

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26368)
 2025-02-17 11:27:33 -05:00
Alexandr Nedvedicky
0b15147a37 Implement SSL_new_from_listener() 
SSL_new_from_listner() creates QUIC connection object (QCSO)
from listener. Caller can use the object retuned from
SSL_new_from_listener() to connect to remote QUIC server.
The QCSO created here shares engine/port with listener.

the change is covered by `test_ssl_new_from_listener()` in
test/quicapitest.c

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26138)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
6bae611c99 Make quic interop tests pass with the demo server 
Included are also multiple style fixes.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26193)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
e9aa0b6c0e IPv6 support for quic interop 
Modify the QUIC HQ interop server/client to support both IPv4 and IPv6.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26194)
 2025-02-17 11:27:33 -05:00
Neil Horman
fcd8f8f7dd Disable address validation for throughput test 
The multiplexing test using quiche as a client seems to get confused
when server address validation is enabled.  specifically it writes the
wrong keys into its keylog file, causing the test to fail when tshark
can't decode the tls connection that is established.  Fix it by
disabling address validation for the multiplexing/transfer test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26198)
 2025-02-17 11:27:33 -05:00
Neil Horman
a99c76d94c Do read retries in quic hq-interop server 
Normally the throughput test in the interop harness requests several
hundred very small files, resulting in lots of small stream packets from
the client, which are nominally read in a single read operation (as they
typically fit into a single stream frame), and the server was written to
expect that.  However, its still possible, if a stream frame is packed
to the end of a datagram, that only part of its content is carried,
finished in a subsequent stream packet, which leads to a short read.

Augment the server to properly handle SSL_read transient failures so
that such an occurance is handled properly.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26198)
 2025-02-17 11:27:33 -05:00
Neil Horman
eabdcadefa Fix SSL_read error handling in http3 demo server 
The SSL_read error handling misses the ZERO_RETURN clause which is
non-fatal, correct that.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
861a322400 Correct copying of the url value 
When setting up the url value we copy data from memory regions that
overlap, it leads to bogus output, correct that.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
66e1e60a61 Preserve fileprefix accross reuse in http3 demo server 
The fileprefix that we serve content from needs to be preserved accross
h3ssl reuse.  Make sure we restore it after zeroing the struct.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
9570ecfc69 Add http3 test to the interop container 
Set fileprefix for interop container on http3 server test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
f851d8dfcc Encrypt the address validation token 
Store an EVP_CIPHER_CTX context with an ephemeral key set in port
and use it to encrypt/decrypt the validation token.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26165)
 2025-02-17 11:27:33 -05:00
Neil Horman
f42036822e removing debug code from quic_impl 
I had experimented with starting the ssl handshake during accept, and
forgot to remove it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
6d25809cd0 Fix typo 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
d11c5b78af augment CI to run ampilficationlimit tests 
NOTE: Do this for the server test as well after rebase when http3
commits get merged

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
86c3c16c3b modify docker endpoint to not do address validation on transfer test 
quic interop uses the transfer test as part of the amplificationlimit
test, and as such we can't do address validation with retry frames
there, as the test requires it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
d1c3bb2f74 Add tracking of receive credit for unvalidated connections 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
eaa1a143ae Add unvalidated credit tracking to packetizer 
Add data to track how much unvalidated credit we are sending and
receiving until such time as we are validated.  Validated conditions
are:

1) A retry token is sent, received, and validated
2) a handshake is completed on the connection

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
b441d20a2f Add a warning that disabling server validation is not recommended 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
f443b4048d Clarify that this validation only relates to retry packets 
Disabling server address validation here only relates to new connections
that arrive without a token.  Future connections using tokens provided
by the server via NEW_TOKEN frames will still be validated

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
78f7141c12 Disable server address validation on interop handshake test 
The handshake test in the interop suite requires that no server address
validation be preformed, so disable it for this test

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
60762be09b Add a public flag to disable address validation on listeners 
Now that we have the infrastructure to skip address validation, add a
public flag to SSL_new_listener and SSL_new_listener_from to allow the
skipping of address validation on selected quic listener SSL objects

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
0746d4628e Add quic port flag to turn off address validation 
Give us the infrastrucute to skip addr validation on the server

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
207892d022 Enhance port binding to allow connections without odcid 
If we opt not to do server address validation, we have no odcid
and therefore never reserved a local cid

We need to follow the initial code path to generate one

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
9fc0d25b09 SSL_free() does check for != NULL (thanks Sashan) 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
b8e462c8e3 Fixes according Sashan review. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
887f6c06a1 port the 2 improvement suggested by @nhorman to help to run the 
quic-interop-runner.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
53ceb451b6 Arrange the code following the reviews. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
43ccd96da6 Fix small things from the review. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
ecf6701907 Add <sys/socket.h> for OpenBSD. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
fe2a51bfda typo in comment. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
1b11d7cf67 Arrange the remove_id() logic to be able to remove multiple stream. 
create a new h3conn in read_from_ssl_ids() when we have a new
connection.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
7492a44391 Arrange macox errors. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
a50a6efd07 make check style happy. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
511c37b88c Arrange the logic: 
SSL_poll() without SSL_POLL_FLAG_NO_HANDLE_EVENT ticks for each stream
we have in SSL_poll() that prevents the server logic to get all events
Use SSL_poll() with SSL_POLL_FLAG_NO_HANDLE_EVENT and
SSL_handle_events() prevents the problem.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
6ba49e30d8 read_from_ssl_ids() before wait_for_activity if something was received 
before and the first time we are in the loop.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
fe3e4bbb4f Arrange poll logic and get it working with chrome. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
76d8bf6f58 Allow to send some files to test with browsers. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
2d080ca544 Use something like wait_for_activity() from demos/quic-server-non-block.c 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
2b271d0f85 Augment RETRY validation token 
Adds fields to the QUIC RETRY packet validation token:
timestamp, remote_addr, odcid, & rscid.

Also adds functionality to validate the token once returned by the client.

Note that this does not encrypt the token yet.

Also check that the RSCID stored in the RETRY validation
token matches the DCID in the header.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26048)
 2025-02-17 11:27:33 -05:00
Neil Horman
4d2912749e Determine which packet to drop for retry 
When doing a retry after a version negotiation, we actually need to drop
packet 1 rather than 0 to get a retransmit of the initial packet

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Neil Horman
2f01b09408 Fix length check for datagram size in quic 
RFC says we should only accept datagrams of at least 1200 bytes, so the
check should discard anything under that, not over that

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Neil Horman
fd50924d01 Augment quic interop harness to support server side interop tests 
the quic-interop-runner that we use for interop testing currently only
supports openssl client testing, as we had previously not had a server
to test with.

This PR rectifies that by doing the following:
1) Adding a quic-hq-interop-server.c file in demos/guide
2) Augmenting our interop Dockerfile and entrypoint to support our
   interop containter running in a server role

With these changes we are able to do server side interop testing

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Matt Caswell
6d1646c66e Add documentation for BIO_dgram_set0_local_addr() 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26066)
 2025-02-17 11:27:33 -05:00
Matt Caswell
16a19002d8 Add the ablity to set a local address for BIO_dgram_pair 
BIOs created from a BIO_dgram_pair don't normally have a local BIO_ADDR
associated with them. This allows us to set one.

Fixes openssl/project#933

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26066)
 2025-02-17 11:27:33 -05:00
Neil Horman
128619a43b Make version negotiation packets use network byte order 
@t8m pointed out that versino negotiation packets weren't guaranteeing
network byte ordering in the array of supported versions.

Convert the client to use network byte order on send and receipt.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
c7b82a7250 Fixup tests to properly check version negotiation 
Currently the quic_multistream_test tests version negotiation..sort of.

It uses a packet injector to force the tserver to send a version
negotiation packet back to the client.  Thats no longer needed as the
server will respond to an invalid version properly.

So alter script_74 to, instead of using the injector, use a quic channel
mutator to invalidate the version provided in the initial packet.  Then
we attempt to connect.  If the server responds with a version
negotiation packet and the client restarts with the proper version, then
the test passes, as the connection is extablished.

Also, while we're in here, update the gen_version_neg function to
properly insert a 0 version into the packet header for script_75, as
version negotiation packets require that to be set, otherwise script_75
will fail now when the server notices this discrepancy.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
78702fb7d6 Handle the receipt of version negotiation packets 
On the client side, when we get a version negotiation packet, we need to
interrogate the supported version list from the server, and either:
1) drop the connection if we don't see a version we can work with

2) select a supported version and try the negotiation again

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
bc4c7cf554 Add port version negotiation response from server 
If the server receives an Initial packet with a version number we don't
support (currently a fixed check for QUIC_VERSION_1), instead of
dropping it, respond with a version negotiation packet to the peer

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
5fdd623df3 Allow packetizer to accept an arg to set protocol version 
In preparation for doing version negotiation, expose the ability to have
the packetiser for QUIC set a configured protocol version.  We only set
it to QUIC_VERSION_1 for now, but it allows for us to set different
protocols in the future.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
2784112e9a Augment ossl_quic_wire_decode_pkt_hdr 
In preparation for supporting the handling of version negotiation, we
need to be able to detect why the decoding of quic header failed.
Specifically, ossl_quic_wire_decode_pkt_hdr fails if the version
provided in the header isn't QUIC_VERSION_1.  We want to keep that, as
we don't support anything else, but the server code needs to
differentiate when we fail decode because of a version problem, vs some
other more fatal malforming issue.

So add a uint64_t *fail_cause pointer that gets filled out with a
failure cause.  We only use VERSION failures right now, but we can
expand this later if needed

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
sashan
41fe7a2b8e SSL_inject_net_dgram() should return result of ossl_quic_demux_inject() 
This got introduced by #595288251b (QUIC APL: Ensure APL
functions use correct prologue)

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25659)
 2025-02-17 11:27:33 -05:00
Neil Horman
35f1917f2d Include RETRY_CID transport parameter when handling retried connection 
After sending a retry frame from a server, the subsequent server hello
record must include the RETRY_SCID transport parameter, as per RFC 9000:
https://datatracker.ietf.org/doc/html/rfc9000#section-7.3

Implement the encoding of said retry_source_connection_id transport
param, and fix up tests to address the impact of that change.  Test
changes amount to:
1) quicapitest needs to have its tparam test augmented such that it
   doesn't inject the retry_scid on its own, as the quic stack does it
   for the test now
2) quicapitest needs to have the ssl_trace test adjusted so the expected
   record values are reflected.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Neil Horman
1c6e1e1c9c Select proper ORIG_DCID when sending server hello over quic 
When establishing a connection over quic, if the channel is established
in response to a retry request from the server, the ORIG_DCID transport
parameter must reflect the original dcid sent from the client in the
first inital packet that the server sent the retry request in response
to.

As opposed to establishing a connection without the retry request, when
address validation isn't in use, where the ORIG_DCID parameter just
represents the the dcid that the client sent.

Augment the channel creation code to select the 'right' DCID when
encoding server side transport parameters

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Neil Horman
6654f8bb42 Generate initial packet keys based on new dcid for addr validation 
When using retry packets in QUIC to implement address validation, the
2nd inital packet that arrives after the server sends the retry frame
will have its CRYPTO packet encrypted using keys derived from the new
dcid, rather than the dcid in the 1st initial packet.  Update the
channel creation code to update those keys on the server so that the
CRYPTO packet is decrypted successfully

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Saša Nedvědický
6ba0457c92 Implement Server Address validation using retry packets 
RFC 9000 describes a method for preforming server address validation on
QUIC using retry packets.  Based on:
https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.5.2

We do the following:
1) Client sends an Initial packet without a retry token
2) Server abandons the initial packet and responds with a retry frame
   which includes a retry token and integrity tag and new SCID
3) Client send the initial packet again, updating the encryption keys
   for the connection based on the SCID sent in (2), using it as the new
   DCID, including the retry token/tag provided in (2).
4) Server validates the token in (3) and creates a new connection using
   the updated DCID from the client to generate its encryption keys

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
c4cd137047 Update QUIC related man7 pages for the added server functionality 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25834)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
417a8e8812 Remove extra FD_SET 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25532)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
0237f21e03 Add a guide for demo QUIC non-blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25532)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
6cb1b4e89e SSL_poll(): Handle blocking with no poll items 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
b7e1d375f1 poll_builder.c: Minor fixes and optimizations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
5031f1b196 Add quic_lock() calls for functions called from poll_translate_ssl_quic() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
44aab1ff84 Ensure WSAStartup() before calling WSASocketA() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
0e470373ad ossl_rio_notifier_init(): Add error messages 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
89134200b8 SSL_poll(): Report result_count for failed events 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
84dbca4df0 QUIC: Immediate-Mode Polling various fixups 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
b20f557021 QUIC: Update SSL_poll documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
0c7063bb6f QUIC: Glossary updates 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
567a9eed65 QUIC RADIX: Use enhanced blocking support when testing 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
7b2eb52473 QUIC RADIX: Test listener polling support 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
381a2b5789 QUIC RADIX: Test new SSL_poll functionality 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
0601469dd6 QUIC MULTISTREAM TEST: Remove test that blocking SSL_poll doesn't work 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
53225c9c3d RIO: Amend SSL_poll code to correctly register blocking operations for inter-thread notification 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
f2fff144d7 QUIC POLLING: Add support for polling listeners 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
67df6bd936 RIO: Amend SSL_poll to support blocking on QUIC objects 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
caa3446eef RIO: Add poll builder to support immediate-mode polling API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
643d149696 QUIC APL: Add support for registering blocking operations to support polling code 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
7f2adb82b1 QUIC REACTOR: Add utility for tracking recursive blocking operations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
5d3720dcb6 QUIC REACTOR: Add support for external registration of blocking operations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
d9d4d84ceb Add demo QUIC non-blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25431)
 2025-02-17 11:27:33 -05:00
Matt Caswell
76af88a621 Use the reactor from ctx.obj for net read/write desired implementations 
The ossl_quic_get_net_write_desired() and
ossl_quic_reactor_net_read_desired() implementations can be used by
listeners. But in that case there is no ctx.qc object present. Instead we
should use the reactor from ctx.obj which will work also for a listener.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25642)
 2025-02-17 11:27:33 -05:00
Matt Caswell
034fa85ced Add a test for early ticking 
Ensure that we don't inadvertently start the connection if we call
SSL_handle_events(), or SSL_get_event_timeout() early.

This adds a test for #25054, which was originally fixed by #25069 to
ensure we haven't broken anything by the changes in the previous commit.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25452)
 2025-02-17 11:27:33 -05:00
Matt Caswell
4af6bcd69c Always tick the QUIC_ENGINE regardless of the state of a connection 
Just because one connection has not started yet, it does not mean that
we should not tick the QUIC_ENGINE. There may be other connections that do
need ticking.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25452)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
9dfacaa82a Add a guide for demo QUIC blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25361)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
dad45ea769 Adds a new demo blocking QUIC server for use with the existing demo QUIC clients 
Remove util/quicserver.c

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25465)
 2025-02-17 11:27:33 -05:00
Matt Caswell
3a75cf8d9c Remove an obsolete comment 
The comment is no longer accurance so it can be removed

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25457)
 2025-02-17 11:27:33 -05:00
Matt Caswell
ac69d0649a Simplify the QUIC time override handling 
Centralise the storage of the override in the QUIC_ENGINE rather than in
the QUIC_CONNECTION. We can now set the override on any type of QUIC SSL
object as needed.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25457)
 2025-02-17 11:27:32 -05:00
Viktor Dukhovni
f23da50318 Handle a couple of NULL QUIC ctx.qc values 
Now that we also QUIC server (listener) handles, we may have a NULL quic
connection (ctx.qc), and so need to either return early or handle the
NULL `qc` gracefully.

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25432)
 2025-02-17 11:27:32 -05:00
Alexandr Nedvedicky
73d7de128b QUIC Concurrency API: Various minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
54fd5e113b Minor fix for Windows 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ccbf3f6ecb QUIC RADIX: Test domain functions as well 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
62f91f2f25 QUIC: Add basic domain flags test 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b93fb2d177 Assorted bugfixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
89fa427504 Doc fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
269409c75b Allow use of socketpair, WSASocketA 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2c9953bbd3 Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
9c1bd44f1d RIO NOTIFIER: Fix symbol usage 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2c70693e92 QUIC OBJ: Require blocking support in the domain flags to use blocking mode 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5eecb6b619 make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c4d516db6a QUIC: Update listener documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
3896bff051 QUIC: Add documentation on concurrency model 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2dae861fe0 QUIC: Document SSL_new_domain, etc. 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
db590923c1 QUIC APL: Refine domain flag handling 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
960b8449cb QUIC CHANNEL: Notify other threads when needed 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fa4a8e8871 QUIC REACTOR: Allow ticks to schedule notifications of other threads 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5dade08ed1 QUIC ENGINE: Notify when ticking 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1c89357d75 QUIC REACTOR: Inter-thread notification 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ae26f1eed6 QUIC APL: Default domain flags 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6bc47aa65f QUIC REACTOR: Integrate RIO NOTIFIER 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
14516cd5a4 RIO: Add OS notifier 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5a6898db3a QUIC APL: Use domain flag to determine thread assisted mode 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
50c7796267 QUIC APL: Add support for configuring domain flags 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f75b3d1db6 QUIC APL: Add QUIC Domain SSL Object: Implementation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
907759818e QUIC APL: Add QUIC Domain SSL Object: Basic Definitions 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Jean-Frederic Clere
a31dfb0ee6 ossl-nghttp3-demo-server.c: Fix compatibility with various clients 
Fixes openssl/project#752

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24946)
 2025-02-17 11:27:32 -05:00
Jean-Frederic Clere
73977a0424 Add a demo HTTP3 server using the quic server support and nghttp3 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24749)
 2025-02-17 11:27:32 -05:00
Hugo Landau
362cc00d6a QUIC Polling Design: Fix nits 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
51771dad69 QUIC Polling Design Document: Rename OSSL_ -> SSL_ for consistency 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1be93781e8 QUIC Polling Design: Move around sections a bit 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e0a66263c2 QUIC Polling Design: Add discussion/rethink of event types 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
0288567452 QUIC Polling Design: minor fixups 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e6f062601b Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8b4b5048ee Minor fixes and hardening 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
20eb1b656b QUIC Server Demo: Use IPv4 only 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6330a78638 Copyright header 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e88f03f193 QUIC APL: Make QCTX comments clearer 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b35712db6c Minor doc fix 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
0723a3ac0c Minor update 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a55d8b8b71 QUIC APL: Connection acceptance is an I/O operation 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
87d474660c QUIC APL: Support SSL_inject_net_dgram for listeners 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
640a32afcf QUIC: Clarify SSL_new_listener API in docs 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2176e0467e QUIC APL: When creating a default XSO, no further streams can arrive after connection terminastion 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8df5b725ef Fix markdown 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
05e0eae202 QUIC APL: Ensure incoming stream data can be drained after connection closure 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
368fc8d486 QUIC: Add demo for QUIC server usage 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8a6bb6b639 QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compat 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f1ade90a66 QUIC PORT: Ensure reactor waits for listening port correctly 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
390403abf8 QUIC REACTOR: Ensure no assertion failure or deadlock if called when unable to wait 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
01b151fbca QUIC RADIX TEST: Ensure connection acceptance does not block 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1e73a3ca9f QUIC APL: Support blocking connection acceptance 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
60c9ce78f5 QUIC APL: Unify event handling mode into QUIC_OBJ 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fdc13a9e4e QUIC APL: Unify blocking mode handling for all object types 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
38df4b1976 QUIC APL: Ensure APL functions use correct prologue 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
67d43a7af5 QUIC APL: Make prologue function names more descriptive 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8110737e42 QUIC APL: Refactor API call prologue code 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
cbd10ff618 QUIC RADIX: Fix simple_conn test 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24064)
 2025-02-17 11:27:32 -05:00
Hugo Landau
458018f3e6 Minor fix 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf8ce68c33 QUIC APL: Fix default stream creation on server side 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2399678797 QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compat 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
17727841d1 QUIC: Avoid ticking before a connection is established 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a3b1982e8a Fix nit 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
eda445e13d Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
03ca681728 Add README for QUIC demos directory 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fe1029d16b Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2b21d3ac18 Amend README 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
05f0960e1f QUIC RADIX: Add keylogging support 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
cbfc09d994 QUIC RADIX: Minor fixes 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
646c20d034 QUIC RADIX TEST: Quiet warnings about uninitialized variables 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
08c5d856b6 QUIC RADIX: Add test of multithreading functionality 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
dc2bff5e58 QUIC RADIX: Add README 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
4a2d5fe812 QUIC RADIX: Add RADIX test framework implementation 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ea236623c8 testutil: Allow overriding output BIOs thread-locally 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c12ae88e10 QUIC RADIX: Add recipe 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
eef93d24ee QUIC RADIX: Add build configuration 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
57496767a8 test/build.info: Ensure QUIC tests are properly disabled in no-quic builds 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
48db230a88 Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
04cec3d65e Minor doc fix 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
68537fceae QUIC APL: Avoid having a mutex variable where not needed 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
63984f276c QUIC OBJ: Use QUIC_OBJ pointer for parent references 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
477ff82236 Post-rebase fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c69ce7fcf1 QUIC APL: Fix bug around default XSO handling on server side 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f4cfa1b9cc QUIC APL: Fix refcounting for listeners 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
99e4a1e3ce QUIC PORT: Allow QUIC_PORT to throw away incoming connections 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
88804f3181 QUIC APL: Fix server API bugs discovered during test 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e3ba554d73 QUIC APL: Implement SSL_get0_listener 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2e582648c5 QUIC APL: Free listeners correctly 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
882c77e93e QUIC APL: Fix QUIC_TLS free order 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
d2ee7ceff0 Minor fix to BIO refcount handling 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
d1e81ca94c Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
7efebeb172 QUIC APL: Add TODOs for unfinished listener APIs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
56b59e7837 QUIC: Add manpage for listener API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
745a779fb2 make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1aea7a2429 QUIC APL: Refactor block_until_pred 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
15f9df40ff QUIC APL: Implement base listener API, move addressing mode handling into PORT 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
3a9cedc20f QUIC APL: Rework QCTX to support listener calls 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a68287adeb QUIC APL: Add skeleton listener API methods 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b67be72a5d QUIC APL: Add skeleton listener API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6d1d52cef5 QUIC APL: Make use of QUIC_OBJ infrastructure 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf55326752 libssl: Move SSL object unwrapping macros to separate header 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1137f3f9ae QUIC APL: Introduce the QUIC_OBJ base type and infrastructure 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e0ffd21e22 QUIC APL: Introduce QUIC listener SSL object type (QLSO) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ce1315140b Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
19c55d559f Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf52454f2d Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1599defd74 Updates to polling design document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
9b149bb201 QUIC Polling Design Document: Add TOC 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
332cc89bb8 QUIC: Update glossary 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c996bdcd91 QUIC Polling Design Document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
4e63896f5a QUIC: Minor updates to server API design document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:31 -05:00
Hugo Landau
f07ba7bccd QUIC: Server API Design Document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:31 -05:00
Dmitry Belyavskiy
340f50b01f Remove redundant define 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26755)
 2025-02-17 16:38:08 +01:00
Viktor Dukhovni
22ab2a72d4 Consolidate ML-KEM and ML-DSA codecs 
These previously duplicated some code and structures, now shared.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26764)
 2025-02-17 15:14:10 +11:00
Viktor Dukhovni
594cef49b4 Accessors for the IANA signature scheme name 
This is the official name of the signature algorithm(s) used by the peer
and/or local end of the connection, and should be available, e.g. for
logging.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26738)
 2025-02-17 15:08:25 +11:00
Viktor Dukhovni
3d57bbb8ca Add ML-KEM long names 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26763)
 2025-02-17 14:58:05 +11:00
Neil Horman
7d284560a0 Don't use __ATOMIC_ACQ_REL on older compilers 
Older compilers don't always support __ATOMIC_ACQ_REL, use a lock where
they don't

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/26747)
 2025-02-16 15:09:03 -05:00
Viktor Dukhovni
afc64c240f Address non-FP coverity nits 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26765)
 2025-02-16 14:48:01 -05:00
Simo Sorce
fc00d9b7b1 Add additional EVP_SKEY helpers 
EVP_SKEY_is_a() allows to check if a key is of a specific type.
EVP_SKEY_to_provider() provides an easy way to move a key to a
different provider.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Simo Sorce
71debb7b84 Allow import of unknown keys via generic type 
This allows to use SKEY even w/o a specific skey managment available,
however it bears the risk of allowing users to mispell the key type
and not see the error of their ways until they expect a specific
provider to pick this up and fail.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy
df93d1327a skeyutl command line utility 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy
00bdee8974 Opaque keys support for the openssl command line 
Support EVP_SKEY object for the `enc` command.
Support EVP_SKEYMGMT for the `list` command.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
759570bfed Implement EVP_MAC_init_SKEY 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Simo Sorce
787a083d42 Add skeymgmt helper to fetch from a provider 
This allows to fetch efficiently directly from the same provider that can
handle the EVP_SKEY at hand.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Simo Sorce
5c16da0c18 Add generic secret skeymgmt provider, skey abstraction and default skeymgmt 
This commits adds an actual skey wrapper structure and skeymgmt
implementation for the default provider

This allows to use fallbacks for any SKEY operation,
and to use it for keys that do not have a specific purpose and
cipher-suite associated to it.

Add a test with a key type that does not have skey support (DES),
to show that the fallback works.

Add raw skey test

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
b9d919f697 EVP_SKEY documentation 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
9422ab6a7e EVP_SKEY tests 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
d46e010cd2 EVP_SKEY implementation for EVP_CIPHER 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
45f9d271cd Design document of using opaque object as symmetric key 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Andrew Dinh
c0cf783178 Add an initial ML-DSA fuzzer 
Add an initial version of an ML-DSA fuzzer.  Exercises various ML-DSA
appropriate APIs. Currently it is able to randomly:

1. Attempt to create raw public private keys of various valid and invalid sizes
2. Generate legitimate keys of various sizes using the keygen api
3. Perform sign/verify operations using real generated keys
4. Perform digest sign/verify operations using real generated keys
5. Do an export and import of a key using todata/fromdata
6. Do a comparison of two equal and unequal keys

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26685)
 2025-02-15 11:13:38 -05:00
Dmitry Belyavskiy
4ca80d3941 When we try to get a group, we need session to be valid 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26722)
 2025-02-14 18:24:19 +01:00
slontis
7cf5300e6b dgst commandline support for one shot signing algorithms 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26697)
 2025-02-14 18:22:01 +01:00
slontis
bd8954bfe5 ML-DSA: Change ossl_ml_dsa_key_public_from_private() to check that the 
decoded value of t0 matches the calculated value of t0.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26681)
 2025-02-14 18:02:28 +01:00
Pauli
51ca035abb doc: fix typo/paste error 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26650)
 2025-02-14 17:49:53 +01:00
Viktor Dukhovni
a39dc27c25 Log name of provided peer temp keys 
Log the peer's temp key name when it is from a provider.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26734)
 2025-02-14 17:14:53 +01:00
Pauli
21f92ecf7c rand: avoid property query manipulations 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
9fef9b194c sslapitest: include hybrid KEM tests with FIPS 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
7c45e7a6c8 fips: include ML-KEM capabilities in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
2e898497a6 fips: add hybrid KEM algorithms to the FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
b6c5342613 evp: add additional functions for FIPS internal use to support hybrids KEMs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
53e3a54b60 evp: include one shot keygen functions for internal FIPS use 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
27b597113f mlkem: include hybrid KEM algs in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
765b2b0857 mlkem: include hybrid KEYMGMT algs in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
236d5d8f72 fips: FIPS ignores property queries for internal algorithm fetches 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Viktor Dukhovni
0554bddd4f Refactor squeezing out empty tuples 
This is more efficient if multiple empty tuples are present, and may
also help to avoid Coverify false positives.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26732)
 2025-02-15 02:08:49 +11:00
Sebastian Andrzej Siewior
c71c65b922 SPARC assembly: Don't file aes-cbc on T4 with small sizes. 
The "openssl speed -testmode -seconds 1 -bytes 1 aes-128-cbc" test
revealed that the assembly code is crashing if length is less than 16.
The code shifts the provided length by 4 and than subtracts one until
the length hits zero. If it was already zero then it underflows the
counter and continues until it segfaults on reading or writing.

Replace the check against 0 with less than 15.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25637)
 2025-02-14 11:42:35 +01:00
Xi Ruoyao
f48c14e94e LoongArch: Fix output file name detection for Perl scripts 
We were using the first (or second) argument containing a '.' as the
output name file, but it may be incorrect as -march=la64v1.0 may be in
the command line.  If the builder specifies -march=la64v1.0 in the
CFLAGS, the script will write to a file named "-march=la64v1.0" and
cause a build error with cryptic message:

    ld: crypto/pem/loader_attic-dso-pvkfmt.o: in function `i2b_PVK':
    .../openssl-3.4.1/crypto/pem/pvkfmt.c:1070:(.text+0x11a8): undefined reference to `OPENSSL_cleanse'

Adapt the approach of ARM and RISC-V (they have similar flags like
-march=v8.1-a or -misa-spec=2.2) to fix the issue.

Signed-off-by: Xi Ruoyao <xry111@xry111.site>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26717)
 2025-02-14 11:35:23 +01:00
Tomas Mraz
0575755eaf ssl_test.c: Allow using DHE with TLS-1.2 and older versions 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Tomas Mraz
c59f5f1210 Make test_ssl_new execute tests with fips provider again 
This has regressed with
https://github.com/openssl/openssl/pull/24799

The test configs have to be generated differently based
on the fips provider version.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
6ab87724e6 Left over doc TODOs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
cedc5bcce2 Post-merge make update 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
b3dd681f07 Two more private key checks. 
- When a PKCS#8 has both seed and key cross check the implicit
  rejection value |z|

- When an import (EVP_PKEY_fromdata call) provides both a private
  and public key, fail if the redundant public key does not match
  the copy in the private key.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26656)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
2ea9903c16 Reject import of private keys that fail PCT 
- Also added a provider "validate" method that wraps the PCT test.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26656)
 2025-02-14 10:50:59 +01:00
Neil Horman
f0be0521d1 Update corpora to include ml-kem seed corpus 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26657)
 2025-02-14 10:50:59 +01:00
Neil Horman
f440e816d0 Add an inital ML-KEM fuzzer 
Add an inital version of an ML-KEM fuzzer.  Exercises various ML-KEM
appropriate apis, as a fuzzer does.  Currently it is able to randomly:

1) Attempt to create raw public private keys of various valid and
   invalid sizes
2) Generate legitimate keys of various sizes using the keygen api

3) Preform encap/decap operations using real generated keys

4) Do a shared secret derivation using 2 keys

5) Do an export and import of a key using todata/fromdata

6) Do a comparison of two equal and unequal keys

Its not much to start, but it should be fairly extensible

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26657)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
096fde92e7 ASN.1 format tagging seed, key now octet string 
- The main ASN.1 private key syntax is the one from Russ Housley's post
  on the LAMPS list, subsequently amended to tag the seed instead of the
  key (each of the three parameter sets will have a fixed size for the
  `expandedKey`):

    ML-DSA-PrivateKey ::= CHOICE {
      seed [0] IMPLICIT OCTET STRING SIZE (64),
      expandedKey OCTET STRING SIZE (1632 | 2400 | 3168)
      both SEQUENCE {
        seed OCTET STRING SIZE (64),
        expandedKey OCTET STRING SIZE (1632 | 2400 | 3168) } }

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26639)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
0fb5a78acd More polish and renamed codec tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
5b2d996f91 Implement seed/key preference when decoding 
- Moved the codec code out of `ml_kem.c` into its own file in
  the provider tree.  Will be easier to share some code with
  ML-DSA, and possible to use PROV_CTX, to do config lookups
  directly in the functions doing the work.

- Update and fixes of the EVP_PKEY-ML-KEM(8) documentation, which
  had accumulated some stale/inaccurate material, and needed new
  text for the "prefer_seed" parameter.

- Test the "prefer_seed=no" behaviour.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
cc5403f33a Fix code comment typo 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
d70edce5bc Check ML-KEM text encoding 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
fc225d9fb7 Test ML-KEM in FIPS module only when ML-KEM is enabled 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
1811f990f9 ML-KEM encoder and decoder tests 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
318994a121 ASN.1 ML-KEM private key format 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
869903c07c Improved import and export 
- On import, if a seed is provided, the keys are regenerated.

- The seed is exported as a separate "seed" parameter, when available.
  The "ml-kem.retain_seed" parameter is also exported, when false.

- The seed is optionally dropped after key generation.
    * When the "ml-kem.retain_seed" keygen parameter is set to zero.
    * When the "ml-kem.retain_seed" keygen parameter is not set to 1,
      and the "ml-kem.retain_seed" provider config property is set
      explictly false.

- The exported private key parameter "priv" is always the FIPS 203 |dk|.

- Private key decoding from PKCS#8 produces a transient "seed-only" form
  of the key, in which "retain_seed" is set to false when the
  "ml-kem.retain_seed" provider config property is set explictly false.
  The full key is generated during "load" and the seed is retained
  or not as specified.

- Import honours the "ml-kem.retain_seed" parameter when specified, or
  otherwise honours the provider's "ml-kem.retain_seed" property.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
9a79d4088f Zeroise temporary secrets while doing ML-KEM 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26456)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
003309c376 ML-KEM implementation cleanup/speedup 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26341)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
b818a99839 Encoders and Decoders for ML-KEM 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26341)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
4a377f04b2 Temporarily disable oqsprovider testing 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
9fdb2a0c2d libssl: Accept any key management which implements the group 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
8dbe1adbd1 Update oqs-provider to the latest commit 
The oqs-provider testing is fixed so it doesn't fetch OpenSSL
implementations during its testing inadvertently.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
ba20b3adee Provide alias names for ML-KEM algorithms without dashes 
Fixes #26326

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Pauli
16870d9a90 test: add fipsinstall corruption tests for KEMs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
d4f0bd379f fips: add pairwise consistency test for ML-KEM key generation 
This is mandated by FIPS 140-3 IG 10.3.A resolution 14

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
073b9f2b1e self_test: add ML-KEM test description 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
96b89c6adb doc: update documentation now that ML-KEM is in the FIPS provider 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
302fdaaf35 doc: remove ML-KEM line because it doesn't have an indicator associated with it 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
b8835e874d test: run ML-KEM tests for both default and FIPS providers 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
3c9b0ca13c tests: run ML-KEM tests in FIPS builds too 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
ff40a08dee fips: add ML-KEM to the FIPS provider 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
7057138f0f fips: defined for ML-KEM CASTs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
289c168996 update build infrastructure for ML-KEM in the FIPS provider 
Also avoid a file name conflict when adding ML-KEM to the FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
5510d96f82 Clear param array to ensure it's initialised properly 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26339)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
4b1c73d2dd ML-KEM hybrids for TLS 
- When used as KEMs in TLS the ECDHE algorithms are NOT subjected to
  HPKE Extract/Expand key derivation.  Instead the TLS HKDF is used
  as usual.

- Consequently these KEMs are just the usual ECDHE key exchange
  operations, be it with the encap ECDH private key unavoidably
  ephemeral.

- A new "MLX" KEM provider is added that supports four hybrids of EC/ECX
  DH with ML-KEM:

    * ML-KEM-768 + X25519
    * ML-KEM-1024 + X448
    * P-256 + ML-KEM-768
    * P-384 + ML-KEM-1024

- Support listing of implemented TLS groups.

  The SSL_CTX_get0_implemented_groups() function and new
  `openssl list -tls-groups` and `openssl list -all-tls-groups`
  commands make it possible to determine which groups are
  implemented by the SSL library for a particular TLS version
  or range of versions matching an SSL_CTX.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26220)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
95d764a044 Prepare to detect side-channels in compiled ML-KEM code 
Loosely based on similar code in BoringSSL.

Added the valgrind macros necessary to mark secret inputs as uninitialised on
entry to the ML-KEM keygen, encap and decap functions.  The inputs and outputs
are then untagged before control returns to the caller, where, at least in the
case of tests and protocols that check whether the derived keys succeeded in
decoding a key-confirmation message, there will at some point be a branch based
on the *content* of the compute shared secret.

When a build is configured with `-DOPENSSL_CONSTANT_TIME_VALIDATION`, and
various tests that use ML-KEM are run under:

    $ valgrind --tool=memcheck --error-exitcode=1 --exit-on-first-error=yes cmd [args]

any internal secret-data-dependent branches added by a mis-optimising
compiler, or inadvertently introduced into the source code would cause
the tests to fail, exposing the side channel.

Since the side-channels are liable to depend on the compiler and
selected optimisation flags, tests would need to cover a few combinations.

    * clang vs. gcc
    * debug builds
    * default builds
    * -O2
    * -O3 -fno-vectorise (a problem with clang in "clangover")
    * -Os (was a problem with clang in "clangover")
    ...

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26270)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
e04a604d0d Remaining batch of ML-KEM-related doc updates 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26217)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
7772dbb17c Initial batch of ML-KEM doc updates. 
With the soon-to-be-merged ML-KEM #26172 as the merge base.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26217)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
63e9a3b1f3 Fix code and docs of pkeyutl en/decapsulation 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26281)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
653fc2189d ML-KEM libcrypto implementation polish 
* Core ML_KEM constants in new <openssl/ml_kem.h>

* Renamed variant ordinals to ML_KEM_<bits>_VARIANT, freeing
  up the unadorned ML_KEM_<bits> names.

* Fewer/cleaner macros in <crypto/ml_kem.h>

* Fewer/cleaner macros for setting up the ML_KEM_VINFO table.

* Made (d, z) be separate inputs to the now single key generation
  function.  Both or neither have to be NULL.  This supports potential
  future callers that store them in a different order, or in separate
  buffers.

    - Random values are chosen when both are NULL, we never return the
      generated seeds, rather we may, when/if (d, z) private key support
      is added, store these in the expanded key, and make them available
      for import/export.

* No need for a stand-by keygen encoded public key buffer when the
  caller does not provide one (will ask for it later if needed).
  New `hash_h_pubkey` function can compute the public hash from
  the expanded form in constant space (384 bytes for 12-bit encoded
  scalar).

* Simplified code in `scalar_mult`.

* New `scalar_mult_add` adds the product to an existing scalar.
  Used in new `matrix_mult_transpose_add` replacing `matrix_mult_transpose`.

* Unrolled loop in `encode_12`.

* Folded decompression and inverse NTT into vecode_decode, the three
  were always used together.

* Folded inverse NTT into former `matrix_mult` as `matrix_mult_intt`,
  always used together.

* New gencbd_vector_ntt combines CBD vector generation with inverse NTT
  in one pass.

* All this makes for more readable code in `decrypt_cpa` and especially
  `genkey()`, which no longer requires caller-allocated variant-specific
  temporary storage (just a single EVP_MD_CTX is still needed).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26236)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
b99e1a9736 Polish ML-KEM kem provider. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26236)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
d2136d9e73 Multi-variant ML-KEM 
This introduces support for ML-KEM-512 and ML-KEM-1024 using the same
underlying implementation parameterised by a few macros for the
associated types and constants.

KAT tests are added for ML-KEM 512 and 1024, to complement the previous
tests for ML-KEM-768.

MLKEM{512,768,1024} TLS "group" codepoints are updated to match the
final IANA assigments and to make the additional KEMs known to the TLS
layer.

The pure-QC MLKEMs are not in the default list of supported groups, and
need to be explicitly enabled by the application.  Future work will
introduce support for hybrids, and for more fine-grained policy of
which keyshares a client should send by default, and when a server
should request (HRR) a new mutually-supported group that was not
sent.

Tests for ML-KEM key exchange added to sslapitest to make sure that our
TLS client MLKEM{512,768,1024} implementations interoperate with our TLS
server, and that MLKEM* are not negotiated in TLS 1.2.

Tests also added to excercise non-derandomised ML-KEM APIs, both
directly (bypassing the provider layer), and through the generic EVP KEM
API (exercising the provider).  These make sure that RNG input is used
correctly (KAT tests bypass the RNG by specifying seeds).

The API interface to the provider takes an "const ML_KEM_VINFO" pointer,
(obtained from ossl_ml_kem_get_vinfo()).  This checks input and output
buffer sizes before passing control to internal code that assumes
correctly sized (for each variant) buffers.

The original BoringSSL API was refactored to eliminate the opaque
public/private key structure wrappers, since these structures are an
internal detail between libcrypto and the provider, they are not part of
the public (EVP) API.

New "clangover" counter-measures added, refined with much appreciated
input from David Benjamin (Chromium).

The internal steps of "encrypt_cpa" were reordered to reduce the
working-set size of the algorithm, now needs space for just two
temporary "vectors" rather than three.  The "decap" function now process
the decrypted message in one call, rather than three separate calls to
scalar_decode_1, scalar_decompress and scalar_add.

Some loops were unrolled, improving performance of en/decapsulate
(pre-expanded vectors and matrix) by around 5%.

To handle, however unlikely, the SHA3 primitives not behaving like
"pure" functions and failing, the implementation of `decap` was modifed:

- To use the KDF to compute the Fujisaki-Okamoto (FO) failure secret
  first thing, and if that fails, bail out returning an error, a shared
  secret is still returned at random from the RNG, but it is OK for the
  caller to not use it.

- If any of the subsequently used hash primitives fail, use the computed
  FO failure secret (OK, despite no longer constant-time) and return
  success (otherwise the RNG would replace the result).

- We quite reasonably assume that chosen-ciphertext attacks (of the
  correct length) cannot cause hash functions to fail in a manner the
  depends on the private key content.

Support for ML-KEM-512 required adding a centered binomial distribution
helper function to deal with η_1 == 3 in just that variant.

Some additional comments were added to highlight how the code relates to
the ML-KEM specification in FIPS 203.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26172)
 2025-02-14 10:50:57 +01:00
Michael Baentsch
78df1c1f61 Initial ML-KEM documentation 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26037)
 2025-02-14 10:50:57 +01:00
Andrew Dinh
42436eb53e Add ML-KEM-768 KATs from BoringSSL 
Add KATs for ML-KEM-768 under CCLA from https://boringssl.googlesource.com/boringssl/

These KATs test key generation, encapsulation, and decapsulation for the
ML-KEM-768 algorithm.

Relevant notes:
- Added functionality to the ML-KEM key management to export/import. These may not
  be fully implemented yet (see openssl/openssl#25885)
- Exposed some more low-level ML-KEM API's to the provider implementation to
  allow for deterministic encapsulation/key generation
- Actually run 'mlkem_internal_test' with `make test`

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25938)
 2025-02-14 10:50:57 +01:00
Michael Baentsch
96a079a03f Add ML-KEM-768 implementation 
Based on code from BoringSSL covered under Google CCLA
Original code at https://boringssl.googlesource.com/boringssl/+/HEAD/crypto/mlkem

- VSCode automatic formatting (andrewd@openssl.org)
- Just do some basic formatting to make diffs easier to read later: convert
  from 2 to 4 spaces, add newlines after function declarations, and move
  function open curly brace to new line (andrewd@openssl.org)
- Move variable init to beginning of each function (andrewd@openssl.org)
- Replace CBB API
- Fixing up constants and parameter lists
- Replace BORINGSSL_keccak calls with EVP calls
- Added library symbols and low-level test case
- Switch boringssl constant time routines for OpenSSL ones
- Data type assertion and negative test added
- Moved mlkem.h to include/crypto
- Changed function naming to be in line with ossl convention
- Remove Google license terms based on CCLA
- Add constant_time_lt_32
- Convert asserts to ossl_asserts where possible
- Add bssl keccak, pubK recreation, formatting
- Add provider interface to utilize mlkem768 code enabling TLS1.3 use
- Revert to OpenSSL DigestXOF
- Use EVP_MD_xof() to determine digest finalisation (pauli@openssl.org)
- Change APIs to return error codes; reference new IANA number; move static asserts
  to one place
- Remove boringssl keccak for good
- Fix coding style and return value checks
- ANSI C compatibility changes
- Remove static cache objects
- All internal retval functions used leading to some new retval functions

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25848)
 2025-02-14 10:47:46 +01:00
Viktor Dukhovni
605b82d7ee Post-merge make update 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
9a6bbf6169 Ensure we accept the IANA name for sigalgs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
7d2d153f9d ML-DSA: Add TLS certificate test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
dd1d010130 MLDSA: Fix no-ml-dsa configure option. 
Added to 'bulk' group and CI

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Matt Caswell
cc699ace92 Drop the session and PSK test from the clienthellotest 
This test doesn't really give us much that the other tests don't already
achieve. Added to that the ClientHello is nearly too long for it to work
reliably. Small changes in the ClientHello length make this test break.
So this test is too brittle with little value - so we drop it.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Matt Caswell
a0fc1ff348 Teach SSL_trace() about ML-DSA 
Ensure the ML-DSA based sigalgs are recognised by SSL_trace()
Also ensure the test_ssl_trace test passes correctly.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
36f10925ff ML-DSA: Add TLS-SIGALG capability to support ML-DSA signatures 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Pauli
6797e02907 ml-dsa test: update ML-DSA key generation tests 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
fb15378fe7 ml-dsa test: update ML-DSA signature verification tests to cover μ inputs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
4e94dc07a9 ml-dsa test: update ML-DSA signature generation tests to cover μ inputs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
7b95d20d48 test: update the ACVP test data parser to include tests that use μ 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
55738c1520 ml-dsa: allow signature operations to be provided a μ value 
The μ value replaces the message and avoids some of the preliminary
processes.  This is part of FIPS 204.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
e2323b1a13 params: add OSSL_SIGNATURE_PARAM_MU to param names 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
e894887d6c doc: document OSSL_SIGNATURE_PARAM_MU for ML-DSA 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
edb3824604 Fix docs/comments with ASN.1 private key syntax 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
8cc7ebf6fe Reject private keys with an incorrect pk hash 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
3138976041 Make the ML-DSA seed gettable as documented 
- Also fix the get_params keymgmt function to always return what's
  available.  Requested, but unavailable, parameters are simply left
  unmodified.  It is not an error to request more than is present.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
5421423ef9 Flexible encoders for ML-DSA 
- Same UX as ML-KEM.  The main ASN.1 private key syntax is the one from
  Russ Housley's post on the LAMPS list, subsequently amended to tag the
  seed instead of the key (each of the three parameter sets will have a
  fixed size for the `expandedKey`):

    ML-DSA-PrivateKey ::= CHOICE {
      seed [0] IMPLICIT OCTET STRING SIZE (32),
      expandedKey OCTET STRING SIZE (2560 | 4032 | 4896)
      both SEQUENCE {
        seed OCTET STRING SIZE (32),
        expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) } }

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26638)
 2025-02-14 10:46:04 +01:00
slontis
1036be4384 ML_DSA: Make apps.c do_X509_REQ_verify() call work correctly. 
- Added sigid_algs for ML_DSA such that OBJ_find_sigid_algs() works.
- OBJ_sn2nid() was also being called, so the SN form of ML_DSA
  algorithms needed to be added to the provider dispatch tables.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26636)
 2025-02-14 10:46:04 +01:00
Pauli
f207938711 endecoders: make ML-KEM endecoders have fips=yes property 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
036ac183ab doc: ML-DSA is in the FIPS provider too, so update docs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
f56dc1f968 test: update endecode test in light of ML-DSA being in the FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
756527b89c ml-dsa(fips): add ML-DSA key generation self test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
cd430bf5da ml-dsa(fips): add power up signature self tests for ML-DSA-65 
This added self tests for ML-DSA.  IG 10.3.A.15 requires known answer
tests for both signing and verify.  This adds them.

The signature generation is constructed to encounter all three of the rejection
loop tests that are relevant for ML-DSA-65.  The message has been generated
so that:

    * it fails the z_max rejection test on iteration one
    * it fails the r0_max rejection test on iteration two
    * it fails the h_ones rejection test on iteration three
    * it successfully generates the signature on iteration four

It is thus an optimal self test in terms of iterations and coverage.

Key generation self tests will be dealt with separately.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
63282ea4ac ml-dsa: document self test names 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
2b6dd88645 ml-dsa: add FIPS self test macro 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
521f2c284f test: run ML-DSA tests on FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
519814602b ml-dsa: add PCT for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
a8956e22d9 ml-dsa: add to FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
29d14eeb2e ml-dsa: add more to internal header 
The ossl_ml_dsa_key_get0_libctx() and the various size macros are better in the intneral header

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
3e914a8a7a fips: build ML-DSA for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
f8dc008254 fips: build ML-DSA for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
01222cfadf build: fix copy/paste mistake 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
a437ba2c08 Add ML-DSA to the FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
slontis
1cacc56137 ML-DSA Add digestsign tests - The digest must be NULL 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:04 +01:00
slontis
808fccb721 ML_DSA Add support for generation of X509 certificates using the openssl 
commandline.

In order to support this gettables are required in both the key and
signature.:

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:04 +01:00
slontis
c83e6c0a2c ML-DSA Updates to encoders required because of changes on the master 
branch.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:03 +01:00
slontis
d9ffc11939 Add ML_DSA encoders 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:03 +01:00
Pauli
aebcb3658f ml-dsa: avoid param builder 
Using param builder consumes more resources and it is only beneficial
when dealing with bignums.  Directly using the param helpers is a better
alternative.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26529)
 2025-02-14 10:46:03 +01:00
slontis
30b6650e1d ML-DSA: coverage testing fixups 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26505)
 2025-02-14 10:46:03 +01:00
slontis
d711ea967d ML-DSA Add coverage tests 
Also remove some ACVP test data from ml_dsa.inc since this is now
also done using evp_test.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26505)
 2025-02-14 10:46:03 +01:00
slontis
2ca319684c Add ML-DSA design document. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26400)
 2025-02-14 10:46:03 +01:00
slontis
6184259849 Add ML-DSA documentation 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26400)
 2025-02-14 10:46:03 +01:00
slontis
5a1caef900 ML-DSA encoder fixups 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26483)
 2025-02-14 10:46:03 +01:00
slontis
87728deddf ML-DSA: Add python utility used to parse ACVP test data. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
aabb69b8ba ML-DSA: Fix endian issue in ossl_ml_dsa_poly_sample_in_ball(). 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
f92855441f ML-DSA: Add evp_test support for ML-DSA ACVP test vectors. 
The evp_test line buffer was increased to 32K to deal with the large
lines required for PQ messages and signatures.
The test data files were generated by parsing AVCP test files using
a python script.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
c848506cd4 ML-DSA: Add support for dup. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
2cb4b0c781 ML_DSA: Fix partially uninitialised hint buffer. 
The encoded hint data consists of omega + k bytes.
The bytes at the end of omega section of the buffer may be 0,
so the buffer must be cleared initially.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
df231a88ab Add ML_DSA encoders 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
fcffbbe192 ML-DSA fixups 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
Viktor Dukhovni
a2391f3aa5 Add ML-DSA-44 and ML-DSA-87, fix endian issues & add fixups 
- Make data encoding work on big-endian systems.

- Fix some ML-DSA-44 specific bugs related to w1-vector bits
  per-coefficient, overall size and high-bits rounding.

- Use "do { ... } while (pointer < end)" style consistently.

- Drop redundant reference counting of provided keys.

- Add parameter blocks for ML-DSA-44 and ML-DSA-87 and turn on
  associated provider glue.  These now pass both keygen and
  siggen tests (to be added separately).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
3ab7409f3d Add ML-DSA sign/verify 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
efd7c96856 ML_DSA: Use pointers instead of arrays for polynomials in Vectors and Matrix. 
A DSA_KEY when created will alloc enough space to hold its k & l
vectors and then just set the vectors to point to the allocated blob.

Local Vectors and Matricies can then be initialised in a similar way by
passing them an array of Polnomials that are on the local stack.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
d3a7ae64b3 Add ML-DSA Keygen support 
The key generation algorithm requires a significant portion of the many
algorithms present in FIPS 204.

This work is derived from the BoringSSL code located at
https://boringssl.googlesource.com/boringssl/+/refs/heads/master/crypto/mldsa/mldsa.cc

Instead of c++ templates it uses an ML_DSA_PARAMS object to store constants such as k & l.
To perform hash operations a temporary EVP_MD_CTX object is used, which is supplied with a
prefetched EVP_MD shake128 or shake256 object that reside in the ML_DSA_KEY object.

The ML_DSA_KEY object stores the encoded public and/or private key
whenever a key is loaded or generated. A public  key is always present
if the private key component exists.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
Bernd Edlinger
5949918f9a Rework and simplify RCU code 
Use __ATOMIC_RELAXED where possible.
Dont store additional values in the users field.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)
 2025-02-13 20:23:48 +01:00
Bernd Edlinger
65787e2dc2 Revert "rcu: Ensure that updates to the ID field of a qp don't lose refs" 
This reverts commit fbd34c03e3.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)
 2025-02-13 20:23:33 +01:00
Tomas Mraz
4b4333ffcc Test openssl ecparam -list_curves 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26525)
 2025-02-13 11:19:02 +01:00
Tomas Mraz
8f416ba9b0 ecparam: process -list_curves before reading input 
Fixes #26519

This is a regression from commit 1dbb67c4

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26525)
 2025-02-13 11:19:02 +01:00
Josh Soref
7a8fe56da8 Fix arithmetic in a comment 
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26707)
 2025-02-13 10:42:39 +01:00
Alexey Moksyakov
e4b899f53c [vpsm4_ex][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
110f1afd12 [vpsm4][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
1e42e76dda [sm3][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
85a8e97a76 [poly1305][aarch64] Extend address range by adrp + add 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
45579e8e58 [bsaes][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
15b011e0be [chacha_sve][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
d5c208b610 [sm4][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Viktor Dukhovni
6f3ada8a14 Address coverity reports 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26703)
 2025-02-12 12:14:04 -05:00
Tomas Mraz
dfd177b776 ossl_rand_ctx_new(): Use OPENSSL_strdup instead of strdup 
Fixes Coverity 1642620

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26641)
 2025-02-12 17:44:51 +01:00
Dr. David von Oheimb
b45e035bf7 X509_STORE_CTX_get1_issuer(): make happy path quicker again 
Fixes #26588

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26600)
 2025-02-12 08:07:57 -05:00
Dr. David von Oheimb
5ebd6d26a8 x509_vfy.c: refactor parameter of get0_best_issuer_sk() and adapt its use by build_chain() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26600)
 2025-02-12 08:07:57 -05:00
Dr. David von Oheimb
c8932aa94f http_client.c: fix error and default case handling in OSSL_HTTP_REQ_CTX_nbio() state machine 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:11:03 +01:00
Dr. David von Oheimb
64b478419a http_client.c: fix OSSL_HTTP_REQ_CTX_nbio() to return content on non-fatal HTTP status code >=400 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
6de09ebe13 http_client.c: fix redirection in OSSL_HTTP_REQ_CTX_nbio() when non-ASN.1 content is expected 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
920dd8a72e http_test.c: small beautifications 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
efb621941a http_client.c: distinguish better between request/response header and body, in particular when tracing 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:41 +01:00
Dr. David von Oheimb
91114d53b0 http_client.c,OSSL_HTTP_REQ_CTX.pod,http.h: fixups for PR #23781 on max_response_hdr_lines 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:09:40 +01:00
Dr. David von Oheimb
153adbc540 remove parts of OSSL_HTTP_transfer.pod that are better described in OSSL_HTTP_transfer.pod 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:09:40 +01:00
Simo Sorce
0ba139f4b9 Add documentation to explain DRBG changes 
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:50:53 +01:00
Simo Sorce
d037551ee3 Change also other DRBG's algorithm fetching 
- DRBG_HASH
- DRBG_HMAC

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Dmitry Belyavskiy
29d02206f3 Filter provider should return proper provctx 
...instead of the default one
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Simo Sorce
c9a2ce6111 Prefer DRBG ciphers from the same provider 
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Ingo Franzki
0e93f64723 test/quicapitest.c: Increase timeout of test_fin_only_blocking to 40ms 
Running this test on heavily loaded systems may cause the SSL_read_ex() to
take more than 20ms, due to concurrent workload.

Increase the timeout to 40ms to allow a little bit more time.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26693)
 2025-02-11 13:04:03 -05:00
Matt Caswell
e2bfb61f61 Add a test for configuring provider certs via config 
A bug existed where provider added cert algorithms caused a crash when
they were configured via a config file. We add a test for this scenario.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)
 2025-02-11 17:36:21 +00:00
Matt Caswell
9cbaa8763c Fix configuring provider certificate algs via config file 
A crash could occur when attempting to configure a certificate via a
config file, where the algorithm for the certificate key was added
dynamically via a provider.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)
 2025-02-11 17:36:21 +00:00
Matt Caswell
c21e213b97 Enable the quic-tls API to work, even in the case of no-quic 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
0c3e1f25b2 Add a test for the quic-tls API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
198e5a847a Add a CHANGES.md entry 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
e6bb7eaee0 Add documentation for the new third party QUIC stack API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
3cf15554f2 Add an API for other QUIC stacks to use our TLS implementation 
We provide some callbacks for third party QUIC stacks to use in order
to be able to reuse the OpenSSL TLS implementation in that stack. This is
essentially a thin wrapper around the same API that OpenSSL's own QUIC
stack uses in order to integrate TLS.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Viktor Dukhovni
3252fe646b Avoid calling ssl_load_sigalgs in tls1_set_sigalgs_list 
- The signature algorithms are already loaded in SSL_CTX_new()

- Calling ssl_load_sigalgs() again is non-productive, and does
  not look thread safe.

- And of course avoiding the call is cheaper.

- Also fix broken loop test in ssl_cert_lookup_by_pkey()

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26671)
 2025-02-12 03:13:07 +11:00
Neil Horman
cf9d6685fd Update CHANGES and NEWS for security release 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
 2025-02-11 08:36:29 -05:00
Viktor Dukhovni
739c4b2e92 Use ERR marks also when verifying server X.509 certs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
 2025-02-11 08:26:51 -05:00
Viktor Dukhovni
6ae8e947d8 With SSL_VERIFY_PEER client RPK should abort on X509 error 
While RPK performs X.509 checks correctly, at the SSL layer the
SSL_VERIFY_PEER flag was not honoured and connections were allowed to
complete even when the server was not verified.  The client can of
course determine this by calling SSL_get_verify_result(), but some
may not know to do this.

Added tests to make sure this does not regress.

Fixes CVE-2024-12797

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
 2025-02-11 08:26:44 -05:00
Dave Kelsey
d69c014608 Add support for multiple key shares 
This PR is the implementation of concluded discussion that occurred in a
draft PR #25605. This changes were mainly authored by @martinschmatz
with some contribution from myself.

It addresses issue #21633

This extends the group list definition to support a more complex
definition while still retaining backward compatibility with the simple
form of colon separated groups.

Details of the agreed format and expected behaviour can be found in
#25605 and in the documentation changes.

Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26445)
 2025-02-10 11:43:56 -05:00
Zhiguo Zhou
78991c9e37 Revise CHANGES.md 
The performance impact on Intel Sierra Forest is documented.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
0f6a3b8ef6 Remove unnecessary flag clearance in crypto/x86_64cpuid.pl 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
b41e0bf168 Fix the checks of factor_size/modulus_bitsize 
The factor_size/modulus_bitsize are required to be 1024/1536/2048.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
c18b6f4c52 Dual 1024/1536/2048-bit exponentiation optimization for Intel Sierra Forest CPU 
It optimizes the RSA-2k/3k/4k via the AVXIFMA ISA on Sierra Forest.
The performance improvements of 1.8x-2.2x are observed in the speed
tests of sign and decryption operations on this CPU.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Dmitry Misharov
78d252889b add workflow dispatch inputs into coveralls workflow 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26645)
 2025-02-06 14:12:38 -05:00
Auto Vincent
becc0078f8 Fix compile error when building VC-WIN64-CLANGASM-ARM target 
With MSVC v143, C++ Clang Compiler for Windows (18.1.8) there are
many errors similar to:

crypto\aes\libcrypto-lib-aesv8-armx.obj.asm:3795:7: error: unknown token in expression
        ld1     {v2.16b},[x0],#16

CLA: trivial

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26603)
 2025-02-06 17:29:39 +01:00
sashan
fd6f27bdd5 perlasm: Replace .previous with the actual previous section 
Older versions of darwin (10.8 and earlier) don't understand .previous.
this tweak emits the previous section directive which preceeds the
rodata (for example .text) instead of using .previous. We use the
same for mingw.

Fixes #26447

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26585)
 2025-02-06 17:25:15 +01:00
Pauli
d46667284d changes: add note about the new provider random hook 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
b6a6eb6807 libcrypto.num: add RAND_set1_random_provider function 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
5bda5de88b style: fix style problems 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
6b518fef38 Add test case for RAND_set1_random_provider() call 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
888073e2e8 document provider random bypass ability 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
815416ba8d document internal ossl_provider_random_bytes rand funtion 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
b1cca25999 Add support for random provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
5b5c24d99e Document random_provider option in random section 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
c6ec045137 Document RAND_set1_random_provider() API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
4636a39503 Add RAND_set1_random_provider() API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
37172e2ab8 Add a new provider API to generate random numbers. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
f096fe4b98 Resolve undefined behaviour in wpacket test 
There is no necessity for rand_data to be aligned so that it can be
directly dereferenced as a uint64_t.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Dr. David von Oheimb
b1775ba4c9 80-test_cmp_http.t: on test failures also print failed client invocations 
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)
 2025-02-03 08:36:10 +01:00
Dr. David von Oheimb
e7c6c5e088 80-test_cmp_http.t: on test failures print Mock server STDERR output 
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)
 2025-02-03 08:34:46 +01:00
Dr. David von Oheimb
12baad7ed4 80-test_cmp_http_data/Mock/test.cnf: further relax total_timeout as workaround for heavily loaded test systems 
Fixes #26577

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26584)
 2025-01-31 11:56:31 +01:00
Kazuki Yamaguchi
aa52ec9b0a Use ASN1_INTEGER_get_int64() in ossl_serial_number_print() 
A -1 return from ASN1_INTEGER_get() indicates both success and error.
Our man page calls out this ambiguity. Use ASN1_INTEGER_get_int64()
instead, which has a better error reporting and also a platform
independent behavior with respect to sizeof(long).

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26557)
 2025-01-28 21:06:51 +01:00
Kazuki Yamaguchi
6f1dbaf7d2 Fix pretty-printing empty serial number in ossl_serial_number_print() 
Fix a crash when the ASN1_INTEGER has empty content. While it is
illegal, this is the initial state of the serialNumber field when an
X509 object is allocated by X509_new(). X509_print*() should be able to
process an incomplete X509 object too.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26557)
 2025-01-28 21:06:51 +01:00
Bartel Artem
93d366bea6 EVP_DigestSign(): Check pctx != NULL 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26551)
 2025-01-28 21:03:46 +01:00
Billy Brumley
f1a4f0368b [providers/implementations/ciphers] make aes-gcm-siv work with zero-length messages 
test cases lifted from RFC 8452

fixes #26431

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26535)
 2025-01-28 21:02:14 +01:00
Josh Cooper
4f20de0c8a Open pem files in binary mode 
In order to avoid an MSVCRT bug affecting ftell and text mode[1], open PEM files
in binary mode. The PEM parser already handles CRLF translation[2].

[1] 8300a8742b
[2] https://github.com/openssl/openssl/pull/24249#issuecomment-2192025429

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)
 2025-01-28 20:57:14 +01:00
Josh Cooper
ed3ce75457 Revert "Work around Windows ftell() bug as per Microsoft engineering's suggestion" 
This reverts commit 8300a8742b.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)
 2025-01-28 20:57:14 +01:00
Viktor Dukhovni
a69288d04a Clarify docs of EVP_CIPHER*_get_block_size 
Also, tolerate NULL input ctx, just like NULL cipher.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26561)
 2025-01-28 23:09:15 +11:00
Viktor Dukhovni
de578a8a6a ossl_provider_prov_ctx is redundant 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26564)
 2025-01-28 20:10:44 +11:00
Michael Baentsch
6ab286f9eb Add version field check to PKCS8 decoder 
Fixes #26459

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26464)
 2025-01-27 09:24:56 +01:00
Dmitry Belyavskiy
40c01d8ddc Expanding trace of providers algorithms fetching/caching/etc 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26543)
 2025-01-27 09:07:48 +01:00
Rajeev Ranjan
24b7c27250 Add function X509_VERIFY_PARAM_get_purpose() 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25132)
 2025-01-27 08:57:30 +01:00
Rajeev Ranjan
0048817523 CMP: add support for central key generation 
- add testcase for central keygen
- add documentation

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25132)
 2025-01-27 08:56:46 +01:00
Frederik Wedel-Heinen
35b97122ea Fixes some memory leaks when errors occur in ossl_cmp_rp_new(). 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26235)
 2025-01-27 08:17:27 +01:00
Viktor Dukhovni
95a3662626 Also expose an accessor for a single string provider config property 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26550)
 2025-01-25 23:16:10 +11:00
Neil Horman
cfc62a3c46 Exclude amplificationlimit test with mvfst client 
The amplificationlimit interop test is failing currently with our
server.

However, based on the global nightly runs here:
3585161414

it appears to be failing in all test cases.

Some analysis indicates that the client appears to abort operations
early during frame loss in this test.

As such just exclude the combination of this test and client.  Re-add it
later if it ever becomes functional

Fixes openssl/project#1062

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26538)
 2025-01-24 12:01:43 -05:00
Sean Kannanaikal
a59efbfc7e Fix magic + 20 in PEM_ASN1_write_bio 
Fixes #26476

In the file crypto/pem/pem_lib.c the function had a +20 to account for
padding in the data size, however this was recognized to not be up to
standard quality. Instead it has now been updated to use the static
maximum block size and uses that for the calculation as opposed to a +20.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26526)
 2025-01-24 17:14:39 +01:00
Mae
b6f2ff9363 Fix passing struct by value rather than by reference to syscall 
Fixes #26521

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26523)
 2025-01-24 14:26:16 +01:00
Tomas Mraz
0bdb4a67bd template_kem.c: Use proper printf format for size_t 
Fixes Coverity 1633351, 1633352, 1633354, 1633355

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26522)
 2025-01-24 14:16:44 +01:00
Tomas Mraz
2581ff619b template_kem.c: Check outlen before dereferencing it 
Fixes Coverity 1633353, 1633356, 1633357

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26522)
 2025-01-24 14:16:44 +01:00
Frederik Wedel-Heinen
bd0a2e0c1e Check returns of sk_X509_CRL_push and handle appropriately. 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26234)
 2025-01-24 13:37:38 +01:00
Viktor Dukhovni
1397dc59c6 Expose the provider c_get_params function via PROV_CTX. 
This applies to the base, default and FIPS providers, could be added in
principle also to the legacy provider, but there's no compelling reason
to do that at the moment.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26530)
 2025-01-24 22:51:35 +11:00
Viktor Dukhovni
3a9e3b1fb0 Don't lose config infopairs of built-in providers 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26520)
 2025-01-24 22:49:08 +11:00
Dmitry Misharov
8900cdf230 os-zoo.yml: Add linux-s390x runner 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26489)
 2025-01-23 12:17:53 +01:00
Stas Cymbalov
7262c0bcc4 Fix data race in asn1_str2tag() on tntmp which was accidentally made static 
Variables tntmp and tnst are declared in the same declaration and thus
share storage class specifiers (static). This is unfortunate as tntmp is
used during iteration through tnst array and shouldn't be static.
In particular this leads to two problems that may arise when multiple
threads are executing asn1_str2tag() concurrently:
1. asn1_str2tag() might return value that doesn't correspond to tagstr
   parameter. This can happen if other thread modifies tntmp to point to
   a different tnst element right after a successful name check in the
   if statement.
2. asn1_str2tag() might perform an out-of-bounds read of tnst array.
   This can happen when multiple threads all first execute tntmp = tnst;
   line and then start executing the loop. If that case those threads
   can end up incrementing tntmp past the end of tnst array.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26504)
 2025-01-23 12:13:42 +01:00
Tomas Mraz
abbc407314 eddsa_signverify_init(): Avoid memory leak on error 
Add missing WPACKET_cleanup() call.
Fixes Coverity 1638693

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)
 2025-01-23 12:09:13 +01:00
Tomas Mraz
2455ef2112 mac_legacy_kmgmt.c: Avoid possible memory leak on error 
Use mac_gen_cleanup() instead of just freeing the gctx.
Fixes Coverity 1638702

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)
 2025-01-23 12:09:13 +01:00
Tomas Mraz
4f7d2b4809 test_kdf_scrypt(): Test resetting the KDF context 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Tomas Mraz
901b108154 kdf_scrypt_reset(): NULLify freed pointers 
Otherwise doublefree happens with further usage.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Tomas Mraz
2dded72022 scrypt: Do not free the context itself when fetch fails 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Alexander Heinlein
b07a273f59 config.pod: Fix typo 
CLA: trivial

Signed-off-by: Alexander Heinlein <alexander.heinlein@web.de>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26497)
 2025-01-23 12:05:57 +01:00
Richard Levitte
0cacf9be97 Refactor MAKE_ENCODER in providers/implementations/encode_decode/encode_key2any.c 
It took a parameter 'evp_type', which isn't used.  The comment describing
it mentions a future refactoring, but it appears that this has already
happened.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26360)
 2025-01-23 12:03:48 +01:00
Bernd Edlinger
b999ea6bc4 Give DTLS tests more time to complete 
Increase the timeout for DTLS tests to 10 seconds.
But do that only for DTLS as this would waste time
for other tests, most of the TLS tests do not need
this at all.

Fixes #26491

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26502)
 2025-01-23 12:01:38 +01:00
Alex Prabhat Bara
c5e17e8cb7 apps/cms.c: Cleanup for dead assignment to argc 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26273)
 2025-01-23 11:21:12 +01:00
Neil Horman
fbd34c03e3 rcu: Ensure that updates to the ID field of a qp don't lose refs 
ppc64le occasionally still fails the threadstest on __rcu_torture

From several days of debugging, I think I've landed on the problem.

Occasionally, under high load I observe the following pattern

CPU0                                     CPU1
update_qp                                get_hold_current_qp
  atomic_and_fetch(qp->users, ID_MASK, RELEASE)
                                         atomic_add_fetch(qp->users, 1, RELEASE
  atomic_or_fetch(qp->users, ID_VAL++, RELEASE)

When this pattern occurs, the atomic or operation fails to see the published
value of CPU1 and when the or-ed value is written back to ram, the incremented
value in get_hold_current_qp is overwritten, meaning the hold that the reader
placed on the rcu lock is lost, allowing the writer to complete early, freeing
memory before a reader is done reading any held memory.

Why this is only observed on ppc64le I'm not sure, but it seems like a pretty
clear problem.

fix it by implementing ATOMIC_COMPARE_EXCHANGE_N, so that, on the write side in
update_qp, we can ensure that updates are only done if the read side hasn't
changed anything.  If it has, retry the operation.

With this fix, I'm able to run the threads test overnight (4000 iterations and
counting) without failure.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26478)
 2025-01-22 20:16:11 +01:00
Kelvin Lee
5b589fcdab byteorder.h: Fix MSVC compiler error C2371 
Compiling byteorder_test.c with VS2022 produces the following warnings
and errors:

E:\build\kiyolee\openssl\include\openssl\byteorder.h(24,21): warning
C4164: '_byteswap_ushort': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(25,21): warning
C4164: '_byteswap_ulong': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(26,21): warning
C4164: '_byteswap_uint64': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(112,18): warning
C4013: '_byteswap_ushort' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(144,18): warning
C4013: '_byteswap_ulong' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(182,18): warning
C4013: '_byteswap_uint64' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(298,41): error C2371:
'_byteswap_ushort': redefinition; different basic types
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(299,41): warning C4142:
'_byteswap_ulong': benign redefinition of type
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(300,41): error C2371:
'_byteswap_uint64': redefinition; different basic types
(compiling source file '../../../test/byteorder_test.c')

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26448)
 2025-01-22 11:40:11 +01:00
Jiasheng Jiang
27b324f90a providers/implementations/keymgmt/ec_kmgmt.c: Remove unused variable 
Remove unused variable "group".

CLA: trivial

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26293)
 2025-01-22 11:34:50 +01:00
Michael Baentsch
c81ff97866 Improve ASN1_TIME_print documentation and output 
This adds missing GMT indication when printing the local time as
it is converted to the UTC timezone before printing.

Also fixing the fractional seconds printing on EBCDIC platforms.

Fixes #26313

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26344)
 2025-01-22 11:28:31 +01:00
Dimitri John Ledkov
7ffb65666f keymgmt: refactor fips indicator check 
Currently direct call to ossl_ec_check_security_strength is used,
instead of ossl_fips_ind_ec_key_check() like in all other places.

Make keymgmt do the same check as ecdh_exch and ecdsa_sig do.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25748)
 2025-01-22 09:29:32 +01:00
Nadav Tasher
113c12ee8c s_socket: naccept: close listening socket after accepting clients 
When `-naccept` is passed (i.e with `s_server`), the listening socket remains open while handling
client, even after `naccept` is supposed to reach `0`.

This is caused to to the decrementation of `naccept` and closing of the socket
happening a little too late in the `do_server` function.

Signed-off-by: Nadav Tasher <tashernadav@gmail.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26228)
 2025-01-22 09:20:14 +01:00
Viktor Dukhovni
e6855e1d79 Support boolean queries against provider config 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26455)
 2025-01-22 14:52:26 +11:00
Alexey Moksyakov
908bc0994d Revert "Move rodata to .rodata section for armv8" 
This reverts commit 5b36728d97.

Issue #26458

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26498)
 2025-01-21 18:21:19 +01:00
Julian Andres Klode
5261f3ca41 Restore correct registers in aarch64 AES-CTR code 
Commit 1d1ca79fe3 introduced
save and restore for the registers, saving them as

	stp		d8,d9,[sp, #16]
	stp		d10,d11,[sp, #32]
	stp		d12,d13,[sp, #48]
	stp		d14,d15,[sp, #64]

But the restore code was inadvertently typoed:

	ldp		d8,d9,[sp, #16]
	ldp		d10,d11,[sp, #32]
	ldp		d12,d13,[sp, #48]
	ldp		d15,d16,[sp, #64]

Restoring [sp, #64] into d15,d16 instead of d14,d15.

Fixes: #26466

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26469)
 2025-01-21 10:55:56 +01:00
Viktor Dukhovni
c374f79549 Move some encode helpers to crypt/encode_decode/ 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26487)
 2025-01-21 20:09:57 +11:00
Viktor Dukhovni
5b94140b52 Check return of OSSL_PROVIDER_do_all to avoid coverity noise 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26462)
 2025-01-21 17:25:22 +11:00
Viktor Dukhovni
1dafff06ca Don't promise a non-zero return size in error cases. 
When a requested parameter has a non-NULL result pointer,
and the error isn't simply that the result buffer is too
small, don't return a non-zero result size.

Returning a non-zero result size that isn't larger than the
user's provided space is an indication that a result of
that size was actually written, inviting trouble if the
error indication was inadvertenly lost.

Also, in such cases (wrong type, data can't be converted to the
requested type when otherwise supported, ...) there is nothing useful to
be done with the return size value, it can't help to address the
problem.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26436)
 2025-01-21 17:21:52 +11:00
Viktor Dukhovni
35f6e7ea02 Make the provider context available to encoders 
At the moment the provider context is only available to
encoders that encrypt, but it is useful more generally.

A similar change has already been merged to "master" on the
decoder side, this is the mirror change for encoders.  The
only significant difference is that PEM_ASN1_write_bio needed
to be "extended" (cloned) to allow it to pass the provider context
down to the `k2d` function it uses to encode the data.

I had to "hold my nose" and live with the random "20" added to the data
size in order to accomodate encryption with padding, which may produce
one more cipher block than the input length.  This really should ask
the EVP layer about the block length of the cipher, and allocate the
right amount.  This should be a separate fix for both the old
PEM_ASN1_write_bio() and the new PEM_ASN1_write_bio_ctx().

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26475)
 2025-01-21 17:19:07 +11:00
Tomas Mraz
c3144e1025 Add CHANGES.md and NEWS.md updates for CVE-2024-13176 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26429)
 2025-01-20 09:30:48 +01:00
Tomas Mraz
63c40a66c5 Fix timing side-channel in ECDSA signature computation 
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In particular
the NIST P-521 curve is affected. To be able to measure this leak, the
attacker process must either be located in the same physical computer or
must have a very fast network connection with low latency.

Attacks on ECDSA nonce are also known as Minerva attack.

Fixes CVE-2024-13176

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26429)
 2025-01-20 09:30:48 +01:00
Dr. David von Oheimb
3294dcdbc2 fix X509_PURPOSE_add() to take |sname| as primary key and handle |id| in a backwd compat way for new purpose 
Fixes #25873

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26221)
 2025-01-20 08:41:19 +01:00
Dr. David von Oheimb
b48ed24737 fix X509_PURPOSE_set() to support clearing the purpose requirement as needed for X509_VERIFY_PARAM_set_purpose() 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26221)
 2025-01-20 08:41:02 +01:00
otherddn1978
3c7db9e0fd If you call X509_add_cert with cert == NULL and the X509_ADD_FLAG_UP_REF 
flag, it will сrash to X509_up_ref.  Passing NULL here is not valid,
return 0 if cert == NULL.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26267)
 2025-01-20 18:22:48 +11:00
Richard Levitte
1df07c761b Fix documentation of OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION 
This drops OSSL_PKEY_PARAM_IMPLICIT_REJECTION - which is a meaningless
name - everywhere apart from still existing (for API stability, in
case someone uses that macro).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26421)
 2025-01-17 18:54:51 +01:00
Jonathan M. Wilbur
635ad41cd9 test: aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Jonathan M. Wilbur
7346348779 doc: aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Jonathan M. Wilbur
0d8cc7c699 feat: support the aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Viktor Dukhovni
38a0926528 Support CLI and API setting of provider configuration parameters 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26427)
 2025-01-18 03:46:37 +11:00
Alexandr Nedvedicky
42aced5c9f Work around to get llvm-mingw working on aarch64 
It looks like llvm-mingw tool chain does not understand `.previous` asm
directive (see https://sourceware.org/binutils/docs/as/Previous.html).
As a workaround for win64 flavor (llvm-mingw toolchain) we let xlate
to emit .text instead of emitting .previous.

We also need to revisit usage of win64 flavor here in aarch64. We should
perhaps introduce a mingw flavour on aarch64 as well. win assembly
flavour should be used for microsoft assembler.

Fixes #26415

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26428)
 2025-01-17 17:43:39 +01:00
Alexey Moksyakov
5b36728d97 Move rodata to .rodata section for armv8 
Adds missing files where asm code is generated by
perl scripts and read only constant is used

PR #24137

closes #23312

Signed-off-by: Alexey Moksyakov <yavtuk@yandex.ru>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26440)
 2025-01-17 17:33:41 +01:00
Dmitry Belyavskiy
e8387ed61c Missing .gitignore entries 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26418)
 2025-01-17 15:06:32 +01:00
Dmitry Belyavskiy
116c0ad952 atoi should be allowed 
When we compile with -O0 for Linux, the command
`./util/checkplatformsyms.pl ./util/platform_symbols/unix-symbols.txt ./libcrypto.so ./libssl.so`
complains to the lack of `atoi`

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26417)
 2025-01-17 15:04:35 +01:00
onexyoung
8fb6c8154b provider_deactivate(): Check return value of CRYPTO_atomic_add() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26249)
 2025-01-17 11:36:26 +01:00
Nikolay Nikolaev
b26894ec69 Workaround for RSA on AArch64 Big Endian 
1064616012 introduced and optimized RSA NEON implementation
for AArch64 architecture, namely Cortex-A72 and Neoverse N1.
This implementation is broken in Big Endian mode, which is not
widely used, therefore not properly verified.
Here we disable this optimized implementation when Big Endian
platform is used.

Fixes: #22687

CLA: trivial

Signed-off-by: Nikolay Nikolaev <nicknickolaev@gmail.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26257)
 2025-01-15 17:52:29 +01:00
Peter Bierma
0b1d3ebb70 Remove non-existing error code. 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26389)
 2025-01-15 16:22:39 +01:00
Peter Bierma
5b81f942d5 Synchronize openssl.txt with comperr.h 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26389)
 2025-01-15 16:22:39 +01:00
Bernd Edlinger
52bcf4f88b Fix dtls tests 
The dtls server process exits too early when the input
has an EOF condition.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:53 +01:00
Bernd Edlinger
bf2e6e849d Revert "Use open2 instead of open for s_server instance" 
This reverts commit 4439ed16c5.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:53 +01:00
Bernd Edlinger
716a64fcc4 Revert "chomp does not work on windows." 
This reverts commit 3e94e2b11d.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:44 +01:00
Bernd Edlinger
824d23772b Revert "Do not confuse TAP::Parser by mixing up stderr with stdout." 
This reverts commit 3d3bb26a13.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:44 +01:00
Tom Fay
62f9fd832a Correct documented KEM ids for OSSL_HPKE_str2suite 
CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26159)
 2025-01-15 16:03:51 +01:00
Dmitry Misharov
d8af77e736 Add a GitHub workflow to make a release 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25662)
 2025-01-15 16:00:58 +01:00
shridhar kalavagunta
21f72fa4c8 genpkey: Avoid leaving empty file if encryption passphrase does not match 
Fixes #25440

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26081)
 2025-01-15 13:26:41 +01:00
Bernd Edlinger
c37f564bb8 Fix test failure in 30-test_evp_pkey_provided.t 
In this test there is a random test output corruption.
`make test TESTS=test_evp_pkey_provided V=1` has some random output,
that can with a certain probability start a line with "ok" or so:

    # Setting up a OSSL_ENCODER context with passphrase
    # Testing with no encryption
jLixONcRPi/m64CGie4KKKDuGeTjtYwfima3BNYCGlgbLGeK3yYxBfZb9JjviOJ4
    # nHaNsRsONTAKyg==

This happens because large random data is output to bio_out
but some data remains buffered, and then test_note() is used to print
some comments on the bio_err file.  This causes output corruption that
confuses the TAP parser.
Fix that by flushing any pending output with test_flush_stdout() first.

Fixes #23992

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26383)
 2025-01-15 09:16:04 +01:00
Viktor Dukhovni
92c242e8ac Big and little-endian load and store support 
These are needed in ML-KEM and ML-DSA, and are likely generally useful,
so public.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26385)
 2025-01-14 12:14:54 +00:00
sashan
8e69c18828 Finishing touch to perlasm update to make it work on OpenBSD 
This changeset brings a finishing touch to stuff we got from botovoq@
Changes to `crypto/perlasm/arm-xlate.pl` deal with verious assembler
flavours to keep various assembler compilers happy.

We also need to keep original code for 32-bit flavour in
`crypto/aes/asm/aesv8-armx.pl`.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24137)
 2025-01-14 12:15:13 +01:00
Theo Buehler
c6e65c1f8e Make it able to run asm code on OpenBSD (arm64) 
In order to get asm code running on OpenBSD we must place
all constants into .rodata sections.

The change to crypto/perlasm/arm-xlate.pl adjusts changes
from Theo for additional assembler variants/flavours we
use for building OpenSSL.

Fixes #23312

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24137)
 2025-01-14 12:14:27 +01:00
Dimitri John Ledkov
3b7bd871c1 drbg: provide requested amount of entropy, rather than self-strength 
Parent DRBG can be seed source (os or jitter) and thus able to provide
unlimited entropy.

get_entropy is documented to provide at least the request amount of
entropy. If requested amount of entropy is same as, or less than
drbg->strength, everything is compliant. However, if requested entropy
is more than drbg->strength (unlikely, but possible), the returned
amount of entropy will be insufficient and additional repeated calls
to get_entropy will be required.

Reading history of refactors, it seems to me that this function call
previouslly had assumptions and usecases that couldn't ever request or
require more than strength amount of entropy.

If entropy is set, request that amount, otherwise request
drbg->strength amount.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25850)
 2025-01-14 12:12:02 +01:00
Tom Cosgrove
4188ab2b19 Fix obvious misspelling of ASN1_VALUE 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26118)
 2025-01-14 12:05:18 +01:00
Tom Cosgrove
690bb5192c Fix double 'the's 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26118)
 2025-01-14 12:05:07 +01:00
Wang Xin
dd7a79fc6f LoongArch: we should access global symbol by la.global instead of 
la.pcrel

openssl will not be built successfully with binutils-2.43.50.20241230
which checks if global symbols are accessed by PC-relative in shared
library.

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26336)
 2025-01-14 12:02:45 +01:00
Neil Horman
25f8e2c15b Fix premature reuse of qp's in rcu locks 
An intermittent failure was noted on our new ppc64le CI runner, in which
what appeared to be a corrupted or invalid value getting returned from a
shared pointer under rcu protection

Investigation showed that the problem was with our small number of qp's
in a lock, and slightly incorrect accounting of the number of qp's
available we were prematurely recycling qp's, which led in turn to
premature completion of synchronization states, resulting in readers
reading memory that may have already been freed.

Fix it by:
a) Ensuring that we account for the fact that the first qp in an rcu
lock is allocated at the time the lock is created

and

b) Ensuring that we have a minimum number of 3 qp's:
1 that is free for write side allocation
1 that is in use by the write side currently
1 "next" qp that the read side can update while the prior qp is being
retired

With this change, the rcu threadstest runs indefinately in my testing

Fixes #26356

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26384)
 2025-01-13 17:13:48 -05:00
Bernd Edlinger
37a954e5c3 Fix intermittent test failure in 80-test_cmp_http.t 
output to stderr is unbuffered bypassing the normal output, which does
not happen at line boundaries and is therefore confusing the TAP parser.
This is known to cause random test failures like this one:

80-test_cmp_http.t                    (Wstat: 0 Tests: 5 Failed: 0)
  Parse errors: Tests out of sequence.  Found (6) but expected (5)
                Bad plan.  You planned 6 tests but ran 5.

Fixes #23992

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26363)
 2025-01-13 20:19:10 +01:00
Tomas Mraz
74cbe9d1a4 coveralls.yml: Avoid excluding subdirectories of already excluded dirs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26405)
 2025-01-13 14:24:22 +01:00
Ingo Franzki
b8028d4890 speed: Pass IV to EVP_CipherInit_ex for -evp runs with non-AEAD ciphers 
Some (non-AEAD) ciphers require an IV to be used. Always pass a (dummy) IV
when setting the key. It is ignored by ciphers that do not use an IV.

Commit 607a46d003 corrected the use of AEAD
ciphers, but removed the IV from being passed to EVP_CipherInit_ex() for
non-AEAD ciphers.

Fixes: 607a46d003

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26346)
 2025-01-13 11:47:29 +01:00
Viktor Dukhovni
b049ce0e35 Tweak case of [fs] variant letter in SLH-DSA algorithms 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26359)
 2025-01-11 14:39:03 +11:00
Tomas Mraz
75416c098e coveralls.yml: Add --ignore-errors mismatch 
Once lcov is updated to 2.2 version or later, it could be dropped.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26381)
 2025-01-10 16:10:46 +01:00
Viktor Dukhovni
0f28638603 Pre-ML-KEM/DSA decoder/encoder refactor 
Simplify some decoder/encoder internals to facilitate upcoming support
for ML-KEM and ML-DSA.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26355)
 2025-01-10 22:23:58 +11:00
Kai Pastor
e87a3473fd Fix buildinf.h generation for space and backslash 
Builds may be configured with CC or CFLAGS containing space and
double quotes. In particular on Windows, this may lead to passing
more than two arguments into mkbuildinf.pl.
In addition, backslashes must be escaped for constructing the C string.

Fixes #26253.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26315)
 2025-01-10 11:56:38 +01:00
Michael Baentsch
3cfcf820bd Update error codes in "crypto/err/openssl.txt" 
Fixes #26316

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26330)
 2025-01-09 15:44:18 +01:00
Dmitry Misharov
ea71f8cd40 Replace self-hosted runners with GitHub hosted 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26304)
 2025-01-09 15:32:20 +01:00
Frederik Wedel-Heinen
d48874ab47 Fix memory leaks from missing checks of return value from sk_OPENSSL_STRING_push() 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26238)
 2025-01-09 15:23:39 +01:00
Richard Levitte
6a2472fb3e Fix the use of OPENSSL_HTTP_PROXY / OPENSSL_HTTPS_PROXY 
Fixes #26337

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26340)
 2025-01-09 12:03:52 +01:00
Neil Horman
89e2c6f61e Fix encryption level ordering 
It was noticed recently that the enum for QUIC encryption levels doesn't
match the ordering that is outlined in the RFC.  RFC 9000 s. 12.2 and
RFC 9002 s 14.4.1 indicate that encryption level ordering is
INITIAL/0RTT/HANDSHAKE/1RTT, but our enum is in the order
INITAL/HANDSHAKE/0RTT/1RTT.

Our enum isn't a direct wire translation, so as long as the wire->enum
mapping done in ossl_quic_pkt_type_to_enc_level is done consistently it
ideally wouldn't matter, but because we do coalescing in
ossl_quic_tx_packetiser_generate by iterating through all the values in
the enum, its possible we may coalesce in the wrong order when we do
start implementing 0RTT support.

Fix it by adjusting the enum properly to match the RFC order.  This also
necessitates and adjustment to the archetypes array, which is a two
dimensional array indexed by encryption level and frame archetype
(PROBE/NORMAL/ACK ONLY).  Moving the 0RTT enc level to index 1 requires
moving the (formerly) index 2 0RTT array row to be at index 1.

Fixes #26324

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26334)
 2025-01-08 11:17:01 -05:00
Frederik Wedel-Heinen
2457fc4816 Free data if sk_OPENSSL_STRING_push fails. 
Fixes #26203

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26227)
 2025-01-08 11:25:30 +01:00
Frederik Wedel-Heinen
dfce0d7418 Return NULL from ossl_lib_ctx_get_concrete() when it is uninitialized 
When default_context_inited is set to false we return NULL instead of
the global default context.

Fixes #25442

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26319)
 2025-01-08 11:18:13 +01:00
Семенов Герман
bbd1811663 Added configuration for Embarcadero-Borland Clang Compiler 64 (BCC64) 
Signed-off-by: Герман Семенов <GermanAizek@yandex.ru>
Signed-off-by: Herman Semenov <GermanAizek@yandex.ru>

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23377)
 2025-01-08 11:13:10 +01:00
Frederik Wedel-Heinen
c626fda8a6 Check returns of various sk_*_push functions 
Check returns of sk_POLICY_MAPPING_push, sk_GENERAL_NAME_push,
sk_ACCESS_DESCRIPTION_push, sk_X509_push, sk_X509_NAME_push,
sk_OPENSSL_CSTRING_push, sk_SCT_push, sk_DIST_POINT_push,
sk_OSSL_CMP_CRLSTATUS_push, sk_ASN1_UTF8STRING_push and
sk_ASN1_OBJECT_push and handle appropriately.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26240)
 2025-01-08 11:11:00 +01:00
Frederik Wedel-Heinen
3ffa64cd45 Pass functions with correct signatures to the evp_generic_fetch_xxx methods 
UBSan complains about functions being called with incorrect signatures.
Relates to #22896

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26318)
 2025-01-07 21:24:13 +01:00
Matt Caswell
0f665e87c7 Fix a funding.json error 
"Active" should be "active"

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26327)
 2025-01-07 17:18:36 +00:00
Viktor Dukhovni
d31fce1972 Some PQ-related CSOR OIDs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26321)
 2025-01-07 23:01:44 +11:00
Niels Dossche
f822a48668 Fix potential memory leak in PKCS12_add_key_ex() 
p8 is allocated using EVP_PKEY2PKCS8(), but when PKCS8_add_keyusage()
fails this memory is not freed. Fix this by adding a call to
PKCS8_PRIV_KEY_INFO_free().

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25818)
 2025-01-06 21:32:50 +01:00
Bernd Edlinger
94f95efce9 Fix a potential misaligned memory access 
in test/wpackettest.c:593:18: runtime error: load of misaligned address
for type 'uint64_t', which requires 8 byte alignment.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
2f67a3dc32 Fix the sporadic test failure in 30-test_evp_extra.t 
Fixes #26276

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
c45fddd597 Run fuzz-checker workflow on ubuntu-24.04 
Fix missing afl++-clang package
Use clang-18
Configure ubsan with -fno-sanitize=function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
eeb3266ebb Fix test failure in 90-test_memleak.t 
recent gcc versions can optimize the memory leak away,
avoid that by declaring the lost variable to be volatile.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
9861be4eef use-of-uninitialized-value in quic_tserver_test 
Fixes #26277

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
e63e889b32 Fix a minor memory sanitizer issue 
Here the undefined value "npa" passed to a function
WPACKET_sub_memcpy_u16(pkt, npa, npalen).
However the value is not really used, because "npalen" is zero,
but the call statememt itself is considered an invalid operation
by the new sanitizer.

The original sanitizer error report was:

==49175==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55a276b29d6f in tls_construct_stoc_next_proto_neg /home/runner/work/openssl/openssl/ssl/statem/extensions_srvr.c:1518:21
    #1 0x55a276b15d7d in tls_construct_extensions /home/runner/work/openssl/openssl/ssl/statem/extensions.c:909:15
    #2 0x55a276b513dc in tls_construct_server_hello /home/runner/work/openssl/openssl/ssl/statem/statem_srvr.c:2471:10
    #3 0x55a276b2e160 in write_state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:896:26
    #4 0x55a276b2e160 in state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:490:21
    #5 0x55a276b2f562 in ossl_statem_accept /home/runner/work/openssl/openssl/ssl/statem/statem.c:309:12
    #6 0x55a276a9f867 in SSL_do_handshake /home/runner/work/openssl/openssl/ssl/ssl_lib.c:4890:19
    #7 0x55a276a9f605 in SSL_accept /home/runner/work/openssl/openssl/ssl/ssl_lib.c:2169:12
    #8 0x55a276a3d4db in create_bare_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1281:24
    #9 0x55a276a3d7cb in create_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1350:10
    #10 0x55a276a64c0b in test_npn /home/runner/work/openssl/openssl/test/sslapitest.c:12266:14
    #11 0x55a276b9fc20 in run_tests /home/runner/work/openssl/openssl/test/testutil/driver.c:377:21
    #12 0x55a276ba0b10 in main /home/runner/work/openssl/openssl/test/testutil/main.c:31:15

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
01e657c546 Try to work around the llvm-symbolizer failure 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
ada0265aab Add __isoc23_strtol to unix-symbols.txt 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
5f0dab5e74 Add -fno-sanitize=function to ubsan 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Dmitry Misharov
8f0c8e33bf Add linux ppc64le runner 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26312)
 2025-01-06 20:44:32 +01:00
Job Snijders
2e36bb07b5 Clean up ASN1_STRING comment and improve example in docs 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26195)
 2025-01-06 20:39:22 +01:00
Neil Horman
e258454479 add multiplexing test for quic server to ci 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26199)
 2025-01-06 11:24:28 -05:00
Tomas Mraz
ff10a027f9 80-test_cms.t: Fix incorrect plan from bad merge 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26322)
 2025-01-06 13:03:59 +01:00
Jakub Zelenka
894e69e747 Fix CMS encryption with key agreement when originator set 
OpenSSL currently does not support encryption with originator flag so it
should fail nicely instead of segfaulting.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26014)
 2025-01-06 11:45:02 +01:00
Jakub Zelenka
24dd635eff Fix originator cert leak in cms app 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26014)
 2025-01-06 11:45:02 +01:00
Jonathan Swinney
ebe34f9a62 Optimize x86/aarch64 MD5 implementation 
As suggested in https://github.com/animetosho/md5-optimisation?tab=readme-ov-file#dependency-shortcut-in-g-function,
we can delay the dependency on 'x' by recognizing that ((x & z) | (y & ~z))
is equivalent to ((x & z) + (y + ~z)) in this scenario, and we can perform
those additions independently, leaving our dependency on x to the final
addition. This speeds it up around 5% on both platforms.

Signed-off-by: Oli Gillespie <ogillesp@amazon.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25737)
 2025-01-06 11:43:36 +01:00
Dr. David von Oheimb
0a0862969f openssl-pkeyutl.pod.in: update from SHA-1 to SHA256, fixing default values and examples 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Dr. David von Oheimb
cbb16094c3 openssl-pkeyutl.pod.in: various fixes 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Dr. David von Oheimb
ddae593a92 apps/pkeyutl: Fix checks and documentation regarding -peerkey 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Matt Caswell
563f6b6573 Add a funding.json file 
For details about this file format see:
https://floss.fund/funding-manifest/

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26247)
 2025-01-06 08:19:28 +00:00
Michael Baentsch
817a2b2b49 Correct return value documentation for X509V3_set_ctx() 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26295)
 2025-01-03 16:57:51 +01:00
Frederik Wedel-Heinen
65db21935a Avoid leaking memory when realloc fails 
In ossl_property_merge() we can drop the realloc because it just makes
the allocation smaller.

In quic-hq-interop.c we check the realloc result.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26244)
 2025-01-03 15:58:26 +01:00
Jonathan M. Wilbur
40c55b5aa4 test: allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
Jonathan M. Wilbur
e3f82f2c56 doc: the allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
Jonathan M. Wilbur
9598bc15e9 feat: support the allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
cx
0f6caf7409 Reject invalid FFDHE and ECDHE key shares with SSL_AD_ILLEGAL_PARAMETER alert 
This changes the alert according to RFC 8446.

Fixes: #25402

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25547)
 2025-01-02 14:12:54 +01:00
Niels Dossche
32476957ea Fix potential memory leak in BIO_get_accept_socket() 
When BIO_parse_hostserv() fails it may still have allocated memory, yet
this memory is not freed. Fix it by jumping to the err label.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25817)
 2025-01-02 14:06:51 +01:00
Tomas Mraz
0baa3ac736 core_namemap.c: Use OPENSSL_STRING instead of defining STRING type 
Also avoid leak if stack push fails.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26230)
 2024-12-31 15:03:13 +01:00
Neil Horman
4f37e543d9 Reduce the matrix fanout of interop runner 
Recent test additions have increased the number of jobs spawned by the
interop runner test which exceeds the maximum allowed.

This occurs because the matrix expands to:
7 server elements
6 client elements
7 tests
2 test steps (client interop and server interop

Because of how github ci does matrix expansion, this results in
2 * 7 * 7 * 6 = 588

But most of those are invalid because each of the 2 steps only considers
either the client or server elements, and so get rerun multiple times

Alter the steps to be individual jobs, each with their own reduced
matrix to only run each relevant test once, limiting our job count to
at most 49 jobs.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26275)
 2024-12-30 14:16:17 -05:00
Зишан Мирза
c93f4a1e75 ec_kem.c: Fix ikmlen check 
This makes `ikmlen` have a length of at least `Nsk`.

Closes #26213

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26254)
 2024-12-30 17:13:43 +01:00
Matt Caswell
0958f5a5bc Add a daily run-checker test for the TLS security level 
Add a test to check that if the user reduces the default TLS security level
at configure time, then the tests still pass.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26256)
 2024-12-26 19:55:17 +01:00
Matt Caswell
2986908cc7 Ensure the tests pass even if the default seclevel has been changed 
The compile time default TLS security level can be changed if the user
sets `-DOPENSSL_TLS_SECURITY_LEVEL=x` at configure time (where "x" is some
number, typically 0 or 1).

Since OpenSSL 3.4 tests are failing if the default security level is 0. We
fix the tests for this case.

Fixes #26255

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26256)
 2024-12-26 19:55:17 +01:00
ryuishii
5b33d3e158 X509_ACERT_sign_ctx(): Remove superfluous reference 
CLA: trivial

Fixes #26107

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26120)
 2024-12-26 19:40:54 +01:00
Peter Juhasz
34ea176abf Add CMS_NO_SIGNING_TIME flag to CMS_sign(), CMS_add1_signer() 
Previously there was no way to create a CMS SignedData signature without a
signing time attribute, because CMS_SignerInfo_sign added it unconditionally.
However, there is a use case (PAdES signatures) where this attribute is not
allowed, so this commit introduces a new flag to the CMS API that causes this
attribute to be omitted at signing time.

Also add -no_signing_time option to cms command.

Fixes #15777

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15783)
 2024-12-26 19:33:42 +01:00
Jonathan M. Wilbur
b85e6f5349 fix: ci failures due to symbols missing from history 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26250)
 2024-12-23 13:54:22 +00:00
Jonathan M. Wilbur
3974058a09 doc: the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Jonathan M. Wilbur
1e307e65ba test: the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Jonathan M. Wilbur
93b5275f6b feat: support the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Dmitry Belyavskiy
b3bb214720 Take into account no_store when pushing algorithm 
When we put algorithm to the store, we have a fallback to the
OSSL_LIB_CTX level store when store is NULL.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26197)
 2024-12-20 18:20:17 +01:00
Dmitry Belyavskiy
f6097c7c5d This is a test for nocache provider behavior 
A follow-up to #26038

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26197)
 2024-12-20 18:20:17 +01:00
Andrey Tsygunka
bf2dea0e2c ossl_i2c_ASN1_BIT_STRING(): Fix a possible heap buffer overflow 
When data contains only zero values a buffer overflow happens.

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26190)
 2024-12-20 09:47:34 +01:00
Kalavakolanu, Hema Anmisha
53b34561b5 safe_math.h: Check if __GNUC__ is defined 
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4880

Facing the below issue after openssl is upgraded

Edk2\CryptoPkg\Library\OpensslLib\openssl\include\internal/safe_math.h(19):
warning C4668: '__GNUC__' is not defined as a preprocessor macro, replacing
with '0' for '#if/#elif'

CLA: trivial

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

Signed-off-by: Kalavakolanu Hema Anmisha <hema.anmisha.kalavakolanu@intel.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26204)
 2024-12-19 17:45:48 +01:00
Tomas Mraz
009fa4f924 test_evp_cipher_pipeline(): Fix memory leaks on errors 
Fixes Coverity 1636844, 1636845

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26206)
 2024-12-19 10:59:53 +01:00
Patrick J. LoPresti
982a9b8bee doc: Correctly reflect parameter constraints in EVP_DecryptUpdate() 
Fixes #26169

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26202)
 2024-12-19 10:57:00 +01:00
Michael Baentsch
50ef944cd6 Fix missing HISTORY doc entries 
Also add a check to find-doc-nits for HISTORY sections.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26188)
 2024-12-18 17:23:57 +01:00
Neil Horman
e0ea913f11 Add amplification limit test to interop quic testing 
Because this ci job only runs from the master branch, we need to add the
test here to validate that our server respects amplification limits in
our ci runs.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26181)
 2024-12-17 12:12:54 -05:00
otherddn1978
82e7a1130a Check whether ctx->pctx != NULL 
If it is NULL, ctx->pctx->pmeth dereference will cause a crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26176)
 2024-12-17 14:53:14 +01:00
Ramkumar
c44066bb4c docs: update man3 and man7 with cipher pipeline APIs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
a055154607 test: add evp_extra_test case for cipher pipeline API with fake pipeline provider 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
ef7967d0b4 feat: add EVP APIs for cipher pipelining 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
81af0b04cb docs: EVP pipeline API design document 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Michael Baentsch
0f77b6f14e Update HISTORY sections of libssl functions > 3.0.0 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26158)
 2024-12-16 11:02:08 +01:00
Tomas Mraz
79c9cbbe1f Fix breakage on arm64_32 platforms 
We just avoid the special handling needed for Apple M1.

Fixes #26135

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26145)
 2024-12-13 15:05:21 +01:00
Ryan Farley
ffa1cf69aa openssl-dgst: Document that xoflen is required for shake 
With b911fef216, there is no longer a
default xoflen for shake algorithms. Update the manual to reflect this.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26129)
 2024-12-13 14:54:18 +01:00
Elizarova, Alina
acc2655236 Extension of OPENSSL_ia32cap to accommodate additional CPUID bits 
bits 128 - 191 CPUID.(EAX=07H,ECX=0H).EDX and CPUID.(EAX=07H,ECX=1H).EAX
bits 192 - 255 CPUID.(EAX=07H,ECX=1H).EDX and CPUID.(EAX=07H,ECX=1H).EBX
bits 256 - 319 CPUID.(EAX=07H,ECX=1H).ECX and CPUID.(EAX=24H,ECX=0H).EBX

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25709)
 2024-12-13 14:51:22 +01:00
Sasha Romijn
1b3b5a019a Fix typo in SSL_get_shared_sigalgs docs 
psighash -> psignhash

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26151)
 2024-12-13 11:38:10 +01:00
Neil Horman
005721e1a2 Limit tests with non-openssl clients 
Several quic interop implementations have a server implementation, but
not a client implementation.  Don't bother trying to run those

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26130)
 2024-12-13 11:29:12 +01:00
Michael Baentsch
8cbe6e5a81 Add HISTORY to BIO_s_mem documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26146)
 2024-12-13 11:27:19 +01:00
Tomas Mraz
c5257fd8d0 Fix leak of a RAND_POOL in error condition 
Fixes Coverity 1636676

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26154)
 2024-12-13 08:30:18 +01:00
Dr. David von Oheimb
a82c2bf5c9 X509: document non-standard behavior checking EKU extensions in CA and TA certs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26142)
 2024-12-13 08:26:19 +01:00
Tomas Mraz
be4ce01f9f Fix the intermittent lhash_test failure on Windows 
We must set pending_delete before the actual deletion as another inserting
or deleting thread can pick up the delete callback before the
ossl_ht_write_unlock() call.

This can happen only if no read locks are pending and only on Windows where
we do not use the write mutex to get the callback list.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26152)
 2024-12-13 08:23:21 +01:00
Dmitry Belyavskiy
8ad98cce41 To verify MAC, we need a MAC 
Fixes #26106

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26140)
 2024-12-11 18:27:54 +01:00
Jonathan M. Wilbur
fe89f308ae test: the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Jonathan M. Wilbur
29ab951e9c doc: the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Jonathan M. Wilbur
70b17e5a00 feat: support the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Shakti Shah
02e72ccffa dh_cms_set_peerkey(): Fix the incorrect condition 
Only absent parameters allowed in RFC 3370.

Fixes #25824

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26058)
 2024-12-11 18:03:34 +01:00
Tomas Mraz
d992e8729e Add function to mix in an additional input into a RAND_POOL 
It will be just xor-ed over the existing entropy
in the pool.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26128)
 2024-12-10 19:04:29 +01:00
Neil Horman
dc10ffc283 Fix potential use-after-free in REF_PRINT_COUNT 
We use REF_PRINT_COUNT to dump out the value of various reference
counters in our code

However, we commonly use this macro after an increment or decrement.  On
increment its fine, but on decrement its not, because the macro
dereferences the object holding the counter value, which may be freed by
another thread, as we've given up our ref count to it prior to using the
macro.

The rule is that we can't reference memory for an object once we've
released our reference, so lets fix this by altering REF_PRINT_COUNT to
accept the value returned by CRYPTO_[UP|DOWN]_REF instead.  The
eliminates the need to dereference the memory the object points to an
allows us to use the call after we release our reference count

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:58:08 +01:00
Tomas Mraz
3bf273b21b Fix memory ordering guarantees and TSAN errors 
If we had refcounted object allowing lockless writes
the relaxed semantics on DOWN_REF would allow scheduling
these writes after simultaneous release of the object by
another thread.

We do not have any such objects yet, but better to make
the refcount correct just in case we will have them
in future.

TSAN doesn't properly understand this so we use
even stronger acq_rel semantics if building with TSAN.

Fixes #25660

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:58:08 +01:00
Tomas Mraz
420d5d6294 Add test for releasing a shared EVP_PKEY across threads 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:57:53 +01:00
Tomas Mraz
c4b30d9c6d ossl_cms_get1_crls_ex(): Avoid doublefree if CRL up ref fails 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/26100)

(cherry picked from commit ef0be53f90)
 2024-12-10 10:52:54 +01:00
Tomas Mraz
e2ffc9e7d0 Revert the behavior change of CMS_get1_certs() and CMS_get1_crls() 
Fixes #26079

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/26100)

(cherry picked from commit afd36cbef8)
 2024-12-10 10:52:52 +01:00
Tom Cosgrove
5f9814d95c Remove references to git.openssl.org from README.md 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26122)
 2024-12-10 10:38:15 +01:00
Mohammed Alhabib
604411f886 speed.c: Changed the declaration of aead_ivlen to a #define 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26109)
 2024-12-10 10:36:16 +01:00
Tomas Mraz
5fce85ec52 Exchange jitter and no-ct jobs between daily and on push CI 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26112)
 2024-12-06 15:36:57 +01:00
Tomas Mraz
6bba373ec3 jitter_generate(): Properly mix in the additional input 
By adding the additional input directly to the pool
we were using just the additional input.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26112)
 2024-12-06 15:36:57 +01:00
willmafh
c8bee68185 A typo fix in a comment 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:31:35 +01:00
willmafh
282c405818 Add spaces to make macros more clear 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:28:09 +01:00
willmafh
2e407ea5c6 Code & comments changes to make them in consistent 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:27:51 +01:00
willmafh
df6a69a850 one more empty line for code style consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:27:51 +01:00
willmafh
8a74ed5619 Change all one's complement to ones' complement for consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:36 +01:00
willmafh
a1f07a0049 BN_secure_new function indentation correction 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:36 +01:00
willmafh
c77d9fcf8e Delete redundant parentheses for code consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:27 +01:00
willmafh
764a876b64 Delete a redundant break 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:25:47 +01:00
Neil Horman
f7c4d4519c Run interop tests on feature/quic-server branch 
We currently run interop tests as a client only from the master branch.
While we are developing quic-server it would be beneficial to also get
interop test results from the quic-server branch run as both a client
and a server, until such time as the feature branch is merged.  Add
building and running of a container in the test harness to our CI set

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26090)
 2024-12-03 15:04:38 +01:00
jsondevers
4d41cc9103 Add handling for additional input in jitter rng 
Fixes #25917

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25966)
 2024-12-03 11:49:33 +01:00
Joachim Vandersmissen
04812ed1de fips: zeroization of ECX public keys 
Commit fa338aa7cd added zeroization of public security parameters as
required by ISO 19790:2012/Cor.1:2015 7.9. However, that commit
overlooked ECX keys, which are used for EdDSA and X25519/X448.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25807)
 2024-12-03 10:37:14 +01:00
Kyle Evans
3d090579e3 providers: stop probing for getentropy(3) on recent FreeBSD 
FreeBSD has supported both getrandom(2) and getentropy(3) since 12.0.
The last version which did *not* have these went EoL in September 2021.
Use getrandom(2) unconditionally and fallback to sysctl kern.arandom if
we do happen to have a FreeBSD that old.

This is generally a necessary step for FreeBSD's _FORTIFY_SOURCE
implementation, which needs to do some symbol renaming tricks with the
getentropy declaration that would otherwise add some platform-specific
hacks here to accommodate.  getentropy(3) uses getrandom(2) internally
on FreeBSD, so we just cut out the middleman.

While we're here, it doesn't seem to make sense to ever prefer the
sysctl on FreeBSD or NetBSD.  For both platforms, it's limited to 256
bytes in a single request while getrandom(2) will generally use the same
backend but service the entire request in one shot, even for larger
amounts of entropy, modulo the EINTR possibility that presents itself
with larger requests.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24903)
 2024-12-03 10:35:49 +01:00
Tomas Mraz
85f17585b0 fips-label.yml: Fix ABI change label removal 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26080)
 2024-12-02 10:30:23 +01:00
Tomas Mraz
f2348f1f84 Avoid NULL dereference with PKCS7_OP_SET_DETACHED_SIGNATURE 
We would dereference p7->d.sign pointer which can be NULL.

Reported by Han Zheng.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26078)
 2024-12-02 09:44:58 +01:00
Michael Baentsch
4a4505cc64 Document version-specific utility of EVP_PKEY_Q_keygen 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26040)
 2024-11-29 19:06:13 +01:00
Frederik Wedel-Heinen
54332adf29 Minor nit fix to EVP_CipherFinal_ex() return code documentation. 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25849)
 2024-11-29 19:03:16 +01:00
Holger Dengler
f4550fb5b5 Fix memleak in dsa_gen() 
Free the stack return value `dsa` on each early exit.

Fixes #25905

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25948)
 2024-11-29 19:01:01 +01:00
slontis
79c98fc6cc Fix EVP_PKEY_print_private() so that it works with non default providers. 
At some point in time it was decided that the EC keymanagers ec_export()
function would only allow the selection to be both the public + private
parts. If just the private element is selected it returns an error.
Many openssl commandline apps use EVP_PKEY_print_private() which passes
EVP_PKEY_PRIVATE_KEY to the encoder. This selection propagates to
encoder_construct_pkey(). For external providers (such as the fips
provider this will call the keymanagers export() with the selection set
to just the private part.

So we either need to
1) change the selection in EVP_PKEY_print_private() or
2) modify the selection used in the export used in
   encoder_construct_pkey
3) Change the ec_export to allow this.

I have chosen 2) but I am not sure if this is the correct thing to do
or whether it should conditionally do this when the output_type ==
'text'.

Issue was reported by Ilia Okomin (Oracle).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26004)
 2024-11-29 17:11:23 +01:00
Alexandr Nedvedicky
578760bb6a die() in .tmpl file should not be silently ignored. 
call to die() in perl templates is currently ignored.
any error printed by die() commad appears in template
output.

In order to make sure die() terminates processing we
must ensure we emite `undef` value. This is ensured
by adding a `BROKEN` callback to `fill_in()` Template
method. The callback must return undef to stop processing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26064)
 2024-11-29 17:07:40 +01:00
Bartel Artem
fdded23b44 apps/passwd.c: Convert a redundant check to assert 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26053)
 2024-11-29 14:33:30 +01:00
Neil Horman
4c04a19860 Fix solaris build in CRYPTO_atomic_store api 
Misnamed variable, just correct it to dst

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26075)
 2024-11-29 12:08:10 +01:00
sftcd
740668f0b5 Use static array (length 256) for copy of OPENSSL_MALLOC_FAILURES 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26039)
 2024-11-28 17:01:28 +01:00
Tomas Mraz
0bba821881 Deprecate all BIO_meth_get_*() functions 
Their use by applications is inherently unsafe.
Fixes #26047

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26056)
 2024-11-28 16:48:43 +01:00
Niels Dossche
a64d26ac02 Use sk_X509_ATTRIBUTE_deep_copy() to copy attribute stacks in pk7_doit.c 
Clean up the code by using the dedicated stack copy function.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25713)
 2024-11-28 15:27:08 +01:00
Pauli
ce4b244415 ci: add daily runcheckers to exercise the -DOPENSSL_PEDANTIC_ZEROIZATION option 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
01cfee2cdf fips: change integrity check zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
8d09e61be6 pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
db1d8c90d5 hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
e73c1faa53 rsa: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
de22c10b97 ffc: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
f471061721 ec: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
willmafh
0b05db0e20 A typo fix in a comment 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26069)
 2024-11-28 15:05:02 +01:00
David Benjamin
847a23757f Document expected BIO operations for libssl 
If your custom BIO does not implement BIO_CTRL_FLUSH, it won't work, but
this is not document anywhere.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26060)
 2024-11-27 13:02:56 +01:00
Richard Levitte
5dbcfbff16 Upgrade action/{upload,download}-artifact to v4 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25920)
 2024-11-27 11:31:35 +01:00
Dimitri John Ledkov
b9886a6f34 fips-jitter: set provider into error state upon CRNG permanent failures 
With fips-jitter build time option, jitter can be inside FIPS
boundary.

Calls to jent_read_entropy() can return permanent failures for
Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG
prediction test.

Ensure the module enters error state upon permanent jitter failures.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25957)
 2024-11-25 15:20:55 +01:00
Niels Dossche
98be2e8fb6 Fix potential memory leak on failure of ecx_gen_init() 
When ecx_gen_set_params() returns 0, it could have duplicated the memory
for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq,
leading to a memory leak.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26015)
 2024-11-25 15:18:26 +01:00
Niels Dossche
d7e8f6f781 Fix potential memory leak on failure of dsa_gen_init() 
When dsa_gen_set_params()  returns 0, it could have duplicated the memory for the parameter
OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak.

Allocated here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L524)
Can return 0 here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L529-L536)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26016)
 2024-11-25 15:11:08 +01:00
Tom Cosgrove
ea5817854c Enable AES and SHA3 optimisations on Apple Silicon M4-based macOS systems 
AES gets a performance enhancement of 7-33%.

Tested on an M4 Pro, but the CPU cores are the same on M4 and M4 Max.

Change-Id: I634c03f1d2b50fa5f8ca97dd65975e49d970c72b

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/25940)
 2024-11-22 14:56:04 +01:00
Dimitri John Ledkov
635bf4946a fips: remove redundant RSA encrypt/decrypt KAT 
FIPS 140-2 IG D.9 has become FIPS 140-3 D.G (see "Mapping FIPS 140-2
IGs to FIPS 140-3" in the FIPS 140-3 IG).

The requirements w.r.t. RSA KATs have now been relaxed, meaning that
existing full-message RSA signature verification (which is performed
separately) is sufficient to meet KAT requirements for all RSA
usecases (KEM/Encrypt/Decrypt/Sign/Verify).

Dropping this KAT is very useful, because it is large/expensive on
module startup, but also because it enables in the future to block RSA
Encrypt/Decrypt operations with paddings other than OAEP, which are
legacy or deprecated by either current or draft algorithm transition
SP.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25988)
 2024-11-22 14:26:01 +01:00
Dimitri John Ledkov
5946465a87 fips: zeroize temporary self-check out MD variable 
At least this is done on module startup only.

To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10]
requirement.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25945)
 2024-11-22 14:24:59 +01:00
Dmitry Belyavskiy
69d0d93954 .gitignore: Ignoring demo executables 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26009)
 2024-11-22 14:23:10 +01:00
Peiwei Hu
7b08f2566b Remove the negative return values of EVP_KDF_* functions in documents 
None of the EVP_KDF_* functions will ever return a negative value.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:11:34 +01:00
Peiwei Hu
8baf61d51b Fix wrong return value checks for some functions 
- in particular in use of X509_LOOKUP_load_file, EVP_PKEY_print_params,
EVP_PKEY_keygen, X509_CRL_add1_ext_i2d, EVP_PKEY_keygen_init

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:10:26 +01:00
Peiwei Hu
b2b995ec2d Fix multiple wrong use of BN_check_prime 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Peiwei Hu
1273fae170 Fix multiple wrong checks of EVP_PKEY_set1_encoded_public_key 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Peiwei Hu
1a93be1eab apps/lib/apps.c: fix the wrong check in check_cert_attributes 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Kai Pastor
e131868678 Mark OPENSSL_armcap_P .hidden in arm asm 
Fixes #25601
Fixes #22414

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22181)
 2024-11-22 11:22:00 +01:00
Neil Horman
2de7e1d698 Fix SSL_write_[ex|ex2] on blocking quic streams 
When writing to a blocking quic stream, we sometimes get duplicate
transmitted data.  This occurs when a call to quic_write_blocking has to
wait for space to become available in the ring buffer.  When we do a
wait, the call sets *written to the value returned in args.total_written
as filled out by the calls to block_until_pred->quic_write_again.
However, the value there is based on the amount we requested, which is
only the remaining data that we didn't append in xso_sstream_write.  So
if we call quic_write_blocking with a buffer of length X, and initially
append Y bytes, and write the remainig X-Y bytes via a block_until_pred
call, then *written will return with the value X-Y, even though we wrote
the full X bytes to the ring buffer.

Fix it by recording the initial amount appended into *written, and then
add the args.total_written value if we have to wait on more space

Fixes openssl/project#924

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26023)
 2024-11-21 09:41:15 -05:00
Tomas Mraz
93bfe97c5b sm2_sig_verify(): Do not call BN_CTX_end() without BN_CTX_start() 
In case of memory allocation failure this
could happen.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25994)
 2024-11-21 11:13:56 +01:00
Michael Baentsch
0c64b1ca03 add new keytype test for EVP_PKEY_Q_keygen 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25972)
 2024-11-21 09:09:45 +00:00
Tomas Mraz
47a80fd203 pkeyutl.c: Avoid freeing pkey at multiple places 
Also fixes a leak of pkey in error case for -verifyrecover.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25987)
 2024-11-20 17:40:26 +01:00
spectre
6f2c97d50a README.md: Fix typo. Change 'the are' to 'there are' 
This pull request fixes a typo in the documentation.
The phrase "the are" has been corrected to "there are".

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25977)
 2024-11-20 17:23:10 +01:00
Michael Baentsch
1a077b38c9 s_cb.c: Move the negotiated group output 
It needs to be always displayed not just with -brief.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25959)
 2024-11-20 17:10:20 +01:00
wangcheng
4c41aa4b33 Add CTX copy function for EVP_MD to optimize the performance of EVP_MD_CTX_copy_ex. 
1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one.

2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers.

3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy.

4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod.

5. Add testcase.

Fixes #25703

Signed-off-by: wangcheng <bangwangnj@163.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25726)
 2024-11-20 14:12:53 +01:00
Dr. David von Oheimb
9ca66fc273 x509_vfy.c and x509_lu.c: refactor find_issuer(), X509_STORE_CTX_get1_issuer(), etc. 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18762)
 2024-11-20 12:48:24 +01:00
Tomas Mraz
6a3d5b6e62 os-zoo CI: Replace macos-12 run with macos-15 
macos-12 runners will be removed in December.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25715)
 2024-11-20 12:19:57 +01:00
Neil Horman
dcb5d6bf88 Add docs for OSSL_PARAM_print_to_buf 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:40:13 -05:00
Neil Horman
63b671626e Make ossl_trace_param_values an official api function 
lots of people may want to print params to a buffer.  Make it part of
our api

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:38:25 -05:00
Neil Horman
4fec10eae7 Add QUERY trace points 
Adds trace messages for method store add/remove and fetch operations

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:25 -05:00
Neil Horman
3eed43f8a1 Add a QUERY trace category 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Neil Horman
11539fd734 Add tracing messages to the provider api 
Adds tracing messages to the
init/teardown/gettable_params/get_params/query/unquery operations for a
provider

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Neil Horman
193296eaaa Adding a trace category for PROVIDER calls 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Dmitry Misharov
5c5b8d2d7c remove ternary from runs-on, security repo is hosted on github.com 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25939)
 2024-11-15 17:44:56 +01:00
Alicja Kario
eaf4da97c9 man ECDSA_sign(3): fix wrong variable names 
the parameters in the function definitions use `siglen` not `sig_len`,
this fixes the doc text.

Signed-off-by: Alicja Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25927)
 2024-11-13 17:32:45 +01:00
Andrew Dinh
ef39dd058b Change "a SSL" to "an SSL" 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25868)
 2024-11-13 17:24:40 +01:00
Tomas Mraz
837f05fc30 test_hashtable_multithread(): Stress it more 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25669)
 2024-11-13 17:22:37 +01:00
Tomas Mraz
9abd6ca635 Use test_random() in hashtable mt test for reproducibility 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25669)
 2024-11-13 17:22:37 +01:00
Dr. David von Oheimb
577ec498bd Fix doc and use of_X509v3_add_extensions() in case sk_X509_EXTENSION_num(exts) <= 0 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25631)
 2024-11-13 17:19:58 +01:00
Neil Horman
15c6580a76 Add test for SSL_stream_reset 
Add a test to the quic_multistream test suite to reset a stream after
all data has been received by a given stream, ensuring that we don't
crash in the reset operation

Fixes #25410

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25910)
 2024-11-13 10:55:16 -05:00
Neil Horman
bbfffbcaf3 Fix SSL_stream_reset for stream objects which have FIN bit set 
When calling SSL_stream_reset on a QUIC stream object that has received
all data that is expected to be sent (i.e. when the sender has sent a
STREAM frame with the FIN bit set), we encounter the following segfault:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273
273	    if (!qss->have_final_size)
(gdb) bt
0)  0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273
1)  0x00007ffff7ef65bf in quic_validate_for_write (xso=0x5555555efcb0, err=0x7fffffffd5e0) at ssl/quic/quic_impl.c:2513
2)  0x00007ffff7ef8ae3 in ossl_quic_stream_reset (ssl=0x5555555efcb0, args=0x0, args_len=0) at ssl/quic/quic_impl.c:3657
3)  0x00007ffff7ebdaa6 in SSL_stream_reset (s=0x5555555efcb0, args=0x0, args_len=0) at ssl/ssl_lib.c:7635
4)  0x0000555555557527 in build_request_set (
    req_list=0x55555555ebd0 "neil1.txt neil2.txt neil3.txt neil4.txt neil5.txt neil6.txt neil7.txt neil8.txt neil9.txt neil10.txt neil11.txt neil12.txt neil13.txt neil14.txt neil15.txt neil16.txt neil17.txt neil18.txt neil19.txt "..., ssl=0x5555555b6f80)
    at demos/guide/quic-hq-interop.c:545
5)  0x00005555555587b2 in main (argc=4, argv=0x7fffffffe568) at demos/guide/quic-hq-interop.c:941

This occurs because:
1) When the stream FIN bit is set, the quic stack frees the underlying
   stream structures immediately within the QUIC stack
and
2) when SSL_stream_reset is called, the call stack indicates we call
   quic_validate_for_write, which attempts to access the
   xso->stream->sstream QUIC_SSTREAM object, which was already freed in
   (1)

The fix I think is pretty straightforward.  On receipt of a STREAM frame
with a FIN bit set, the QUIC stack sets the QUIC_STREAM object state to
QUIC_SSTREAM_STATE_DATA_RECVD, which means we can use that state to
simply assert that the stream is valid for write, which allows it to be
reset properly.

Fixes #25410

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25910)
 2024-11-13 10:55:08 -05:00
Tomas Mraz
21f6c3b4fb Adjustments for the on schedule workflows 
Run them all after 02:00 UTC.
Add possibility to run them on workflow_dispatch.
Add branch 3.4 to the coveralls.yml.
Remove the branches from os-zoo.yml as it is
possible to run on them manually from workflow_dispatch.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25765)
 2024-11-13 12:15:35 +01:00
Holger Dengler
0abbd3e5ac Fix memleaks in cmd_RecordPadding() 
Free the internal copy of parameter `value` on each early
exit.

Fixes #25906

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25926)
 2024-11-13 12:00:26 +01:00
Jonathan M. Wilbur
1f7d2a2887 feat: define and use ossl_bio_print_hex 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
80b0a33b38 test: the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
044b95837a doc: the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
cccdf41010 feat: support the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Tomas Mraz
ba6f115ccf txp_generate_stream_frames(): Set stream id in header early enough 
Otherwise we will calculate an incorrect header
size for higher stream ids and won't fit the
frame into the packet.

Fixes #25417

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25928)
 2024-11-12 16:56:09 +01:00
Dr. David von Oheimb
dd73b45e28 APPS/load_key_certs_crls(): refactor to clean up the code a little and add clarifying comments 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/22528)
 2024-11-12 12:27:46 +01:00
Dr. David von Oheimb
012353bdf2 openssl-pkeyutl.pod.in: improve description of -rawin and -digest options 
Fixes #25827

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25831)
 2024-11-09 12:06:38 +01:00
Dr. David von Oheimb
26a826c2d1 openssl-pkeyutl.pod.in: add that -sign is default op, update claim on hash needed for -sign/-verify, etc. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25831)
 2024-11-09 12:06:07 +01:00
Dr. David von Oheimb
abad748da8 APPS/pkeyutl: add missing high-level check for -verifyrecover being usable only with RSA 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25903)
 2024-11-09 11:43:59 +01:00
Dr. David von Oheimb
fe07cbf9c3 APPS/pkeyutl: remove wrong check for -verifyrecover regarding too long sign/verify input 
Fixed #25898

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25903)
 2024-11-09 11:43:59 +01:00
Matt Caswell
b10cfd93fd Add a test for setting TLSv1.2 ciphersuites on a QUIC object 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25886)
 2024-11-08 14:36:17 +01:00
Matt Caswell
40237bf97a Don't complain with "no cipher match" for QUIC objects 
Calling the functions SSL_CTX_set_cipher_list() or SSL_set_cipher_list() will
return the error "no cipher match" if no TLSv1.2 (or below) ciphers are enabled
after calling them. However this is normal behaviour for QUIC objects which do
not support TLSv1.2 ciphers. Therefore we should suppress that error in this
case.

Fixes #25878

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25886)
 2024-11-08 14:36:17 +01:00
Matt Caswell
e54526413d Add a test for the new_session_cb from a QUIC object 
Setting a new_session_cb should work for a QUIC object just as it does
with a normal TLS object.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:34 +01:00
Matt Caswell
dc84829cc5 Make sure we use the correct SSL object when making a callback 
When processing a callback within libssl that applies to TLS the original
SSL object may have been created for TLS directly, or for QUIC. When making
the callback we must make sure that we use the correct SSL object. In the
case of QUIC we must not use the internal only SSL object.

Fixes #25788

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:34 +01:00
Matt Caswell
f88c2f2d17 Keep hold of a reference to the user SSL in QUIC 
In some cases a QUIC SSL_CONNECTION object needs to get hold of a reference
to the original SSL object as created by the user. We should keep a
reference to it.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:23 +01:00
Vladimirs Ambrosovs
2aaef03339 Bugfixes for params to legacy control translations for EC parameters 
param->ctrl translation: Fix fix_ecdh_cofactor()

In POST_PARAMS_TO_CTRL state the fix_ecdh_cofactor() function should
return value in ctx->p1

param->ctrl translation: fix evp_pkey_ctx_setget_params_to_ctrl
 return

Since some of the ctrl operations may return 0 as valid value
(e.g. ecdh_cofactor value 0 is valid setting), before colling
POST_PARAMS_TO_CTRL, we need to check return value for 0 as well
otherwise the evp_pkey_ctx_setget_params_to_ctrl function fails
without a chance to fix the return value

param->ctrl translation: Set ecdh_cofactor default action_type GET

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22587)
 2024-11-07 10:35:54 +01:00
oleg.hoefling
85a52f7292 Adjust naming authority formatting when printing out admission extension 
Indent namingAuthority section with two spaces to match the parent
node.

Signed-off-by: oleg.hoefling <oleg.hoefling@gmail.com>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25814)
 2024-11-07 10:29:34 +01:00
Niels Dossche
fa856b0ce0 Fix memory leak on failure in copy_issuer() 
When sk_GENERAL_NAME_reserve() fails, ialt is not freed.
Add the freeing operation in the common error path.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25876)
 2024-11-07 10:19:56 +01:00
Niels Dossche
83b62d41b2 Remove unnecessary sk_GENERAL_NAME_free() calls on NULL 
There are several calls to sk_GENERAL_NAME_free() where the argument is
actually NULL, there are not necessary.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25877)
 2024-11-05 16:14:40 +01:00
Celeste Liu
e899361b98 x509: add a newline after printing Full Name 
We forget it in 58301e24f6.

Fixes #25853

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25854)
 2024-11-05 14:22:10 +01:00
Tomas Mraz
0b234a237c interop-tests.yml: Update to Fedora 40 and fix provisioning breakage 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25847)
 2024-11-05 14:07:30 +01:00
ArtSin
ccaa754b5f Fix uses of EVP_PKEY_Q_keygen with size_t variadic argument 
Fix cases where `int` argument was passed instead of `size_t`.

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25857)
 2024-11-05 13:49:08 +01:00
Matt Caswell
d1669a14d1 Fix the default_md example in the ca docs 
We should not have an example showing the default_md as md5.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25856)
 2024-11-05 11:12:33 +00:00
Michael Baentsch
b9881e8eb1 Document extensibility of -groups parameter via providers 
Also add brainpool curves

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25821)
 2024-11-04 12:01:18 +01:00
Gábor Tóthvári
8f4cd8e305 Remove two unused union members from struct x509_object_st. 
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25826)
 2024-11-04 11:52:17 +01:00
Todd Short
a590a7e3bc Use correct alerts for some cert comp errors 
Fixes #25471

Signed-off-by: Todd Short <todd.short@me.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25845)
 2024-11-04 11:50:46 +01:00
Frederik Wedel-Heinen
357e27342e Support DEFAULT keyword and '-' prefix in SSL_CTX_set1_groups_list() 
Fixes #25790

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25813)
 2024-11-04 11:49:49 +01:00
Dr. David von Oheimb
1ee906143c APPS/pkeyutl: strengthen error message on too long sign/verify input 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:19:04 +01:00
Dr. David von Oheimb
50c0241de2 APPS/pkeyutl: -digest implies -rawin and can only be used with -sign and -verify 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:19:02 +01:00
Dr. David von Oheimb
c7764dacdf APPS/pkeyutl: improve -rawin usability (implied by Ed25519 and Ed448) and doc 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:18:24 +01:00
Dr. David von Oheimb
7086332550 CHANGES.md: re-word 'app' to 'command' and 'apps' to 'commands' for consistency 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:16:04 +01:00
Mohammed Alhabib
607a46d003 apps/speed.c: Fix the benchmarking for AEAD ciphers 
Fixed the benchmarking for the evp aead interface for ccm, gcm, ocb, and siv,
where decryption fails when executing
`openssl speed -evp aes-128-ccm -decrypt` and
`openssl speed -evp aes-128-gcm -decrypt`.

Related issues are [24686](https://github.com/openssl/openssl/issues/24686)
and [24250](https://github.com/openssl/openssl/issues/24250).
Now both encryption and decryption, with or without AAD, executes correctly
without issues.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25823)
 2024-11-04 10:04:23 +01:00
Aditya
539b17b658 apps: Change default cipher to aes-256-cbc for req, cms and smime apps 
Update `CHANGES.md` and `NEWS.md`; remove `no-des` guard from req, cms,
and smime apps

Update MAN pages for default cipher; fix styling by removing braces around single statements

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25839)
 2024-11-04 09:56:55 +01:00
Zheyu Shen
1d160dbf39 Fix incorrect openssl-smime doc sample command for encrypt 
Original documented sample command causes error. PEM recipient cert argument needs to go last.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25829)
 2024-11-01 17:27:19 +01:00
Tomas Mraz
59f5f6c73c speed.c: Check for 0 block size 
Although this cannot really happen check for 0 block size
to avoid division by 0.

Fixes Coverity 1633936

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25822)
 2024-10-31 13:00:10 +01:00
Niels Dossche
8ff6edb9da Fix potential memory leak in OSSL_HPKE_CTX_new() 
ctx->propq is a duplicated string, but the error code does not free
the duplicated string's memory. If e.g. EVP_CIPHER_fetch() fails then
we can leak the string's memory.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25812)
 2024-10-30 11:58:16 +00:00
Aditya
7e3f7f1dbb test: Add test cases for req -cipher option 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25796)
 2024-10-30 11:55:23 +00:00
Aditya
bca1bb2977 req: Add -cipher option to specify private key encryption cipher 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25796)
 2024-10-30 11:55:23 +00:00
Neil Horman
43ba601723 Remove sslkeylog file setup from quic-hq-interop 
Now that libcrypto supports the user of SSLKEYLOGFILE, the interop demo
attempts to open the same file based on the same env variable.

The hq-interop-demo code can just be removed, and it fixes the open
failure when both libcrypto and hq-interop attempt to open and write the
same file, which is causing the nightly failure

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25819)
 2024-10-30 11:49:11 +00:00
Richard Levitte
4c29044a83 fix: util/check-format-commit.sh - fix ending check 
Look at the end result instead of the file name it's stored in

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25810)
 2024-10-30 11:41:55 +00:00
Michael Baentsch
280c1d0f3e output negotiated TLS1.3 group 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25808)
 2024-10-30 11:39:29 +00:00
Tomas Mraz
a3660729e6 speed.c: Check block size before running EVP_Cipher_loop() 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25792)
 2024-10-28 15:53:31 -04:00
Tomas Mraz
c60a2b1830 test_speed: Explicitly test the crashing command line on sparc 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25792)
 2024-10-28 15:53:31 -04:00
Matt Caswell
27fa9d33e1 Fix builds on riscv64 using musl 
Some environments using musl are reported to have the hwprobe.h include
file but not have the __NR_riscv_hwprobe define.

Fixes #25772

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25787)
 2024-10-28 15:44:44 -04:00
Bernd Edlinger
f30d6ba455 Fix ambiguous output of Signature Algorithms 
Signature Algorithms are printed in a SIG+HASH format.
In some cases this is ambiguous like brainpool and RSA-PSS.
And the name of ed25519 and ed448 must be spelled in lower case,
so that the output can be used as a -sigalgs parameter value.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25797)
 2024-10-28 05:52:48 +01:00
Dr. David von Oheimb
80026e5d9e check-format-commit.sh: various improvements; check unstaged changes on empty commit range 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25666)
 2024-10-26 18:52:57 +02:00
Dr. David von Oheimb
380ea5974c check-format-commit.sh: make awk patterns more robust for MacOS and certain flavors of Linux 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25666)
 2024-10-26 18:52:57 +02:00
dependabot[bot]
06aa41a5f5 Dependabot update 
CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.2.0 to 5.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.2.0...v5.3.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25795)
 2024-10-24 17:45:24 +00:00
Dimitri John Ledkov
a08a145d4a github: add fips configuration, with legacy transitions turned off 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25762)
 2024-10-24 15:27:43 +02:00
Dimitri John Ledkov
9d70bba135 fips no-des: compile out TDES KAT 
FIPS provider correctly supports no-des build time option and doesn't
advertise DES related algorithms. However KAT test for DES is still
attempted to be executed and fails.

This prevents configuring FIPS provider without legacy behaviour as
defined in SP 800-131Arev2. Also see #25761 internal docs.

Fix `enable-fips no-des` build option, and add a daily checker for
"legacy-free" (as much as currently feasible) FIPS configuration.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25762)
 2024-10-24 15:27:43 +02:00
Frederik Wedel-Heinen
fc0e79461f tls_common.c: Align the calculation of maximal alignment value 
In tls_setup_write_buffer() and tls_setup_read_buffer() the calculation
is different. Make them the same.

Fixes #25746

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25764)
 2024-10-24 15:24:52 +02:00
Alexandr Nedvedicky
3d3bb26a13 Do not confuse TAP::Parser by mixing up stderr with stdout. 
This avoids false psotivie failures on FreeBSD-CI which
suffers most from this issue.

Fixes #23992

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/25613)
 2024-10-23 15:45:57 +02:00
Kurt Roeckx
76783a8286 Dependabot: no longer set an "approval: otc review pending" label 
The label doesn't exist anymore.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25706)
 2024-10-23 15:21:23 +02:00
Tomas Mraz
c5795689c9 Fix missing sendmmsg/recvmmsg on AIX 
This at least fixes the build failures on AIX

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25704)
 2024-10-23 15:19:34 +02:00
Dr. David von Oheimb
72d3e9bac4 TRACE: automatically respect disabled categories 
by fixing OSSL_trace_begin() to return NULL when given category is not enabled

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25652)
 2024-10-23 15:16:37 +02:00
Niels Dossche
e8d963594f Fix memory leaks in ossl_quic_calculate_retry_integrity_tag() 
Fixes #25625

Several error paths return 0 directly instead of going to err to clean
up the objects.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25636)
 2024-10-23 15:14:08 +02:00
Michael Baentsch
37aa1143c3 Improve documentation about duplicate algorithm registrations 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25624)
 2024-10-23 15:10:49 +02:00
Ingo Franzki
f928304a9d s390x: Don't probe crypto cards for ME/CRT offloading during initialization 
Probing for crypto cards during initialization by issuing an ioctl to the
zcrypt device driver can cause a lot of traffic and overhead, because it
runs for each and every application that uses OpenSSL, regardless if that
application will later perform ME or CRT operations or not.

Fix this by performing no probing during initialization, but detect the
crypto card availability only at the first ME/CRT operation that is subject
to be offloaded. If the ioctl returns ENODEV, then no suitable crypto
card is available in the system, and we disable further offloading
attempts by setting flag OPENSSL_s390xcex_nodev to 1.

Setting the global flag OPENSSL_s390xcex_nodev in case of ENODEV is
intentionally not made in a thread save manner, because the only thing
that could happen is that another thread, that misses the flag update,
also issues an ioctl and gets ENODEV as well.

The file descriptor is not closed in such error cases, because this could
cause raise conditions where we would close a foreign file if the same
file descriptor got reused by another thread. The file descriptor is finally
closed during termination by the atexit handler.

In case the ioctl returns ENOTTY then this indicates that the file descriptor
was closed (e.g. by a sandbox), but in the meantime the same file descriptor
has been reused for another file. Do not use the file descriptor anymore,
and also do not close it during termination.

Fixes: 79040cf29e

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25576)
 2024-10-23 15:07:01 +02:00
Michael Baentsch
e1886edf4b work around oqsprovider out-of-source build bug 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25702)
 2024-10-23 11:12:33 +11:00
Michael Baentsch
8bcf488011 Updated oqsprovider to v0.7.0 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25702)
 2024-10-23 11:12:33 +11:00
Tomas Mraz
36254fda37 Add CHANGES.md and NEWS.md entries for CVE-2024-9143 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/25734)

(cherry picked from commit 233034bc5a)
 2024-10-22 10:45:14 +01:00
Tomas Mraz
1f0cb85047 ecdh_cofactor_derive_test(): Skip the test if the curve is not supported 
It will not be supported if the fips provider was built with no-ec2m.

Fixes #25729

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25731)
 2024-10-21 14:57:20 +01:00
Tomas Mraz
dfc5ba8afa run-checker-merge.yml: Combine no-ec2m with enable-fips 
This can reveal more errors than just no-ec2m.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25731)
 2024-10-21 14:57:20 +01:00
Dmitry Misharov
e84878a7eb update logo 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25725)
 2024-10-21 11:49:25 +01:00
Michael Baentsch
51921b8737 first cut at KEM & key management skeletons 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25640)
 2024-10-21 11:47:16 +01:00
Ondrej Moris
00776cba04 ci: re-organize external tests 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Ondrej Moris
7832374ffb test: clean-up README-external documentation 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Ondrej Moris
e9af1eaa54 test: Add external test for pkcs11-provider 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Alicja Kario
144b9ebc3e add test coverage for #25298 
Add test coverage for issue #25298, clean up the json file so
it uses consistent indentation

Signed-off-by: Alicja Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25329)
 2024-10-21 11:40:16 +01:00
Alicja Kario
bb221d3607 update tlsfuzzer to new version 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25329)
 2024-10-21 11:40:16 +01:00
Neil Horman
5b29c71aa4 updating comments in test recipie 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
5dffe6afb0 updating docs to reflect security risks for SSLKEYLOGFILE 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
6f7273a9b0 Convert keylogging in response to comments 
1) Convert failures in keylog setup to trace messages for a warning-like
   mechanism

2) Convert sslkeylogfile_cb to be a flag used to determine making a
   direct call to the internal logging function

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
a2b5e64907 Fix build break when OPENSSL_NO_SSLKEYLOGFILE is not defined 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
3992add1b7 Update sslkeylog in response to comments 
* instead of keeping an external reference count, just use the
  BIO_up_ref call, and the BIO's callback mechanism to detect the
  final free, for which we set keylog_bio to NULL

* Return an error from SSL_CTX_new_ex if the setup of the keylog file
  fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
8458f873a0 Adding documentation to INSTALL 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
825bb7f4bd Enable sslkeylog for some CI builds for checking 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
d381fc54b1 Add test to confirm sslkeylogfile format 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
97d4b67cca Add documentation for SSLKEYLOGFILE 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
4a69a6d171 Add sslkeylog config option and implementation 
Add a config option for sslkeylog (disabled by default)

When enabled, SSL_CTX_new[_ex] becomes sensitive to the SSLKEYLOGFILE
environment variable.  It records keylog callback messages to the file
specified in the environment variable according to the format specified
in https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
olszomal
256f580dcd CHANGES.md: Support for PKCS#7 inner contents verification 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22575)
 2024-10-21 11:32:04 +01:00
olszomal
8cfc26e6c4 Add support for p7->d.sign->contents with the V_ASN1_SEQUENCE type 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22575)
 2024-10-21 11:32:04 +01:00
Tomas Mraz
f4c4674526 Revert API change of OPENSSL_version() 
There was an API change done as part of PR #24450.
This patch reverts it.

Fixes #25690

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25692)
 2024-10-17 13:36:58 +02:00
Richard Levitte
0f8ff8fc25 [DOC] Document the OPENSSL_WINCTX type for OpenSSL_version() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25693)
 2024-10-17 13:33:06 +02:00
Richard Levitte
7b36037e22 fix: let util/mkbuildinf.pl use SOURCE_DATE_EPOCH, even if it's zero 
Doing this allows reproducible builds, for those who want this.

Fixes #25475

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25699)
 2024-10-17 12:42:45 +02:00
Tomas Mraz
6bb62ab826 openssl-info.pod.in: Add windowscontext option to synopsis in doc 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25712)
 2024-10-16 20:00:19 +02:00
Richard Levitte
5f3fefe2f3 Add 'openssl info' item for the Windows install context 
This information is already present as an 'openssl version' item.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25694)
 2024-10-16 19:29:53 +02:00
Sebastian Andrzej Siewior
50e9d2b188 mem: Don't use posix_memalign() and friends with custom wrapper 
If the application provides custom memory allocations functions via
CRYPTO_set_mem_functions() then those should be used instead something
else like posix_memalign(). The applications might verify alloc and free
calls and pointers from posix_memalign() were never returned by the
implementations.

At least stunnel4 complains here.

Use posix_memalign() or if aligned_alloc() only if the application did
not provide a custom malloc() implementation. In case of a custom
implementation use CRYPTO_malloc() and align the memory accordingly.

Fixes #25678

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25682)
 2024-10-16 10:13:49 +02:00
dependabot[bot]
e524ac548a Dependabot update 
CLA: trivial

(deps): Bump coverallsapp/github-action

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.3.0 to 2.3.2.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v2.3.0...v2.3.2)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25701)
 2024-10-16 10:05:57 +02:00
Viktor Dukhovni
8e008cb8b2 Harden BN_GF2m_poly2arr against misuse. 
The BN_GF2m_poly2arr() function converts characteristic-2 field
(GF_{2^m}) Galois polynomials from a representation as a BIGNUM bitmask,
to a compact array with just the exponents of the non-zero terms.

These polynomials are then used in BN_GF2m_mod_arr() to perform modular
reduction.  A precondition of calling BN_GF2m_mod_arr() is that the
polynomial must have a non-zero constant term (i.e. the array has `0` as
its final element).

Internally, callers of BN_GF2m_poly2arr() did not verify that
precondition, and binary EC curve parameters with an invalid polynomial
could lead to out of bounds memory reads and writes in BN_GF2m_mod_arr().

The precondition is always true for polynomials that arise from the
standard form of EC parameters for characteristic-two fields (X9.62).
See the "Finite Field Identification" section of:

    https://www.itu.int/ITU-T/formal-language/itu-t/x/x894/2018-cor1/ANSI-X9-62.html

The OpenSSL GF(2^m) code supports only the trinomial and pentanomial
basis X9.62 forms.

This commit updates BN_GF2m_poly2arr() to return `0` (failure) when
the constant term is zero (i.e. the input bitmask BIGNUM is not odd).

Additionally, the return value is made unambiguous when there is not
enough space to also pad the array with a final `-1` sentinel value.
The return value is now always the number of elements (including the
final `-1`) that would be filled when the output array is sufficiently
large.  Previously the same count was returned both when the array has
just enough room for the final `-1` and when it had only enough space
for non-sentinel values.

Finally, BN_GF2m_poly2arr() is updated to reject polynomials whose
degree exceeds `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against
CPU exhausition attacks via excessively large inputs.

The above issues do not arise in processing X.509 certificates.  These
generally have EC keys from "named curves", and RFC5840 (Section 2.1.1)
disallows explicit EC parameters.  The TLS code in OpenSSL enforces this
constraint only after the certificate is decoded, but, even if explicit
parameters are specified, they are in X9.62 form, which cannot represent
problem values as noted above.

Initially reported as oss-fuzz issue 71623.

A closely related issue was earlier reported in
<https://github.com/openssl/openssl/issues/19826>.

Severity: Low, CVE-2024-9143

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25639)
 2024-10-16 09:21:33 +02:00
Christopher Triantafilis
f1607c8a2c Update documentation for SSL_SESSION_set_time_ex() 
Fixes #24322

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25665)
 2024-10-14 12:20:24 +02:00
Dr. David von Oheimb
2c536c8b15 replace various calls to sprintf() by BiO_snprintf() to avoid compiler warnings, e.g., on MacOS 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25534)
 2024-10-12 15:38:07 +02:00
Niels Dossche
b2474b287f Fix memory leak in tls_parse_ctos_psk() 
`sess` is not NULL at this point, and is freed on the success path, but
not on the error path. Fix this by going to the `err` label such that
`SSL_SESSION_free(sess)` is called.

CLA: trivial

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25643)
 2024-10-11 14:54:03 +02:00
slontis
01244adfc6 fipsinstall: Save the 'status indicator' if the FIPS provider is 3.0.X. 
Fixes #23400

The 3.1 FIPS provider no longer writes out the 'status indicator' by
default due to changes related to FIPS 140-3 requirements. For Backwards
compatability if the fipsinstall detects it is loading a 3.0.X FIPS
provider then it will save the 'status indicator' by default.

Disclaimer: Using a fipsinstall command line utility that is not supplied
with the FIPS provider tarball source is not recommended.

This PR deliberately does not attempt to exclude any additional options
that were added after 3.0.X. These additional options will be ignored by older
providers.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/23689)
 2024-10-11 14:52:37 +02:00
Niels Dossche
792b2c8da2 Fix potential double free through SRP_user_pwd_set1_ids() 
If SRP_user_pwd_set1_ids() fails during one of the duplications, or id
is NULL, then the old pointer values are still stored but they are now dangling.
Later when SRP_user_pwd_free() is called these are freed again,
leading to a double free.

Although there are no such uses in OpenSSL as far as I found,
it's still a public API.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25655)
 2024-10-11 14:22:36 +02:00
Andreas Mair
38e8392ba0 Use poll() in BIO_socket_wait() if available 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25055)
 2024-10-11 10:21:07 +01:00
Taylor R Campbell
99548cd16e Avoid undefined behaviour with the <ctype.h> functions. 
fix https://github.com/openssl/openssl/issues/25112

As defined in the C standard:

   In all cases the argument is an int, the value of which shall
   be representable as an unsigned char or shall equal the value
   of the macro EOF.  If the argument has any other value, the
   behavior is undefined.

This is because they're designed to work with the int values returned
by getc or fgetc; they need extra work to handle a char value.

If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed
inputs to the ctype.h functions are:

   {-1, 0, 1, 2, 3, ..., 255}.

However, on platforms where char is signed, such as x86 with the
usual ABI, code like

   char *p = ...;
   ... isspace(*p) ...

may pass in values in the range:

   {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}.

This has two problems:

1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden.

2. The non-EOF byte 0xff is conflated with the value EOF = -1, so
   even though the input is not forbidden, it may give the wrong
   answer.

Casting char inputs to unsigned char first works around this, by
mapping the (non-EOF character) range {-128, -127, ..., -1} to {128,
129, ..., 255}, leaving no collisions with EOF.  So the above
fragment needs to be:

   char *p = ...;
   ... isspace((unsigned char)*p) ...

This patch inserts unsigned char casts where necessary.  Most of the
cases I changed, I compile-tested using -Wchar-subscripts -Werror on
NetBSD, which defines the ctype.h functions as macros so that they
trigger the warning when the argument has type char.  The exceptions
are under #ifdef __VMS or #ifdef _WIN32.  I left alone calls where
the input is int where the cast would obviously be wrong; and I left
alone calls where the input is already unsigned char so the cast is
unnecessary.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25113)
 2024-10-10 20:47:48 +02:00
Tomas Mraz
6afaa3f41f Revert "TEMPORARY: run daily checks on PR" 
This reverts commit 4c44603d55.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25658)
 2024-10-10 08:26:38 +02:00
Dr. David von Oheimb
ee0bf38e87 improve and move text on OPENSSL_TRACE from doc/man1/openssl.pod to doc/man7/openssl-env.pod 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25540)
 2024-10-09 12:11:01 +02:00
slontis
f5981c9629 Add utility function ossl_param_is_empty() 
Changed all provider implementations that have a set_ctx_params()
to call this function instead of just testing (params == NULL).This
detects the case wherean OSSL_PARAM array contains just a terminator
entry.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25499)
 2024-10-09 11:13:46 +02:00
Dr. David von Oheimb
187952d449 APPS/storeutl: fix case where uri and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25559)
 2024-10-09 11:10:19 +02:00
Dr. David von Oheimb
d1a0bbe658 test/recipes/tconversion.pl: add sub test_file_contains 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25559)
 2024-10-09 11:10:04 +02:00
Pauli
47ebeb1c10 doc: add note about fips jitter option 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
4bdbd830ac doc: add note about the configuration option for the jitter source. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
4c44603d55 TEMPORARY: run daily checks on PR 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
348c928d66 fips: fix locking issues 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
b448cc1ac4 test: add test for fips-jitter 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
ed524da19a add news and changes entries for the internal jitter source in FIPS 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
fc5fb3c925 fips: mention the internal jitter source in the FIPS README 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
3a01d5d65b jitter: support an internal jitter entropy source in the FIPS provider 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
61f032cc7b Add configuration option to allow the FIPS provider to use the jitter source internally 
Enabling this breaks FIPS compliance unless an entropy assessment and a revalidation
are undertaken.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
01ec59defd jitter: avoid a signed vs unsigned comparison 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Dimitri John Ledkov
6f08353a4b doc: EVP_KDF document the semantic meaning of output 
Explicitely document what semantic meaning do various EVP_KDF
algorithms produce.

PBKDF2 produces cryptographic keys that are subject to cryptographic
security measures, for example as defined in NIST SP 800-132.

All other algorithms produce keying material, not subject to explicit
output length checks in any known standards.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25610)
 2024-10-08 16:05:59 +02:00
Dmitry Belyavskiy
cdbe47bf3c Increase limit for CRL download 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25608)
 2024-10-08 15:59:38 +02:00
Dmitry Belyavskiy
e647220c00 Documenting CRL download usage and restrictions 
Fixes #25603

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25608)
 2024-10-08 15:59:38 +02:00
Pauli
73e720c3a5 evp_libctx_test: fix provider compat CI regression 
The regression was introduced by #25522.

Fixes #25632

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25633)
 2024-10-08 09:28:32 +02:00
Niels Dossche
0a2a8d970f Fix potential memory leak in save_statusInfo() 
If sk_ASN1_UTF8STRING_push() fails then the duplicated string will leak
memory. Add a ASN1_UTF8STRING_free() to fix this.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25604)
 2024-10-07 17:58:12 +02:00
Niels Dossche
d8b7a6eae9 Fix potential memory leak in PKCS7_signatureVerify() 
Fixes #25594

The code jumps to an error block when EVP_VerifyUpdate fails.
This error block does not free abuf.
In the success path the abuf memory is freed.
Move the free operation to the error block.

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25596)
 2024-10-07 17:55:13 +02:00
Olivier Chéron
80a31435e5 Test PBMAC1 with absent PBKDF2 PRF 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25568)
 2024-10-07 17:51:54 +02:00
Olivier Chéron
f3652dff2f Handle PBMAC1 with absent PBKDF2 PRF 
PRF in PBKDF2-params is optional and defaults to hmacWithSHA1.

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25568)
 2024-10-07 17:51:54 +02:00
Beat Bolli
0d6544cdf8 check-format-commit: call fewer unneeded processes 
`wc` does not output a file name if the input is stdin.

`awk` reads its file argument; there's no need for `cat`.

`sort -u` outputs unique lines. It should be supported on all platforms,
as it's specified by POSIX.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25562)
 2024-10-07 17:50:27 +02:00
Neil Horman
1c1223ff53 Add some documentation to describe the encap/decap requirements 
Document the fact that we now require unwrappedlen/wrappedlen to be set
to the size of the unwrapped/wrapped buffers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:47:17 +02:00
Neil Horman
796b2caa9e Adjust tests to fetch the output len for EVP_PKEY_[en|de]cap 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:47:17 +02:00
Neil Horman
0f9516855e Update rsasve_recover to properly store outlen on success 
Outlen was never validated in this function prior to use, nor is it set
to the decrypted value on sucess.  Add both of those operations

Fixes #25509

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:44:23 +02:00
Tomas Mraz
5bc13d5d8c cmp_vfy_test.c: Avoid NULL pointer dereference 
Fixes Coverity 1619463

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25503)
 2024-10-07 17:41:22 +02:00
Klaus Holst Jacobsen
445017152b Added check for __QNX__ define when using in_pktinfo.ipi_spec_dst 
CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24361)
 2024-10-07 17:39:27 +02:00
lan1120
b69ca92a5e Drop the aid field of the signature prov ctx 
Signed-off-by: lan1120 <lanming@huawei.com>

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23094)
 2024-10-07 17:35:28 +02:00
Neil Horman
76c4f0e8ea Update test/quic-openssl-docker/run_endpoint.sh 
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
a941f5d52e quic-interop: exlude multiplexing 
The multiplexing test works on local runs, but
appears to be failing in CI, possibly due to some environmental
limitation (the test generates a large list of requests in an
environment variable), leading to not sending all the requests needed.
Disable the test for now, and look to re-enable it after release when we
can appropriately diagnose the problem

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
c8b050eef1 Update quic interop docker container for chacha20 
Need to update the docker interop container to use the quic-hq-interop
client so that the right alpn is negotiated for chacha20 testing

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
5f43a3376b Add SSL_CIPHER_SUITES env variable to quic-hq-interop 
To run the chacha20 test in interop we need to:
1) negotiate an hq-interop alpn
2) only use chacha 20

Item 1 requires the use of quic-hq-interop, the latter requires this
change

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
slontis
ffa5465e54 Exclude EVP_DigestSign and EVP_DigestVerify related APIs from the FIPS 
provider.

Revert changes to m_sigver.c related to #ifdef FIPS_MODULE and exclude
the file using build.info instead.

Also exclude these calls inside EVP_DigestUpdate() within the FIPS
provider since this API should only be used for self testing digests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
slontis
349815b57f Fix rsa_sigalg_set_ctx_params() to return 1 for unknown parameters. 
This keeps the code consistent with the changes done for other
algorithms that support sigalg_set_ctx_params().

set_ctx_params() should always return 1 if the parameter is unknown.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
slontis
923baa12e1 Change FIPS self tests to use EVP_PKEY_sign/verify API. 
Self tests no longer use the EVP_DigestSign/Verify API's.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
Maks Mishin
4f48629c9d v3_ncons: Fix difference args names in nc_match_single function 
The arguments of the `nc_match_single` function have different names
in the declaration and definition or are mixed up in places.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25592)
 2024-10-04 12:20:19 +02:00
Dr. David von Oheimb
a571425492 add test/recipes/15-test_pkey.t 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
c8359abb88 APPS/pkey: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
d5c4a8aecc APPS/pkcs8: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
421e8d7af8 APPS/ocsp: fix case where reqin and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
1dbb67c4f1 APPS/{ecparam,pkeyparam}: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
32189981a3 APPS/dsaparam: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
9ae1e6596f APPS/dhparam: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Tomas Mraz
93d1bb6dff os-zoo.yml: Disable stringop-overflow warning on alpine edge 
fortify-headers are broken due to this warning.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25599)
 2024-10-03 13:12:40 +02:00
Richard Levitte
27af422b1c Update fips-label.yml to make 'Cleanup artifact' conditional 
If it's not conditional in the same manner as the other steps, it fails
because the artifacts aren't present => job failure.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25584)
 2024-10-03 13:06:38 +02:00
Dimitri John Ledkov
c262cc0c04 fips: add lots of potentially missing ossl_prov_is_running checks 
After rudimentary analysis, it appears the below functions can
potentially produce output, whilst the provider is in error state.

These functions were detected using this method:

```
CFLAGS='-save-temps' ./Configure enable-fips --debug
make -j10
find . -name '*.i' | xargs git add -f
git grep --cached -p ossl_prov_is_running | grep libfips-lib > ossl_prov_is_running.txt
git grep --cached -p 'return' | grep  libfips-lib > return.txt
grep '\.i=' return.txt > func-with_return.txt
grep '\.i=' ossl_prov_is_running.txt > func-with-ossl_prov_is_running.txt
grep --fixed-strings --line-regexp --file=func-with-ossl_prov_is_running.txt return.txt > func-without-ossl_prov_is_running.txt
grep -e newctx -e initctx -e dupctx func-without-ossl_prov_is_running.txt  | grep -v ossl_prov_is_running
```

And from there doing manual inspection, as the list was short at that
point.

As in compile with keeping pre-processed source code; and use `git
grep --cached -p` to find these preprocessed files, and scan for calls
to return or opssl_prov_is_running, with function name printed. And
then exclude one from the other, to hopefully get a list of all the
functions that do not check for ossl_prov_is_running.

As number of functions without "func-without-ossl_prov_is_running"
check is large, I do wonder which other functions are "interesting" to
check for. I think I'm not scanning for _update functions
correctly. Any tips on improving above analysis will help with
maintaining such checks going forward.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25580)
 2024-10-02 12:20:53 +02:00
Simo Sorce
5c91f70ba8 Use the correct length value for input salt 
In this function the salt can be either a zero buffer of exactly mdlen
length, or an arbitrary salt of prevsecretlen length.
Although in practice OpenSSL will always pass in a salt of mdlen size
bytes in the current TLS 1.3 code, the openssl kdf command can pass in
arbitrary values (I did it for testing), and a future change in the
higher layer code could also result in unmatched lengths.

If prevsecretlen is > mdlen this will cause incorrect salt expansion, if
prevsecretlen < mdlen this could cause a crash or reading random
information. Inboth case the generated output would be incorrect.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25579)
 2024-10-02 12:05:39 +02:00
Pauli
c477fa5a22 ci: add 3.4 to prov-compat-label tests 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25583)
 2024-10-02 08:11:05 +02:00
Pauli
3cc299258c ci: add 3.4 to the provider compatibility test 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25583)
 2024-10-02 08:11:05 +02:00
Pauli
12d14de641 test: add FIPS version check for EC cofactor derive tests 
These were added in #25548 but didn't include a FIPS version check which
causes failures testing older FIPS providers against later versions.

Also change some skips to use TEST_skip.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25582)
 2024-10-01 09:28:27 +10:00
slontis
2f362e99a1 Fix bugs in ECDH cofactor FIPS indicator. 
The code was not detecting that the cofactor was set up correctly
if OSSL_PKEY_PARAM_USE_COFACTOR_ECDH was set, resulting in an incorrect
FIPS indicator error being triggered.

Added a test for all possible combinations of a EVP_PKEY setting
OSSL_PKEY_PARAM_USE_COFACTOR_ECDH and the derive context setting
OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE.

This only affects the B & K curves (which have a cofactor that is not 1).

Bug reported by @abkarcher

Testing this properly, also detected a memory leak of privk when the
FIPS indicator error was triggered (in the case where mode = 0 and
use_cofactor was 1).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25548)
 2024-09-30 20:07:09 +02:00
Dimitri John Ledkov
fc68cf21b5 kdfs: implement key length check in X9.42 
Similar to other KDFs, the input key should be 112 bits long.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25529)
 2024-09-30 20:03:49 +02:00
Dimitri John Ledkov
3be6387588 docs: document options added in openssl-fipsinstall 3.4+ 
Document new command line options added in 3.4.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:49:02 +01:00
Dimitri John Ledkov
9331a202fe docs: document options added in openssl-fipsinstall 3.2+ 
Document new command line options added in 3.2.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:48:29 +01:00
Dimitri John Ledkov
1b52b24aa4 docs: document options added in openssl-fipsinstall 3.1+ 
Document new command line options added in 3.1.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:46:28 +01:00
Dimitri John Ledkov
634d84324a docs: add HISTORY section to openssl-fipsinstall (3.0+) 
Documents when the command was added.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:45:28 +01:00
Pauli
c788f1c6be Add CHANGES entry 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:58:23 +10:00
Pauli
0081964805 test: fix unit tests for fips CRNG tests 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:58:09 +10:00
Pauli
d927eb2950 doc: fix typo in CRNG test documentation. 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:57:18 +10:00
Dimitri John Ledkov
ed68623287 fips: Prohibit SHA1 in DH & ECDH exchange 
See Section 5 Key Agreement Using Diffie-Hellman and MQV of
[NIST SP 800-131Ar2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf).

Strengths less than 112bits is disallowed, thus eliminating SHA1.

Skip cms test case that requires use of SHA1 with X9.42 DH.

Rename ossl_fips_ind_digest_check to ossl_fips_ind_digest_exch_check

Add myself to Changes for fips indicator work

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25517)
 2024-09-27 09:13:05 +02:00
Зишан Мирза
3ef1b7426b Check file name for not being NULL before opening it 
Fixes #24416

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25458)
 2024-09-26 20:35:26 +02:00
Зишан Мирза
4f899849ce Fix examples in EVP_PKEY_encapsulate/decapsulate documentation 
Fixes #25448

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25450)
 2024-09-26 10:29:57 +02:00
Зишан Мирза
ffc5a29608 Remove double engine reference in ossl_ec_key_dup() 
Fixes #25260

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25453)
 2024-09-26 10:26:19 +02:00
Shawn C
8ac42a5f41 Fix NULL ptr dereference on EC_POINT *point 
Use non-usual params of pkcs11 module will trigger a null ptr deref bug. Fix it for #25493

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25496)
 2024-09-26 10:04:30 +02:00
Neil Horman
c4ec708bd5 Rename list macros 
The quic implementation defined a set of LIST_* macros for list
manipulation, which conflicts with the generally support BSD api found
in the queue.h system header.  While this isn't normally a problem, A
report arrived indicating that MacOSX appears to implicitly include
queue.h from another system header which causes definition conflicts.

As the openssl macros are internal only, it seems the most sensible
thing to do is place them in a well known namespace for our library to
avoid the conflict, so add an OSSL_ prefix to all our macros

Fixes #25516

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/25519)
 2024-09-26 10:02:30 +02:00
Dr. David von Oheimb
91ec19e92e check-format.pl: do checks regarding statement/block after for() also on {OSSL_,}LIST_FOREACH{,_*} 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25535)
 2024-09-24 22:19:12 +02:00
Pauli
260ecea0d4 ctr-drbg: always use the DF for OpenSSL's DRBGs 
Force the use of the derivation function when creating OpenSSL's internal
DRBGs.

FIPS mandates the use of a derivation function, so 3.4 cannot be validated as
it stands which run counter to the indicator work that was included.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25511)

(cherry picked from commit 0ab796ef96)
 2024-09-24 17:53:26 +02:00
JohnnySavages
9d71a6622b Check sk_X509_value result before dereference 
issuer passed as second parameter to check_issued may result in
NULL dereference

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24760)
 2024-09-24 17:40:26 +02:00
Vladimir Kotal
e7abc2118f document the format of DSA signature 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23762)
 2024-09-23 22:37:03 +02:00
David von Oheimb
1ef3032eac 80-test_cmp_http.t: fix handling of IPv6 server host (localhost '::1') 
Fixes 22467

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
ac91bd88d9 doc/man{1,3}: fix details on IPv6 host addresses and of whitespace in no_proxy 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
fe004a09ac OSSL_HTTP_adapt_proxy(): fix handling of escaped IPv6 host addresses and of whitespace in no_proxy 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
1c90d36ab1 OSSL_HTTP_open(): fix completion with default port for IPv6 host addresses 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:49 +02:00
David von Oheimb
ec4b123a96 http_server.{c,h}: make clear that IPv4 or IPv6 is used by http_server_init() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:49 +02:00
David von Oheimb
7ec5d5916b http_server.c: fix checks of error return code in http_server_init() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:39 +02:00
David von Oheimb
907ddee3ea BIO_s_accept.pod: fix whitespace nits: '<=0' -> '<= 0' 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:39 +02:00
Jakub Zelenka
7f62adaf2b Fix smime-type for AuthEnvelopedData 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25482)
 2024-09-19 20:59:25 +02:00
Alex Shaindlin
f5a8f65b80 doc/man3/OSSL_PARAM.pod: Correct the type of data_type 
CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25486)
 2024-09-19 20:53:41 +02:00
erbsland-dev
1299699a90 Clarify Tag Length Setting in OCB Mode 
Fixes #8331: Updated the description for setting the tag length in OCB mode to remove the misleading “when encrypting” and “during encryption” phrasing. This change emphasizes that setting a custom tag length requires a call with NULL, applicable to both encryption and decryption contexts.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25424)
 2024-09-19 20:51:38 +02:00
Paul E. Murphy
daead12df0 Fix big-endian Power10 chacha20 implementation 
Some of the BE specific permutes were incorrect. Fix them.

This passes all tests on a P10/ppc64 debian unstable host.

Fixes #25451

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25483)
 2024-09-19 11:13:35 +02:00
Michael Baentsch
27f20a464b deactivate failing Cloudflare PQ interop tests 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25488)
 2024-09-19 11:06:08 +02:00
Pauli
5ac48fd813 test: add unit tests for fips CRNG tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
39dc3c0f34 doc: document the health test EVP_RAND 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
6f20c6804e fips: continuous random bit generator tests 
For FIPS 140-3 the continuous tests specified in SP 800-90B need to be
included on the output of any entropy source.

They are implemented here as a replacement for the primary DRBG in the FIPS
provider.  This results in a setup that looks like this:

               +-------------+
               |             |
               | Seed Source |
               |             |
               +------+------+
                      |
                      |
                      v
               +-------------+
               |             |
               |  CRNG Test  |
               |             |
               ++----------+-+
                |          |
                |          |
                v          v
    +--------------+     +--------------+
    |              |     |              |
    | Public DRBG  |     | Private DRBG |
    |              |     |              |
    +--------------+     +--------------+

An additional benefit, that of avoiding DRBG chains, is also gained.
The current standards do not permit the output of one DRBG to be used
as the input for a second (i.e. a chain).

This also leaves open the future possibility of incorporating a seed
source inside the FIPS boundary.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
59eaa8c4af rand: remove unused field in DRBG structure 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Pauli
ce27133708 Add failed entropy continuous test error 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Pauli
ff157ee2f0 drbg: Fix typo 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Matt Caswell
a57c6f8492 Don't restrict what EVP_PKEY_Q_keygen can be used for 
The EVP_PKEY_Q_keygen function contains a list of algorithm type names
and fails if the requested name is not in the list. This prevents the use
of this function for externally supplied key type names.

We should just assume that any unrecognised key type name does not require
a parameter.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25468)
 2024-09-17 16:25:44 +01:00
Orgad Shaneh
6288aa440c Build: Fix circular object deps with old GCC 
When both -o and -MT are used, GCC 4.1 prints the object file twice in
the dependency file. e.g.:

foo.o foo.o: foo.c

If the file name is long, then the second occurrence moves to the next
line. e.g.:

ssl/statem/libssl-shlib-statem_dtls.o \
  ssl/statem/libssl-shlib-statem_dtls.o: ../ssl/statem/statem_dtls.c \

add-depends script scans one line at a time, so when the first line is
processed, the object file becomes a dependency itself.

Fix by removing -MT altogether.

This also fixes makedepend for nonstop platform.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25455)
 2024-09-17 07:19:33 +02:00
Jonathan M. Wilbur
27abf142f6 feat: use ossl_serial_number_print in X509_print_ex 
fixup: Remove trailing space previously added

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 23:40:16 +02:00
Jonathan M. Wilbur
c90451d89d feat: use ossl_serial_number_print in X509_print_ex 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
935f6e63c9 feat: add ossl_serial_number_print 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
4455c1a309 test: the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
f4887d723e doc: support the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
bda7b3edbb feat: support the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Dmitry Belyavskiy
d81709316f EVP_get_default_properties - tests 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
ac645995c4 EVP_get_default_properties - make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
41b51bf6bc EVP_get_default_properties - documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
54fb2fd013 EVP_get_default_properties - implementation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Neil Horman
0fdf965bf0 review fixups for quic-hq-interop 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
a62fb94609 Clean up style issues 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
67b739fba1 Add some more tests to the interop matrix and fixup a typo 
* Add resumption and multiplexing tests
* Remove needless head -n operation when patching implementation.json

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
e4bfcee240 Adding more documentation 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1b6638b1d8 Do batching of stream requests 
We have a limited number of streams to use
send requests in accordance with the number of streams we have
and batch requests according to that limit

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
34d6ec804b support polling of multiple streams 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
3951741224 update quic docker container files 
1) Limit clone depth to allow faster fetches
2) Supply OPENSSL_URL and OPENSSL_BRANCH args to allow for branch
   testing

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1b114e39ae Add lots of docs 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
d978e5fb06 Adding session resume support to hq-interop 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1df1cb4383 Convert retry test to use hq-interop client 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:35:11 -04:00
Neil Horman
2858149e44 Adding an hq-interop alpn client 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:35:11 -04:00
Neil Horman
c8127df04c Detect fin state of a QUIC stream for streams which are completely read 
SSL_poll indicates that a stream which has had the fin bit set on it,
should generate SSL_POLL_EVENT_R events, so that applications can detect
stream completion via SSL_read_ex and SSL_get_error returning
SSL_ERROR_ZERO_RETURN.

However, the quic polling code misses on this, as a client that
completely reads a buffer after receipt has its underlying stream buffer
freed, loosing the fin status

We can however detect stream completion still, as a stream which has
been finalized, and had all its data read will be in the
QUIC_RSTREAM_STATE_DATA_READ state, iff the fin bit was set.

Fix it by checking in test_poll_event_r for that state, and generating a
SSL_POLL_EVENT_R if its found to be true, so as to stay in line with the
docs.

Fixes openssl/private#627

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25399)
 2024-09-13 15:05:29 -04:00
Richard Levitte
8e0d479b98 docs: Correct bad link to provider-keymgmt(7) in provider-signature(7) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25423)
 2024-09-13 17:08:23 +02:00
Richard Levitte
04c134a95b docs: Document the new signature interface for providers 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25423)
 2024-09-13 17:08:23 +02:00
Sahana Prasad
22c2928a9a IANA has assigned numbers for new TLS Supported Groups in ML-KEM 
https://www.ietf.org/archive/id/draft-kwiatkowski-tls-ecdhe-mlkem-01.html#name-iana-considerations
Signed-off-by: Sahana Prasad <sahana@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25477)
 2024-09-13 14:09:34 +02:00
erbsland-dev
645edf50f0 Add Missing Error Messages for AES-OCB Tag Length Validation 
Related to #8331
Addressing found issues by adding specific error messages to improve
feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG`
parameter in the AES-OCB algorithm.

- Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag
  length exceeds the maximum tag length of the algorithm.
- Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag
  length in the context does not match a custom tag length provided as
  a parameter.
- Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an
  invalid pointer is passed in encryption mode.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25425)
 2024-09-13 10:10:34 +02:00
Holger Dengler
9cd4051e47 s390x: Add hardware acceleration for full AES-XTS 
The CPACF instruction KM provides support for accelerating the full
AES-XTS algorithm on newer machines for AES_XTS_128 and AES_XTS_256.

Preliminary measurements showed performance improvements of up to 50%,
dependent on the message size.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25414)
 2024-09-13 09:26:38 +10:00
Tomas Mraz
af8b7e43e4 Update the version to 3.5.0-dev 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25437)
 2024-09-12 19:22:48 +02:00
Richard Levitte
3cd5aeb3cc docs: Document the implemented composite signature+hash algorithms 
The details for RSA and EdDSA have already been documented, albeit the
RSA documentation wasn't conforming properly to the POD format.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25422)
 2024-09-12 15:20:23 +02:00
Daiki Ueno
f37dea418b s_server: Support reading HTTP request from early data 
This would be useful when testing with browsers / downloaders which
support 0-RTT only through HTTP.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16055)
 2024-09-12 14:19:44 +02:00
Gerd Hoffmann
2a53df6947 fix small footprint builds on arm 
Building with '-D OPENSSL_SMALL_FOOTPRINT' for aarch64 fails due to
'gcm_ghash_4bit' being undeclared.  Fix that by not setting the function
pointer when building with OPENSSL_SMALL_FOOTPRINT, matching openssl
behavior on x86.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25419)
 2024-09-12 09:07:12 +10:00
Michael Baentsch
e8498dc645 document provider dependency handling 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24884)
 2024-09-11 09:33:27 +02:00
Frederik Wedel-Heinen
2478d3b7f5 Cleanup of unused functions and macros in ssl_local.h 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24648)
 2024-09-10 20:43:16 +02:00
Jonathan M. Wilbur
7a4f0c6aea feat: print <none> in issuer serials in ac targeting extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
f6b2ab0ba4 test: authorityAttributeIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
221e8fa131 doc: authorityAttributeIdentifier-related ASN.1 symbols 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
a6e0d6d5c0 feat: support the authorityAttributeIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Randall S. Becker
ad1d0cc999 Add NonStop KLT Configuration for new platform kernel treading model. 
This fix supports the new NonStop KLT threading model, including
configurations and documentation for using this model.

Fixes: fix-24175

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25016)
 2024-09-10 19:16:04 +02:00
Neil Horman
d677482b7e Use Jq to add openssl to interop test harness 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:15 -04:00
Neil Horman
d2157bbb83 Collapse errors down by using || in run_endpoint.sh 
Makes for smaller more consistent coding

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
e7e48e7f6c Add interop status badge 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
f984323fcd Need to remove our bash settings as we need to interrogate failures 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
36d5b38d2b Add local nightly interop running 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Tomas Mraz
a4954ea01a Reduce footprint of Windows CI 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Tomas Mraz
ecab977464 Add Windows build with enable-fips no-thread-pool no-quic 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Tomas Mraz
f0fd24d5f3 Fix no-thread-pool build on Windows 
thread/arch/thread_win.c must be included into libcrypto as rcu depends
on ossl_crypto_mutex implementation on Windows.

Fixes #25337

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Matt Caswell
c9e36a8221 Add a test for the nonce-type sigopt 
Check that using the nonce-type sigopt via the dgst app works correctly

Based on the reproducer from #25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
Matt Caswell
d244abb651 Don't restrict the ECDSA settable ctx params unnecessarily 
We just allow all possible settables all the time. Some things like the
digest name can't actually be changed in some circumstances - but we already
have checks for those things. It's still possible to pass a digest of the
same name to one that's already been set for example.

Fixes #25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
Matt Caswell
8cc0a97d60 Complain about a missing digest when doing deterministic ECDSA 
We need a digest for the none when doing deterministic ECDSA. Give a
better error message if one hasn't been supplied.

See openssl/openssl#25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
icy17
5d6322741a Add missing security rules about NULL check to various manpages 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25083)
 2024-09-09 09:40:28 +02:00
ha1215
85eb4f303f Minor WINDOWS.md cleanups 
The possessive form of "Windows" has been updated from "Windows's"
to "Windows'".

The function call "a poll(2) call" has been specified as
"a poll(2) system call" for clarity.

The phrase "and supposed" has been corrected to "and was supposed" to
improve sentence structure.

The phrase "However Microsoft has" now includes a comma, revised to
"However, Microsoft has" to enhance readability.

The statement "Supporting these is a pain" has been adjusted to
"Supporting these can be a pain" to better convey potential variability
in user experience.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24242)
 2024-09-09 09:23:38 +02:00
XZ-X
a5cd06f7ff rehash.c: handle possible null pointer returned by OPENSSL_strdup 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24980)
 2024-09-09 09:20:08 +02:00
erbsland-dev
26521fdcf4 Add note for non-interactive use of s_client 
Fixes #8018

Documented the potential issue of premature connection closure in
non-interactive environments, such as cron jobs, when using `s_client`.

Added guidance on using the `-ign_eof` option and input redirection to
ensure proper handling of `stdin` and completion of TLS session data exchange.

Highlight potential issues with the `-ign_eof` flag and provide solutions for
graceful disconnection in SMTP and HTTP/1.1 scenarios to avoid indefinite hangs.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25311)
 2024-09-09 09:14:21 +02:00
erbsland-dev
d52e92f835 Refactor Password Variables to Use const char[] Arrays 
- Converted password declaration from `char*` to `const char[]`.
- Updated `memcpy` and `return` statements accordingly to use `sizeof` instead of predefined lengths.
- Renamed `key_password` into `weak_password` to match test name.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
9808ccc53f Refactor Callback Tests for Improved Memory Management 
Refactor the callback test code to replace global variables with local structures, enhancing memory management and reducing reliance on redundant cleanup logic.

Using a local struct containing a magic number and result flag to ensure the correct handling of user data and to verify that the callback function is invoked at least once during the test.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
5387b71acb Fix Edge Cases in Password Callback Handling 
Fixes #8441: Modify the password callback handling to reserve one byte in the buffer for a null terminator, ensuring compatibility with legacy behavior that puts a terminating null byte at the end.

Additionally, validate the length returned by the callback to ensure it does not exceed the given buffer size. If the returned length is too large, the process now stops gracefully with an appropriate error, enhancing robustness by preventing crashes from out-of-bounds access.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
fa6ae88a47 Add test for BIO password callback functionality 
Related to #8441

This commit introduces a test suite for the password callback mechanism used when reading or writing encrypted and PEM or DER encoded keys via a BIO in OpenSSL. The test is designed to cover various edge cases, particularly focusing on scenarios where the password callback might return unexpected or malformed data from user code.

By simulating different callback behaviors, including negative returns, zero-length passwords, passwords that exactly fill the buffer and wrongly reported lengths. Also testing for the correct behaviour of binary passwords that contain a null byte in the middle.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
slontis
7845ff7692 Add fips indicator requirements doc 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23609)
 2024-09-08 13:54:39 +10:00
Tomas Mraz
5c82588173 CHANGES.md, NEWS.md: Add 3.5 sections 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Tomas Mraz
3e3a2bfcf0 libcrypto/libssl.num: Set the numbers for 3_4_0 symbols 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Tomas Mraz
314c327b14 NEWS.md: Add missing link to 3.4 section 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Ingo Franzki
dc5afb7e87 s390x: Fix s390x_shake_squeeze() when MSA 12 is available 
On the first squeeze call, when finishing the absorb process, also set
the NIP flag, if we are still in XOF_STATE_INIT state. When MSA 12 is
available, the state buffer A has not been zeroed during initialization,
thus we must also pass the NIP flag here. This situation can happen
when a squeeze is performed without a preceding absorb (i.e. a SHAKE
of the empty message).

Add a test that performs a squeeze without a preceding absorb and check
if the result is correct.

Fixes: 25f5d7b85f

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25388)
 2024-09-06 11:26:06 +02:00
Ingo Franzki
979dc53001 s390x: Fix s390x_sha3_absorb() when no data is processed by KIMD 
If the data to absorb is less than a block, then the KIMD instruction is
called with zero bytes. This is superfluous, and causes incorrect hash
output later on if this is the very first absorb call, i.e. when the
xof_state is still XOF_STATE_INIT and MSA 12 is available. In this case
the NIP flag is set in the function code for KIMD, but KIMD ignores the
NIP flag when it is called with zero bytes to process.

Skip any KIMD calls for zero length data. Also do not set the xof_state
to XOF_STATE_ABSORB until the first call to KIMD with data. That way,
the next KIMD (with non-zero length data) or KLMD call will get the NIP
flag set and will then honor it to produce correct output.

Fixes: 25f5d7b85f

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25388)
 2024-09-06 11:26:05 +02:00
dependabot[bot]
8af4c02ea9 Dependabot update 
CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.1.1 to 5.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25328)
 2024-09-05 18:12:48 +02:00
dependabot[bot]
65e32c6867 Dependabot update 
CLA: trivial

(deps): bump actions/download-artifact

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.7 to 4.1.8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4.1.7...v4.1.8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25385)
 2024-09-05 18:08:11 +02:00
PIums
60725f8511 argon2: Fixed an thread availability error string 
Correctly display the number of requested threads and the number
of available threads.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25375)
 2024-09-05 17:32:01 +02:00
Jiasheng Jiang
f60b3c5fdc crypto/pkcs12/p12_mutl.c: Add check and EVP_MD_free() for EVP_MD_fetch() 
Add check and EVP_MD_free() for EVP_MD_fetch() to avoid NULL pointer
dereference and memory leak, like "md_fetch".

Fixes: fe79159be0 ("Implementation of the RFC 9579, PBMAC1 in PKCS#12")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25370)
 2024-09-05 17:30:28 +02:00
Viktor Dukhovni
8439337036 Drop redundant non-negative checks on unsigned values 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25341)
 2024-09-05 17:28:47 +02:00
Pablo Rodríguez
6fd9bc6568 blank line required to display code in openssl-ts.pod.in 
CLA:trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25338)
 2024-09-05 17:26:58 +02:00
Alessandro Chitarrini
f2b7a00fbb Fix inaccurate comment about default nonce length in demos/cipher/aesccm.c 
Fixes #25270

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25318)
 2024-09-05 17:24:32 +02:00
Jonathan M. Wilbur
9183306815 feat: add TCG / platform certificate OIDs 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25312)
 2024-09-05 17:22:40 +02:00
Zhihao Yuan
36840ab577 Recycle the TLS key that holds thread_event_handler 
Fixes #25278

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25300)
 2024-09-05 17:19:53 +02:00
Jiasheng Jiang
09ae1c9f5a Add error return value information for EVP_MD_get_size() 
Add error return value information for EVP_MD_get_size() and
EVP_MD_CTX_get_size() to better guide their usages and avoid
the integer overflow, such as
4a50882 ("ssl_cipher_get_overhead(): Replace size_t with int and add the checks")
and ef9ac2f ("test/bad_dtls_test.c: Add checks for the EVP_MD_CTX_get_size()").

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25282)
 2024-09-05 17:16:45 +02:00
erbsland-dev
d15077d336 Clarify EVP_CipherUpdate() authenticated bytes behavior 
Fixes #8310: Document that the number of authenticated bytes returned by EVP_CipherUpdate() varies with the cipher used. Mention that stream ciphers like ChaCha20 can handle 1 byte at a time, while OCB mode requires processing data one block at a time. Ensure it's clear that passing unpadded data in one call is safe.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24961)
 2024-09-05 17:14:18 +02:00
Georgi Valkov
71ae466181 threads_win: fix improper cast to long * instead of LONG * 
InterlockedExchangeAdd expects arguments of type LONG *, LONG
but the int arguments were improperly cast to long *, long

Note:
- LONG is always 32 bit
- long is 32 bit on Win32 VC x86/x64 and MingW-W64
- long is 64 bit on cygwin64

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24941)
 2024-09-05 17:09:50 +02:00
Georgi Valkov
9f4d8c63e8 threads: follow formatting rules 
Adjust long lines and correct padding in preprocessor lines to
match the formatting rules

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24941)
 2024-09-05 17:09:50 +02:00
Daniel Gustafsson
5efc57caf2 Fix memleak in rsa_cms_sign error path 
If the call to X509_ALGOR_set0 fails then the allocated ASN1_STRING
variable passed as parameter leaks.  Fix by explicitly freeing like
how all other codepaths with X509_ALGOR_set0 do.

Fixes #22680

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24868)
 2024-09-05 17:04:59 +02:00
FdaSilvaYY
2bb83824bb ssl: rework "e_os.h" inclusions 
- Remove e_os.h include from "ssl_local.h"
- Added e_os.h into the files that need it now.
- Move e_os.h to be the very first include

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
23b795d34f apps: directly inclusion of "e_os.h when needed 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
0022bc81a9 crypto: fix missing <winsock.h> indirection inclusion. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
b2ac9c714e Move inclusion of <winsock.h> out of "e_os.h" into a dedicated header file. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
1303 changed files with 131943 additions and 11038 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.gitattributes vendored
View file

@ -2,6 +2,8 @@
*.der binary
/fuzz/corpora/** binary
*.pfx binary
test/recipes/15-test_ml_dsa_codecs_data/*.dat binary
test/recipes/15-test_ml_kem_codecs_data/*.dat binary
# For git archive
fuzz/corpora/** export-ignore

1
.github/dependabot.yml vendored
View file

@ -11,6 +11,5 @@ updates:
- "dependencies"
- "cla: trivial"
- "approval: review pending"
- "approval: otc review pending"
reviewers:
- "openssl/committers"

2
.github/workflows/build_quic_interop_container.yml vendored
View file

@ -2,7 +2,7 @@ name: "Build openssl interop container from master"
on:
schedule:
- cron: '20 0 * * *'
- cron: '40 02 * * *'
workflow_dispatch:
jobs:

203
.github/workflows/ci.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -26,7 +26,7 @@ env:
jobs:
check_update:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- name: install unifdef
run: |
@ -45,7 +45,7 @@ jobs:
run: git diff --exit-code
check_docs:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
@ -65,16 +65,16 @@ jobs:
# We are not as strict with libraries, but rather adapt to what's
# expected to be available in a certain version of each platform.
check-ansi:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
run: CPPFLAGS='-ansi -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --banner=Configured no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips --strict-warnings && perl configdata.pm --dump
run: CPPFLAGS='-ansi -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --banner=Configured enable-sslkeylog no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips --strict-warnings && perl configdata.pm --dump
- name: make
run: make -s -j4
basic_gcc:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -86,7 +86,7 @@ jobs:
run: echo "FIPS_VENDOR=CI" >> VERSION.dat
- name: config
# enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
run: CC=gcc ./config --banner=Configured enable-demos enable-h3demo enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
run: CC=gcc ./config --banner=Configured enable-demos enable-h3demo enable-sslkeylog enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -99,13 +99,13 @@ jobs:
run: |
util/wrap.pl -fips apps/openssl list -providers | grep 'name: CI FIPS Provider for OpenSSL$'
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@basic-gcc"
path: artifacts.tar.gz
basic_clang:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -121,18 +121,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@basic-clang"
path: artifacts.tar.gz
self-hosted:
if: github.repository == 'openssl/openssl'
strategy:
matrix:
os: [freebsd-13.2, ubuntu-arm64-22.04]
runs-on: ${{ matrix.os }}-self-hosted
continue-on-error: true
linux-arm64:
runs-on: ${{ github.repository == 'openssl/openssl' && 'linux-arm64' || 'ubuntu-24.04-arm' }}
steps:
- uses: actions/checkout@v4
- name: config
@ -142,17 +137,60 @@ jobs:
- name: make
run: make -j4
- name: get cpu info
run: ./util/opensslwrap.sh version -c
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@self-hosted-${{ matrix.os }}"
name: "ci@linux-arm64"
path: artifacts.tar.gz
freebsd-x86_64:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: |
sudo pkg install -y gcc perl5
./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: ./configdata.pm --dump
- name: make
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: make -j4
- name: make test
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
run: |
./util/opensslwrap.sh version -c
.github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@BSD-x86_64"
path: artifacts.tar.gz
minimal:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -168,13 +206,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@minimal"
path: artifacts.tar.gz
no-deprecated:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -190,13 +228,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@no-deprecated"
path: artifacts.tar.gz
no-shared-ubuntu:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -212,7 +250,7 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@no-shared-ubuntu"
path: artifacts.tar.gz
@ -222,7 +260,6 @@ jobs:
fail-fast: false
matrix:
os: [macos-13, macos-14]
if: github.server_url == 'https://github.com'
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
@ -239,13 +276,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@no-shared-${{ matrix.os }}"
path: artifacts.tar.gz
non-caching:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -265,13 +302,13 @@ jobs:
- name: make test
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@non-caching"
path: artifacts.tar.gz
address_ub_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -291,13 +328,13 @@ jobs:
- name: make test
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@address_ub_sanitizer"
path: artifacts.tar.gz
fuzz_tests:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -317,14 +354,14 @@ jobs:
- name: make test
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@fuzz_tests"
path: artifacts.tar.gz
if-no-files-found: ignore
memory_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -335,7 +372,7 @@ jobs:
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
# --debug -O1 is to produce a debug build that runs in a reasonable amount of time
run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
run: CC=clang ./config --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips no-slh-dsa && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -345,13 +382,13 @@ jobs:
- name: make test
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@memory_sanitizer"
path: artifacts.tar.gz
threads_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -361,7 +398,7 @@ jobs:
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: CC=clang ./config --banner=Configured no-fips --strict-warnings -fsanitize=thread && perl configdata.pm --dump
run: CC=clang ./config --banner=Configured no-shared no-fips --strict-warnings -g -fsanitize=thread && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -369,15 +406,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: .github/workflows/make-test V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
run: .github/workflows/make-test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@threads_sanitizer"
path: artifacts.tar.gz
enable_non-default_options:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -395,13 +432,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@enable_non-default_options"
path: artifacts.tar.gz
full_featured:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -411,7 +448,7 @@ jobs:
- name: Enable sctp
run: sudo modprobe sctp
- name: Enable auth in sctp
run: sudo sysctl -w net.sctp.auth_enable=1
run: sudo sysctl -w net.sctp.auth_enable=1
- name: install extra config support
run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
- name: config
@ -425,13 +462,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@full_featured"
path: artifacts.tar.gz
no-legacy:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -447,13 +484,13 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@no-legacy"
path: artifacts.tar.gz
legacy:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -469,7 +506,7 @@ jobs:
- name: make test
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@legacy"
path: artifacts.tar.gz
@ -480,7 +517,7 @@ jobs:
# - That building, testing and installing works with a read-only source
# tree
out-of-readonly-source-and-install-ubuntu:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
@ -511,7 +548,7 @@ jobs:
run: ../source/.github/workflows/make-test
working-directory: ./build
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@out-of-readonly-source-and-install-ubuntu"
path: build/artifacts.tar.gz
@ -525,7 +562,6 @@ jobs:
matrix:
os: [macos-13, macos-14]
runs-on: ${{ matrix.os }}
if: github.server_url == 'https://github.com'
steps:
- uses: actions/checkout@v4
with:
@ -556,7 +592,7 @@ jobs:
run: ../source/.github/workflows/make-test
working-directory: ./build
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "ci@out-of-readonly-source-and-install-${{ matrix.os }}"
path: build/artifacts.tar.gz
@ -564,8 +600,8 @@ jobs:
run: make install
working-directory: ./build
external-tests:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
external-tests-misc:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
@ -584,6 +620,7 @@ jobs:
run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- uses: dtolnay/rust-toolchain@stable
- name: get cpu info
run: |
cat /proc/cpuinfo
@ -592,18 +629,42 @@ jobs:
run: make test TESTS="test_external_gost_engine"
- name: test external krb5
run: make test TESTS="test_external_krb5"
- name: test external_tlsfuzzer
- name: test external tlsfuzzer
run: make test TESTS="test_external_tlsfuzzer"
- name: test external oqs-provider
run: make test TESTS="test_external_oqsprovider"
- name: test external Cloudflare quiche
run: make test TESTS="test_external_cf_quiche" VERBOSE=1
- name: test ability to produce debuginfo files
run: |
make debuginfo
gdb < <(echo -e "file ./libcrypto.so.3\nquit") > ./results
grep -q "Reading symbols from.*libcrypto\.so\.3\.debug" results
external-test-pyca:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
external-tests-providers:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: package installs
run: |
sudo apt-get update
sudo apt-get -yq install meson pkg-config gnutls-bin libnss3-tools libnss3-dev libsofthsm2 opensc expect
- name: config
run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: test external oqs-provider
run: make test TESTS="test_external_oqsprovider"
# Disabled temporarily: https://github.com/latchset/pkcs11-provider/pull/525#discussion_r1982805969
# - name: test external pkcs11-provider
# run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
external-tests-pyca:
runs-on: ubuntu-latest
strategy:
matrix:
RUST:
@ -619,7 +680,7 @@ jobs:
- name: make
run: make -s -j4
- name: Setup Python
uses: actions/setup-python@v5.1.1
uses: actions/setup-python@v5.3.0
with:
python-version: ${{ matrix.PYTHON }}
- uses: dtolnay/rust-toolchain@master
@ -631,21 +692,3 @@ jobs:
./util/opensslwrap.sh version -c
- name: test external pyca
run: make test TESTS="test_external_pyca" VERBOSE=1
external-test-cf-quiche:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Configure OpenSSL
run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump
- name: make
run: make -s -j4
- uses: dtolnay/rust-toolchain@stable
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: test external Cloudflare quiche
run: make test TESTS="test_external_cf_quiche" VERBOSE=1

31
.github/workflows/compiler-zoo.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -19,17 +19,11 @@ jobs:
matrix:
zoo: [
{
cc: gcc-7,
distro: ubuntu-20.04
}, {
cc: gcc-8,
distro: ubuntu-20.04
}, {
cc: gcc-9,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: gcc-10,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: gcc-11,
distro: ubuntu-22.04
@ -40,27 +34,12 @@ jobs:
cc: gcc-13,
distro: ubuntu-22.04,
gcc-ppa-name: ubuntu-toolchain-r/test
}, {
cc: clang-6.0,
distro: ubuntu-20.04
}, {
cc: clang-7,
distro: ubuntu-20.04
}, {
cc: clang-8,
distro: ubuntu-20.04
}, {
cc: clang-9,
distro: ubuntu-20.04
}, {
cc: clang-10,
distro: ubuntu-20.04
}, {
cc: clang-11,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: clang-12,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: clang-13,
distro: ubuntu-22.04

83
.github/workflows/coveralls.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -7,40 +7,74 @@
name: Coverage
# Run once a day
on:
schedule:
- cron: '49 0 * * *'
- cron: '15 02 * * *'
workflow_dispatch:
inputs:
branch:
description: Branch to measure coverage
required: true
default: master
extra_config:
description: Extra options for configuration script
default: ""
permissions:
contents: read
jobs:
define-matrix:
runs-on: ubuntu-latest
outputs:
branches: ${{ steps.branches.outputs.branches }}
steps:
- name: Define branches
id: branches
run: |
if [ "${{ github.event_name}}" = "workflow_dispatch" ]; then
MATRIX=$(cat << EOF
[{
"branch": "${{ github.event.inputs.branch }}",
"extra_config": "${{ github.event.inputs.extra_config }}"
}]
EOF
)
else
MATRIX=$(cat << EOF
[{
"branch": "openssl-3.4",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.3",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.2",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.1",
"extra_config": "no-afalgeng enable-fips"
}, {
"branch": "openssl-3.0",
"extra_config": "no-afalgeng enable-fips"
}, {
"branch": "master",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}]
EOF
)
fi
echo "branches<<EOF"$'\n'"$MATRIX"$'\n'EOF >> "$GITHUB_OUTPUT"
coverage:
needs: define-matrix
permissions:
checks: write # for coverallsapp/github-action to create new checks
contents: read # for actions/checkout to fetch code
strategy:
fail-fast: false
matrix:
branches: [
{
branch: openssl-3.3,
extra_config: no-afalgeng enable-fips enable-tfo
}, {
branch: openssl-3.2,
extra_config: no-afalgeng enable-fips enable-tfo
}, {
branch: openssl-3.1,
extra_config: no-afalgeng enable-fips
}, {
branch: openssl-3.0,
extra_config: no-afalgeng enable-fips
}, {
branch: master,
extra_config: no-afalgeng enable-fips enable-tfo
}
]
branches: ${{ fromJSON(needs.define-matrix.outputs.branches) }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@ -72,17 +106,16 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test TESTS='-test_external_krb5'
run: make test TESTS='-test_external_krb5' EVP_TEST_EXTENDED=1
- name: generate coverage info
run: lcov -d . -c
--exclude "${PWD}/test/*"
--exclude "${PWD}/test/helpers/*"
--exclude "${PWD}/test/testutil/*"
--exclude "${PWD}/fuzz/*"
--exclude "/usr/include/*"
--ignore-errors mismatch
-o ./lcov.info
- name: Coveralls upload
uses: coverallsapp/github-action@v2.3.0
uses: coverallsapp/github-action@v2.3.2
with:
github-token: ${{ secrets.github_token }}
git-branch: ${{ matrix.branches.branch }}

28
.github/workflows/cross-compiles.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -50,20 +50,24 @@ jobs:
}, {
arch: aarch64-linux-gnu,
libs: libc6-dev-arm64-cross,
target: linux-aarch64
target: linux-aarch64,
fips: no
}, {
arch: alpha-linux-gnu,
libs: libc6.1-dev-alpha-cross,
target: linux-alpha-gcc
target: linux-alpha-gcc,
fips: no
}, {
arch: arm-linux-gnueabi,
libs: libc6-dev-armel-cross,
target: linux-armv4,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
arch: arm-linux-gnueabihf,
libs: libc6-dev-armhf-cross,
target: linux-armv4,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
# gcc hppa seems to have some potential compiler issues
@ -94,26 +98,28 @@ jobs:
arch: mipsel-linux-gnu,
libs: libc6-dev-mipsel-cross,
target: linux-mips32,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
arch: powerpc64le-linux-gnu,
libs: libc6-dev-ppc64el-cross,
# The default compiler for this platform on Ubuntu 20.04 seems
# buggy and causes test failures. Dropping the optimisation level
# resolves it.
target: -O2 linux-ppc64le
target: linux-ppc64le,
fips: no
}, {
arch: riscv64-linux-gnu,
libs: libc6-dev-riscv64-cross,
target: linux64-riscv64
target: linux64-riscv64,
fips: no
}, {
arch: s390x-linux-gnu,
libs: libc6-dev-s390x-cross,
target: linux64-s390x -Wno-stringop-overflow
target: linux64-s390x -Wno-stringop-overflow,
fips: no
}, {
arch: sh4-linux-gnu,
libs: libc6-dev-sh4-cross,
target: no-async linux-latomic,
fips: no,
tests: -test_includes -test_store -test_x509_store
},
@ -150,7 +156,7 @@ jobs:
tests: none
}
]
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- name: install package repository
if: matrix.platform.ppa != ''
@ -219,7 +225,7 @@ jobs:
TESTS="test_evp*" \
QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
- name: save artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: "cross-compiles@${{ matrix.platform.arch }}"
path: artifacts.tar.gz

4
.github/workflows/fips-checksums.yml vendored
View file

@ -69,7 +69,7 @@ jobs:
- name: save PR number
run: echo ${{ github.event.number }} > ./artifact/pr_num
- name: save artifact
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: fips_checksum
path: artifact/
@ -113,7 +113,7 @@ jobs:
- name: save PR number
run: echo ${{ github.event.number }} > ./artifact/pr_num
- name: save artifact
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: abidiff
path: artifact/

3
.github/workflows/fips-label.yml vendored
View file

@ -80,6 +80,7 @@ jobs:
}
}
- name: 'Cleanup artifact'
if: ${{ github.event.workflow_run.conclusion == 'success' }}
run: rm artifact.zip pr_num
- name: 'Download abidiff artifact'
@ -133,7 +134,7 @@ jobs:
issue_number: pr_num,
owner: context.repo.owner,
repo: context.repo.repo,
name: 'severity: fips change'
name: 'severity: ABI change'
});
}
}

26
.github/workflows/fuzz-checker.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -21,28 +21,28 @@ jobs:
{
name: AFL,
config: enable-fuzz-afl no-module,
install: afl++-clang,
install: afl++,
cc: afl-clang-fast
}, {
name: libFuzzer,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan,
libs: --with-fuzzer-lib=/usr/lib/llvm-12/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/12/include/fuzzer,
install: libfuzzer-12-dev,
cc: clang-12,
linker: clang++-12,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function,
libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
install: libfuzzer-18-dev,
cc: clang-18,
linker: clang++-18,
tests: -test_memleak
}, {
name: libFuzzer+,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
libs: --with-fuzzer-lib=/usr/lib/llvm-12/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/12/include/fuzzer,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
extra: enable-fips enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-nextprotoneg,
install: libfuzzer-12-dev,
cc: clang-12,
linker: clang++-12,
install: libfuzzer-18-dev,
cc: clang-18,
linker: clang++-18,
tests: -test_memleak
}
]
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- name: install packages
run: |

8
.github/workflows/interop-tests.yml vendored
View file

@ -6,12 +6,14 @@
name: Interoperability tests with GnuTLS and NSS
on:
schedule:
- cron: '0 6 * * *'
- cron: '55 02 * * *'
workflow_dispatch:
jobs:
test:
runs-on: ubuntu-22.04
container:
image: docker.io/fedora:39
image: docker.io/fedora:40
options: --sysctl net.ipv6.conf.lo.disable_ipv6=0
timeout-minutes: 90
strategy:
@ -48,6 +50,6 @@ jobs:
- name: Run interop tests
run: |
cd interop
tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local execute -h tmt --interactive
tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local --feeling-safe execute -h tmt --interactive
openssl version
echo "Finished - important to prevent unwanted output truncating"

2
.github/workflows/main.yml vendored
View file

@ -26,7 +26,7 @@ jobs:
fuzz-seconds: 600
dry-run: false
- name: Upload Crash
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
if: failure()
with:
name: artifacts

42
.github/workflows/make-release.yml vendored Normal file
View file

@ -0,0 +1,42 @@
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
name: "Make release"
on:
push:
tags:
- "openssl-*"
jobs:
release:
runs-on: "releaser"
steps:
- name: "Checkout"
uses: "actions/checkout@v4"
with:
fetch-depth: 1
ref: ${{ github.ref_name }}
github-server-url: "https://github.openssl.org/"
repository: "openssl/openssl"
token: ${{ secrets.GHE_TOKEN }}
path: ${{ github.ref_name }}
- name: "Prepare assets"
run: |
cd ${{ github.ref_name }}
./util/mktar.sh
mkdir assets && mv ${{ github.ref_name }}.tar.gz assets/ && cd assets
openssl sha1 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha1
openssl sha256 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha256
gpg -u ${{ vars.signing_key_uid }} -o ${{ github.ref_name }}.tar.gz.asc -sba ${{ github.ref_name }}.tar.gz
- name: "Create release"
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
run: |
VERSION=$(echo ${{ github.ref_name }} | cut -d "-" -f 2-)
PRE_RELEASE=$([[ ${{ github.ref_name }} =~ alpha|beta ]] && echo "-p" || echo "")
gh release create ${{ github.ref_name }} $PRE_RELEASE -t "OpenSSL $VERSION" -d --notes " " -R ${{ github.repository }} ${{ github.ref_name }}/assets/*

2
.github/workflows/make-test vendored
View file

@ -38,6 +38,6 @@ echo "Test suite exited with $RESULT, artifacts path is $OSSL_CI_ARTIFACTS_PATH"
echo "::endgroup::"
echo "Archive artifacts"
tar -czvf artifacts.tar.gz $OSSL_CI_ARTIFACTS_PATH
tar -czf artifacts.tar.gz $OSSL_CI_ARTIFACTS_PATH
exit $RESULT

104
.github/workflows/os-zoo.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -9,7 +9,8 @@ name: OS Zoo CI
on:
schedule:
- cron: '0 5 * * *'
- cron: '50 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -21,20 +22,20 @@ jobs:
matrix:
tag: [edge, latest]
cc: [gcc, clang]
branch: [openssl-3.0, openssl-3.1, master]
runs-on: ubuntu-latest
container:
image: docker.io/library/alpine:${{ matrix.tag }}
env:
# https://www.openwall.com/lists/musl/2022/02/16/14
EXTRA_CFLAGS: ${{ matrix.cc == 'clang' && '-Wno-sign-compare' || '' }}
# See https://www.openwall.com/lists/musl/2022/02/16/14
# for the reason why -Wno-sign-compare is needed with clang
# -Wno-stringop-overflow is needed to silence a bogus
# warning on new fortify-headers with gcc
EXTRA_CFLAGS: ${{ matrix.cc == 'clang' && '-Wno-sign-compare' || matrix.tag == 'edge' && '-Wno-stringop-overflow' || '' }}
CC: ${{ matrix.cc }}
steps:
- name: install packages
run: apk --no-cache add build-base perl linux-headers ${{ matrix.cc }}
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: config
run: |
./config --banner=Configured no-shared -Wall -Werror enable-fips --strict-warnings \
@ -54,7 +55,6 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
zoo:
- image: docker.io/library/debian:10
install: apt-get update && apt-get install -y gcc make perl
@ -83,8 +83,6 @@ jobs:
container: ${{ matrix.zoo.image }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: install packages
run: ${{ matrix.zoo.install }}
- name: config
@ -104,13 +102,10 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
os: [macos-12, macos-13, macos-14]
os: [macos-13, macos-14, macos-15]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
@ -130,13 +125,10 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
os: [windows-2019, windows-2022]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- uses: ilammy/msvc-dev-cmd@v1
@ -167,12 +159,8 @@ jobs:
working-directory: _build
run: nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4
self-hosted:
strategy:
matrix:
os: [freebsd-13.2, ubuntu-arm64-22.04]
runs-on: ${{ matrix.os }}-self-hosted
continue-on-error: true
linux-arm64:
runs-on: linux-arm64
steps:
- uses: actions/checkout@v4
- name: config
@ -185,3 +173,73 @@ jobs:
run: ./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
linux-ppc64le:
runs-on: linux-ppc64le
steps:
- uses: actions/checkout@v4
- name: config
run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
run: ./configdata.pm --dump
- name: make
run: make -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
linux-s390x:
runs-on: linux-s390x
steps:
- uses: actions/checkout@v4
- name: config
run: ./config enable-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
run: ./configdata.pm --dump
- name: make
run: make -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
freebsd-x86_64:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: |
sudo pkg install -y gcc perl5
./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: ./configdata.pm --dump
- name: make
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: make -j4
- name: make test
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
run: |
./util/opensslwrap.sh version -c
.github/workflows/make-test

12
.github/workflows/prov-compat-label.yml vendored
View file

@ -125,6 +125,10 @@ jobs:
name: openssl-3.3,
dir: branch-3.3,
tgz: branch-3.3.tar.gz,
}, {
name: openssl-3.4,
dir: branch-3.4,
tgz: branch-3.4.tar.gz,
}, {
name: master,
dir: branch-master,
@ -193,12 +197,14 @@ jobs:
# Note that releases are not used as a test environment for
# later providers. Problems in these situations ought to be
# caught by cross branch testing before the release.
tree_a: [ branch-3.3, branch-3.2, branch-3.1, branch-3.0,
tree_a: [ branch-3.4, branch-3.3, branch-3.2, branch-3.1, branch-3.0,
openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
tree_b: [ PR ]
include:
- tree_a: PR
tree_b: branch-master
- tree_a: PR
tree_b: branch-3.4
- tree_a: PR
tree_b: branch-3.3
- tree_a: PR
@ -218,7 +224,7 @@ jobs:
fi
continue-on-error: true
- uses: actions/download-artifact@v4.1.7
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_a }}.tar.gz
@ -226,7 +232,7 @@ jobs:
if: steps.early_exit.outcome == 'success'
run: tar xzf "${{ matrix.tree_a }}.tar.gz"
- uses: actions/download-artifact@v4.1.7
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_b }}.tar.gz

28
.github/workflows/provider-compatibility.yml vendored
View file

@ -10,12 +10,15 @@
name: Provider compatibility across versions
# NOTE: if this is being run on pull_request, it will **not** use the pull
# request's branch. It is hardcoded to use the master branch.
#
on: #[pull_request]
# Please note there is no point in running this job on PR as the tests
# will always run against the tips of the branches in the main repository
# and not the branch from the PR.
# Use the `extended tests` label to run provider compatibility checks
# on PRs.
on:
schedule:
- cron: '0 15 * * *'
- cron: '10 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -124,6 +127,10 @@ jobs:
name: openssl-3.3,
dir: branch-3.3,
tgz: branch-3.3.tar.gz,
}, {
name: openssl-3.4,
dir: branch-3.4,
tgz: branch-3.4.tar.gz,
}, {
name: master,
dir: branch-master,
@ -195,10 +202,11 @@ jobs:
# Note that releases are not used as a test environment for
# later providers. Problems in these situations ought to be
# caught by cross branch testing before the release.
tree_a: [ branch-master, branch-3.3, branch-3.2, branch-3.1, branch-3.0,
tree_a: [ branch-master, branch-3.4, branch-3.3,
branch-3.2, branch-3.1, branch-3.0,
openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
tree_b: [ branch-master, branch-3.3, branch-3.2, branch-3.1,
branch-3.0 ]
tree_b: [ branch-master, branch-3.4, branch-3.3,
branch-3.2, branch-3.1, branch-3.0 ]
steps:
- name: early exit checks
id: early_exit
@ -210,7 +218,7 @@ jobs:
fi
continue-on-error: true
- uses: actions/download-artifact@v4.1.7
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_a }}.tar.gz
@ -218,7 +226,7 @@ jobs:
if: steps.early_exit.outcome == 'success'
run: tar xzf "${{ matrix.tree_a }}.tar.gz"
- uses: actions/download-artifact@v4.1.7
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_b }}.tar.gz

6
.github/workflows/run-checker-ci.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -27,10 +27,12 @@ jobs:
no-dtls,
no-ec,
no-ecx,
no-ml-dsa,
no-ml-kem,
no-http,
no-legacy,
no-sock,
enable-ssl-trace,
no-ssl-trace,
no-stdio,
no-threads,
no-thread-pool,

91
.github/workflows/run-checker-daily.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -10,7 +10,9 @@ name: Run-checker daily
on:
schedule:
- cron: '0 6 * * *'
- cron: '30 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -43,12 +45,12 @@ jobs:
no-cmac,
no-comp,
enable-crypto-mdebug,
no-crypto-mdebug,
enable-crypto-mdebug-backtrace,
no-crypto-mdebug-backtrace,
no-ct,
enable-demos,
no-deprecated,
no-des,
no-devcryptoeng,
# enable-devcryptoeng, # Cannot work on Linux
no-docs,
no-dsa,
no-dtls1,
@ -58,25 +60,24 @@ jobs:
no-ecdh,
no-ecdsa,
enable-ec_nistp_64_gcc_128,
no-ec_nistp_64_gcc_128,
enable-egd,
no-egd,
no-engine,
no-external-tests,
# enable-external-tests, # Requires extra setup
enable-fips,
enable-fips enable-acvp-tests,
enable-fips no-tls1_3,
no-fuzz-afl,
no-fuzz-libfuzzer,
enable-fips no-des no-dsa no-ec2m,
# enable-fuzz-afl, # Requires extra setup
# enable-fuzz-libfuzzer, # Requires extra setup
no-gost,
enable-h3demo,
enable-heartbeats,
no-heartbeats,
enable-hqinterop,
no-hw,
no-hw-padlock,
no-idea,
no-makedepend,
enable-md2,
no-md2,
no-md4,
no-mdc2,
no-msan,
@ -89,9 +90,7 @@ jobs:
no-posix-io,
no-psk,
no-rc2,
no-rc4,
enable-rc5,
no-rc5,
no-rdrand,
no-rfc3779,
no-ripemd,
@ -109,9 +108,9 @@ jobs:
no-sock,
no-sse2,
no-ssl,
no-ssl3,
no-ssl3-method,
no-ssl-trace,
enable-ssl3,
enable-ssl3-method,
enable-sslkeylog,
no-static-engine no-shared,
no-tests,
enable-tfo,
@ -120,19 +119,19 @@ jobs:
no-tls1_1-method,
no-tls1_2-method,
no-tls1-method,
no-trace,
enable-trace,
no-ubsan,
no-ui-console,
no-unit-test,
enable-unit-test,
no-uplink,
no-weak-ssl-ciphers,
no-whirlpool,
no-zlib,
enable-zlib-dynamic,
no-zlib-dynamic,
-DOPENSSL_PEDANTIC_ZEROIZATION,
-DOPENSSL_PEDANTIC_ZEROIZATION enable-fips,
-DOPENSSL_NO_BUILTIN_OVERFLOW_CHECKING,
-DSSL3_ALIGN_PAYLOAD=4
-DSSL3_ALIGN_PAYLOAD=4,
-DOPENSSL_TLS_SECURITY_LEVEL=0
]
runs-on: ubuntu-latest
steps:
@ -191,32 +190,6 @@ jobs:
if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
jitter:
runs-on: ubuntu-latest
steps:
- name: checkout openssl
uses: actions/checkout@v4
- name: checkout jitter
uses: actions/checkout@v4
with:
repository: smuellerDD/jitterentropy-library
ref: v3.5.0
path: jitter
- name: build jitter
run: make -C jitter/
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --with-rand-seed=none enable-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
enable_brotli_dynamic:
runs-on: ubuntu-latest
steps:
@ -370,3 +343,25 @@ jobs:
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
memory_sanitizer_slh_dsa:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: Adjust ASLR for sanitizer
run: |
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
# --debug -O1 is to produce a debug build that runs in a reasonable amount of time
run: CC=clang ./config --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0

56
.github/workflows/run-checker-merge.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -18,15 +18,14 @@ jobs:
fail-fast: false
matrix:
opt: [
enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT,
no-ct,
enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-dso,
no-dynamic-engine,
no-ec2m,
no-ec2m enable-fips,
no-engine no-shared,
no-err,
no-filenames,
enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=alignment,
enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-module,
no-ocsp,
no-pinshared,
@ -59,3 +58,50 @@ jobs:
if [ -x apps/openssl ] ; then ./util/opensslwrap.sh version -c ; fi
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
jitter:
runs-on: ubuntu-latest
steps:
- name: checkout openssl
uses: actions/checkout@v4
- name: checkout jitter
uses: actions/checkout@v4
with:
repository: smuellerDD/jitterentropy-library
ref: v3.5.0
path: jitter
- name: build jitter
run: make -C jitter/
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --with-rand-seed=none enable-jitter enable-fips-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
threads_sanitizer_atomic_fallback:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: Adjust ASLR for sanitizer
run: |
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: CC=clang ./config --banner=Configured no-shared no-fips --strict-warnings -g -fsanitize=thread -DBROKEN_CLANG_ATOMICS && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"

71
.github/workflows/run_quic_interop.yml vendored Normal file
View file

@ -0,0 +1,71 @@
name: "Run openssl quic interop testing"
on:
workflow_run:
workflows: ["Build openssl interop container from master"]
types: [completed]
workflow_dispatch:
jobs:
run_quic_interop_openssl_client:
strategy:
matrix:
tests: [http3, transfer, handshake, retry, chacha20, resumption, multiplexing, ipv6]
servers: [quic-go, ngtcp2, mvfst, quiche, nginx, msquic, haproxy]
exclude:
- servers: msquic
tests: retry
fail-fast: false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
repository: 'quic-interop/quic-interop-runner'
fetch-depth: 0
- name: Install dependencies
run: |
pip install -r requirements.txt
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get install -y tshark
- name: Patch implementations file
run: |
jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
, url: "https://github.com/openssl/openssl"
, role: "both"
}' ./implementations.json > ./implementations.tmp
mv ./implementations.tmp implementations.json
- name: "run interop with openssl client"
run: |
python3 ./run.py -c openssl -t ${{ matrix.tests }} -s ${{ matrix.servers }} --log-dir ./logs-client -d
run_quic_interop_openssl_server:
strategy:
matrix:
tests: [http3, transfer, handshake, retry, chacha20, resumption, amplificationlimit, ipv6]
clients: [quic-go, ngtcp2, mvfst, quiche, msquic, openssl, chrome]
exclude:
- clients: mvfst
tests: amplificationlimit
fail-fast: false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
repository: 'quic-interop/quic-interop-runner'
fetch-depth: 0
- name: Install dependencies
run: |
pip install -r requirements.txt
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get install -y tshark
- name: Patch implementations file
run: |
jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
, url: "https://github.com/openssl/openssl"
, role: "both"
}' ./implementations.json > ./implementations.tmp
mv ./implementations.tmp implementations.json
- name: "run interop with openssl server"
run: |
python3 ./run.py -s openssl -t ${{ matrix.tests }} -c ${{ matrix.clients }} --log-dir ./logs-server -d

2
.github/workflows/static-analysis-on-prem.yml vendored
View file

@ -9,7 +9,7 @@ name: Static Analysis On Prem
on:
schedule:
- cron: '20 0 * * *'
- cron: '25 02 * * *'
workflow_dispatch:
permissions:

3
.github/workflows/static-analysis.yml vendored
View file

@ -10,7 +10,8 @@ name: Static Analysis
#Run once a day
on:
schedule:
- cron: '20 0 * * *'
- cron: '20 02 * * *'
workflow_dispatch:
permissions:
contents: read

20
.github/workflows/windows.yml vendored
View file

@ -17,15 +17,17 @@ jobs:
# Run a job for each of the specified target architectures:
strategy:
matrix:
os:
- windows-2019
- windows-2022
platform:
- arch: win64
os: windows-2019
config: enable-fips
- arch: win64
os: windows-2022
config: enable-fips no-thread-pool no-quic
- arch: win32
os: windows-2022
config: --strict-warnings no-fips
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.platform.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -90,9 +92,9 @@ jobs:
strategy:
matrix:
os:
- windows-2019
# Reducing CI footprint - windows-2019
- windows-2022
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -128,8 +130,8 @@ jobs:
matrix:
os:
- windows-2019
- windows-2022
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
# Reducing CI footprint - windows-2022
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -174,7 +176,7 @@ jobs:
# are we really learning sth new from win32? So let's save some CO2 for now disabling this
# - arch: win32
# config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.os }}
env:
CYGWIN_NOWINPATH: 1
SHELLOPTS: igncr

70
.gitignore vendored
View file

@ -67,6 +67,7 @@
doc/man1/openssl-*.pod
# Auto generated der files
providers/common/der/der_slh_dsa_gen.c
providers/common/der/der_digests_gen.c
providers/common/der/der_dsa_gen.c
providers/common/der/der_ec_gen.c
@ -74,6 +75,8 @@ providers/common/der/der_ecx_gen.c
providers/common/der/der_rsa_gen.c
providers/common/der/der_wrap_gen.c
providers/common/der/der_sm2_gen.c
providers/common/der/der_ml_dsa_gen.c
providers/common/include/prov/der_slh_dsa.h
providers/common/include/prov/der_dsa.h
providers/common/include/prov/der_ec.h
providers/common/include/prov/der_ecx.h
@ -81,6 +84,7 @@ providers/common/include/prov/der_rsa.h
providers/common/include/prov/der_digests.h
providers/common/include/prov/der_wrap.h
providers/common/include/prov/der_sm2.h
providers/common/include/prov/der_ml_dsa.h
# error code files
/crypto/err/openssl.txt.old
@ -118,6 +122,70 @@ providers/common/include/prov/der_sm2.h
/test/threadstest_fips
/test/timing_load_creds
# Demo applications
/demos/bio/client-arg
/demos/bio/client-conf
/demos/bio/saccept
/demos/bio/sconnect
/demos/bio/server-arg
/demos/bio/server-cmod
/demos/bio/server-conf
/demos/cipher/aesccm
/demos/cipher/aesgcm
/demos/cipher/aeskeywrap
/demos/cipher/ariacbc
/demos/cms/cms_comp
/demos/cms/cms_ddec
/demos/cms/cms_dec
/demos/cms/cms_denc
/demos/cms/cms_enc
/demos/cms/cms_sign
/demos/cms/cms_sign2
/demos/cms/cms_uncomp
/demos/cms/cms_ver
/demos/digest/BIO_f_md
/demos/digest/EVP_MD_demo
/demos/digest/EVP_MD_stdin
/demos/digest/EVP_MD_xof
/demos/encode/ec_encode
/demos/encode/rsa_encode
/demos/encrypt/rsa_encrypt
/demos/guide/quic-client-block
/demos/guide/quic-client-non-block
/demos/guide/quic-hq-interop
/demos/guide/quic-multi-stream
/demos/guide/tls-client-block
/demos/guide/tls-client-non-block
/demos/http3/libnghttp3.pc
/demos/http3/nghttp3/
/demos/http3/ossl-nghttp3-demo
/demos/kdf/argon2
/demos/kdf/hkdf
/demos/kdf/pbkdf2
/demos/kdf/scrypt
/demos/keyexch/x25519
/demos/mac/cmac-aes256
/demos/mac/gmac
/demos/mac/hmac-sha512
/demos/mac/poly1305
/demos/pkey/EVP_PKEY_DSA_keygen
/demos/pkey/EVP_PKEY_DSA_paramfromdata
/demos/pkey/EVP_PKEY_DSA_paramgen
/demos/pkey/EVP_PKEY_DSA_paramvalidate
/demos/pkey/EVP_PKEY_EC_keygen
/demos/pkey/EVP_PKEY_RSA_keygen
/demos/signature/EVP_DSA_Signature_demo
/demos/signature/EVP_EC_Signature_demo
/demos/signature/EVP_ED_Signature_demo
/demos/signature/rsa_pss_direct
/demos/signature/rsa_pss_hash
/demos/smime/smdec
/demos/smime/smenc
/demos/smime/smsign
/demos/smime/smsign2
/demos/smime/smver
/demos/sslecho/sslecho
# Certain files that get created by tests on the fly
/test-runs
/test/buildtest_*
@ -141,7 +209,6 @@ providers/common/include/prov/der_sm2.h
/tools/c_rehash.pl
/util/shlib_wrap.sh
/util/wrap.pl
/util/quicserver
/tags
/TAGS
*.map
@ -172,7 +239,6 @@ providers/common/include/prov/der_sm2.h
# Files created on other branches that are not held in git, and are not
# needed on this branch
/include/openssl/asn1_mac.h
/include/openssl/des_old.h
/include/openssl/fips.h
/include/openssl/fips_rand.h

3
.gitmodules vendored
View file

@ -32,3 +32,6 @@
path = fuzz/corpora
url = https://github.com/openssl/fuzz-corpora
branch = main
[submodule "pkcs11-provider"]
path = pkcs11-provider
url = https://github.com/latchset/pkcs11-provider.git

2
AUTHORS.md
View file

@ -12,6 +12,7 @@ Groups
* OpenSSL Software Services, Inc.
* OpenSSL Software Foundation, Inc.
* Google LLC
Individuals
-----------
@ -48,4 +49,5 @@ Individuals
* Tim Hudson
* Tomáš Mráz
* Ulf Möller
* Valerii Krygin
* Viktor Dukhovni

343
CHANGES.md
View file

@ -12,6 +12,7 @@ appropriate release branch.
OpenSSL Releases
----------------
- [OpenSSL 3.5](#openssl-35)
- [OpenSSL 3.4](#openssl-34)
- [OpenSSL 3.3](#openssl-33)
- [OpenSSL 3.2](#openssl-32)
@ -24,10 +25,285 @@ OpenSSL Releases
- [OpenSSL 1.0.0](#openssl-100)
- [OpenSSL 0.9.x](#openssl-09x)
OpenSSL 3.5
-----------
### Changes between 3.5 and 3.6 [xx XXX xxxx]
* none yet
### Changes between 3.4 and 3.5 [xx XXX xxxx]
* Added server side support for QUIC
*Hugo Landau, Matt Caswell, Tomáš Mráz, Neil Horman, Sasha Nedvedicky, Andrew Dinh*
* Added a `no-tls-deprecated-ec` configuration option.
The `no-tls-deprecated-ec` option disables support for TLS elliptic curve
groups deprecated in RFC8422 at compile time. This does not affect use of
the associated curves outside TLS. By default support for these groups is
compiled in, but, as before, they are not included in the default run-time
list of supported groups.
With the `enable-tls-deprecated-ec` option these TLS groups remain enabled at
compile time even if the default configuration is changed, provided the
underlying EC curves remain implemented.
*Viktor Dukhovni*
* Added new API to enable 0-RTT for 3rd party QUIC stacks.
*Cheng Zhang*
* Added support for a new callback registration `SSL_CTX_set_new_pending_conn_cb`,
which allows for application notification of new connection SSL object
creation, which occurs independently of calls to `SSL_accept_connection()`.
Note: QUIC objects passed through SSL callbacks should not have their state
mutated via calls back into the SSL api until such time as they have been
received via a call to `SSL_accept_connection()`.
*Neil Horman*
* Add SLH-DSA as specified in FIPS 205.
*Shane Lontis and Dr Paul Dale*
* ML-KEM as specified in FIPS 203.
Based on the original implementation in BoringSSL, ported from C++ to C,
refactored, and integrated into the OpenSSL default and FIPS providers.
Including also the X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024
TLS hybrid key post-quantum/classical key agreement schemes.
*Michael Baentsch, Viktor Dukhovni, Shane Lontis and Paul Dale*
* Add ML-DSA as specified in FIPS 204.
The base code was derived from BoringSSL C++ code.
*Shane Lontis, Viktor Dukhovni and Paul Dale*
* Added new API calls to enable 3rd party QUIC stacks to use the OpenSSL TLS
implementation.
*Matt Caswell*
* The default DRBG implementations have been changed to prefer to fetch
algorithm implementations from the default provider (the provider the
DRBG implementation is built in) regardless of the default properties
set in the configuration file. The code will still fallback to find
an implementation, as done previously, if needed.
*Simo Sorce*
* Initial support for opaque symmetric keys objects. These replace the ad-hoc byte
arrays that are pervasive throughout the library.
*Dmitry Belyavskiy and Simo Sorce*
* For TLSv1.3: Add capability for a client to send multiple key shares. Extend the scope of
`SSL_OP_CIPHER_SERVER_PREFERENCE` to cover server-side key exchange group selection.
Extend the server-side key exchange group selection algorithm and related group list syntax
to support multiple group priorities, e.g. to prioritize (hybrid-)KEMs.
*David Kelsey*, *Martin Schmatz*
* The default TLS group list setting is now set to:
`?*X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072`
This means two key shares (X25519MLKEM768 and X25519) will be sent by
default by the TLS client. GOST groups and FFDHE groups larger than 3072
bits are no longer enabled by default.
*Viktor Dukhovni*
* A new random generation API has been introduced which modifies all
of the L<RAND_bytes(3)> family of calls so they are routed through a
specific named provider instead of being resolved via the normal DRBG
chaining. In a future OpenSSL release, this will obsolete RAND_METHOD.
*Dr Paul Dale*
* New inline functions were added to support loads and stores of unsigned
16-bit, 32-bit and 64-bit integers in either little-endian or big-endian
form, regardless of the host byte-order. See the `OPENSSL_load_u16_le(3)`
manpage for details.
*Viktor Dukhovni*
* All the `BIO_meth_get_*()` functions allowing reuse of the internal OpenSSL
BIO method implementations were deprecated. The reuse is unsafe due to
dependency on the code of the internal methods not changing.
*Tomáš Mráz*
* Support DEFAULT keyword and '-' prefix in `SSL_CTX_set1_groups_list()`.
`SSL_CTX_set1_groups_list()` now supports the DEFAULT keyword which sets the
available groups to the default selection. The '-' prefix allows the calling
application to remove a group from the selection.
*Frederik Wedel-Heinen*
* Updated the default encryption cipher for the `req`, `cms`, and `smime` applications
from `des-ede3-cbc` to `aes-256-cbc`.
AES-256 provides a stronger 256-bit key encryption than legacy 3DES.
*Aditya*
* Enhanced PKCS#7 inner contents verification.
In the `PKCS7_verify()` function, the BIO *indata parameter refers to the
signed data if the content is detached from p7. Otherwise, indata should be
NULL, and then the signed data must be in p7.
The previous OpenSSL implementation only supported MIME inner content
[RFC 5652, section 5.2].
The added functionality now enables support for PKCS#7 inner content
[RFC 2315, section 7].
*Małgorzata Olszówka*
* The `-rawin` option of the `pkeyutl` command is now implied (and thus no
longer required) when using `-digest` or when signing or verifying with an
Ed25519 or Ed448 key.
The `-digest` and `-rawin` option may only be given with `-sign` or `verify`.
*David von Oheimb*
* `X509_PURPOSE_add()` has been modified
to take `sname` instead of `id` as the primary purpose identifier.
For its convenient use, `X509_PURPOSE_get_unused_id()` has been added.
This work was sponsored by Siemens AG.
*David von Oheimb*
* Added support for central key generation in CMP.
This work was sponsored by Siemens AG.
*Rajeev Ranjan*
* Optionally allow the FIPS provider to use the `JITTER` entropy source.
Note that using this option will require the resulting FIPS provider
to undergo entropy source validation [ESV] by the [CMVP], without this
the FIPS provider will not be FIPS compliant. Enable this using the
configuration option `enable-fips-jitter`.
*Paul Dale*
* Extended `OPENSSL_ia32cap` support to accommodate additional `CPUID`
feature/capability bits in leaf `0x7` (Extended Feature Flags) as well
as leaf `0x24` (Converged Vector ISA).
*Dan Zimmerman, Alina Elizarova*
* Cipher pipelining support for provided ciphers with new API functions
EVP_CIPHER_can_pipeline(), EVP_CipherPipelineEncryptInit(),
EVP_CipherPipelineDecryptInit(), EVP_CipherPipelineUpdate(),
and EVP_CipherPipelineFinal(). Cipher pipelining support allows application to
submit multiple chunks of data in one cipher update call, thereby allowing the
provided implementation to take advantage of parallel computing. There are
currently no built-in ciphers that support pipelining. This new API replaces
the legacy pipeline API [SSL_CTX_set_max_pipelines](https://docs.openssl.org/3.3/man3/SSL_CTX_set_split_send_fragment/) used with Engines.
*Ramkumar*
* Add CMS_NO_SIGNING_TIME flag to CMS_sign(), CMS_add1_signer()
Previously there was no way to create a CMS SignedData signature without a
signing time attribute, because CMS_SignerInfo_sign added it unconditionally.
However, there is a use case (PAdES signatures [ETSI EN 319 142-1](https://www.etsi.org/deliver/etsi_en/319100_319199/31914201/01.01.01_60/en_31914201v010101p.pdf) )
where this attribute is not allowed, so a new flag was added to the CMS API
that causes this attribute to be omitted at signing time.
The new `-no_signing_time` option of the `cms` command enables this flag.
*Juhász Péter*
* Parallel dual-prime 1024/1536/2048-bit modular exponentiation for
AVX_IFMA capable processors (Intel Sierra Forest and its successor).
This optimization brings performance enhancement, ranging from 1.8 to 2.2
times, for the sign/decryption operations of rsaz-2k/3k/4k (`openssl speed rsa`)
on the Intel Sierra Forest.
*Zhiguo Zhou, Wangyang Guo (Intel Corp)*
* VAES/AVX-512 support for AES-XTS.
For capable processors (>= Intel Icelake), this provides a
vectorized implementation of AES-XTS with a throughput improvement
between 1.3x to 2x, depending on the block size.
*Pablo De Lara Guarch, Dan Pittman*
* Fix EVP_DecodeUpdate(): do not write padding zeros to the decoded output.
According to the documentation,
for every 4 valid base64 bytes processed (ignoring whitespace, carriage returns and line feeds),
EVP_DecodeUpdate() produces 3 bytes of binary output data
(except at the end of data terminated with one or two padding characters).
However, the function behaved like an EVP_DecodeBlock():
produces exactly 3 output bytes for every 4 input bytes.
Such behaviour could cause writes to a non-allocated output buffer
if a user allocates its size based on the documentation and knowing the padding size.
The fix makes EVP_DecodeUpdate() produce
exactly as many output bytes as in the initial non-encoded message.
*Valerii Krygin*
OpenSSL 3.4
-----------
### Changes between 3.3 and 3.4 [xx XXX xxxx]
### Changes between 3.4.1 and 3.4.2 [xx XXX xxxx]
* When displaying distinguished names in the openssl application escape control
characters by default.
*Tomáš Mráz*
### Changes between 3.4.0 and 3.4.1 [11 Feb 2025]
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.
([CVE-2024-12797])
*Viktor Dukhovni*
* Fixed timing side-channel in ECDSA signature computation.
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In particular
the NIST P-521 curve is affected. To be able to measure this leak, the
attacker process must either be located in the same physical computer or
must have a very fast network connection with low latency.
([CVE-2024-13176])
*Tomáš Mráz*
* Reverted the behavior change of CMS_get1_certs() and CMS_get1_crls()
that happened in the 3.4.0 release. These functions now return NULL
again if there are no certs or crls in the CMS object.
*Tomáš Mráz*
### Changes between 3.3 and 3.4.0 [22 Oct 2024]
* For the FIPS provider only, replaced the primary DRBG with a continuous
health check module. This also removes the now forbidden DRBG chaining.
*Paul Dale*
* Improved base64 BIO correctness and error reporting.
@ -75,7 +351,7 @@ OpenSSL 3.4
[fips_module(7)]: https://docs.openssl.org/master/man7/fips_module/#FIPS indicators
*Shane Lontis, Paul Dale and Po-Hsing Wu*
*Shane Lontis, Paul Dale, Po-Hsing Wu and Dimitri John Ledkov*
* Added support for hardware acceleration for HMAC on S390x architecture.
@ -118,7 +394,7 @@ OpenSSL 3.4
* Added options `-not_before` and `-not_after` for explicit setting
start and end dates of certificates created with the `req` and `x509`
apps. Added the same options also to `ca` app as alias for
commands. Added the same options also to `ca` command as alias for
`-startdate` and `-enddate` options.
*Stephan Wurm*
@ -157,7 +433,9 @@ OpenSSL 3.4
*Rajeev Ranjan*
* Added support for requesting CRL in CMP.
* Added support for retrieving certificate request templates and CRLs in CMP,
with the respective CLI options `-template`,
`-crlcert`, `-oldcrl`, `-crlout`, `-crlform>`, and `-rsp_crl`.
This work was sponsored by Siemens AG.
@ -197,7 +475,25 @@ OpenSSL 3.4
OpenSSL 3.3
-----------
### Changes between 3.3.1 and 3.3.2 [xx XXX xxxx]
### Changes between 3.3.2 and 3.3.3 [xx XXX xxxx]
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
Use of the low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial can lead to out-of-bounds memory
reads or writes.
Applications working with "exotic" explicit binary (GF(2^m)) curve
parameters, that make it possible to represent invalid field polynomials
with a zero constant term, via the above or similar APIs, may terminate
abruptly as a result of reading or writing outside of array bounds. Remote
code execution cannot easily be ruled out.
([CVE-2024-9143])
*Viktor Dukhovni*
### Changes between 3.3.1 and 3.3.2 [3 Sep 2024]
* Fixed possible denial of service in X.509 name checks.
@ -345,6 +641,8 @@ OpenSSL 3.3
- `certProfile` request message header and respective `-profile` CLI option
- support for delayed delivery of all types of response messages
This work was sponsored by Siemens AG.
*David von Oheimb*
* The build of exporters (such as `.pc` files for pkg-config) cleaned up to
@ -650,11 +948,6 @@ OpenSSL 3.2
*Fergus Dall*
* Added support for securely getting root CA certificate update in
CMP.
*David von Oheimb*
* Improved contention on global write locks by using more read locks where
appropriate.
@ -907,21 +1200,24 @@ OpenSSL 3.2
* Lutz Jänicke*
* The `x509`, `ca`, and `req` apps now produce X.509 v3 certificates.
* The `x509`, `ca`, and `req` commands now produce X.509 v3 certificates.
The `-x509v1` option of `req` prefers generation of X.509 v1 certificates.
`X509_sign()` and `X509_sign_ctx()` make sure that the certificate has
X.509 version 3 if the certificate information includes X.509 extensions.
*David von Oheimb*
* Fix and extend certificate handling and the apps `x509`, `verify` etc.
* Fix and extend certificate handling and the commands `x509`, `verify` etc.
such as adding a trace facility for debugging certificate chain building.
*David von Oheimb*
* Various fixes and extensions to the CMP+CRMF implementation and the `cmp` app
in particular supporting requests for central key generation, generalized
polling, and various types of genm/genp exchanges defined in CMP Updates.
in particular supporting various types of genm/genp exchanges such as getting
CA certificates and root CA cert updates defined in CMP Updates [RFC 9480],
as well as the `-srvcertout` and `-serial` CLI options.
This work was sponsored by Siemens AG.
*David von Oheimb*
@ -1243,7 +1539,7 @@ OpenSSL 3.1
*Orr Toledano*
* s_client and s_server apps now explicitly say when the TLS version
* `s_client` and `s_server` commands now explicitly say when the TLS version
does not include the renegotiation mechanism. This avoids confusion
between that scenario versus when the TLS version includes secure
renegotiation but the peer lacks support for it.
@ -2294,7 +2590,8 @@ breaking changes, and mappings for the large list of deprecated functions.
*Nicola Tuveri*
* Behavior of the `pkey` app is changed, when using the `-check` or `-pubcheck`
* Behavior of the `pkey` command is changed,
when using the `-check` or `-pubcheck`
switches: a validation failure triggers an early exit, returning a failure
exit status to the parent process.
@ -8534,7 +8831,7 @@ OpenSSL 1.0.1
*Matt Caswell*
* Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
built with the no-ssl3 option and an SSL v3 ClientHello is received the ssl
method would be set to NULL which could later result in a NULL pointer
dereference. Thanks to Frank Schmirler for reporting this issue.
([CVE-2014-3569])
@ -9599,7 +9896,7 @@ OpenSSL 1.0.0
*Matt Caswell*
* Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
built with the no-ssl3 option and an SSL v3 ClientHello is received the ssl
method would be set to NULL which could later result in a NULL pointer
dereference. Thanks to Frank Schmirler for reporting this issue.
([CVE-2014-3569])
@ -15730,7 +16027,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
*stefank@valicert.com via Richard Levitte*
* Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
* Add an SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
the bitwise-OR of the two for use by the majority of applications
@ -16279,7 +16576,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
### Changes between 0.9.6a and 0.9.6b [9 Jul 2001]
* Change ssleay_rand_bytes (crypto/rand/md_rand.c)
to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
to avoid an SSLeay/OpenSSL PRNG weakness pointed out by
Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
PRNG state recovery was possible based on the output of
one PRNG request appropriately sized to gain knowledge on
@ -18880,7 +19177,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
* Bugfix: ssl23_get_client_hello did not work properly when called in
state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
an SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
but a retry condition occurred while trying to read the rest.
*Bodo Moeller*
@ -20856,6 +21153,8 @@ ndif
<!-- Links -->
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
@ -21049,3 +21348,5 @@ ndif
[CVE-2002-0657]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0657
[CVE-2002-0656]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0656
[CVE-2002-0655]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0655
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations

59
Configurations/50-cppbuilder.conf
View file

@ -58,5 +58,64 @@ my %targets = (
shared_defflag => '',
perl_platform => 'Windows::cppbuilder',
uplink_arch => 'common',
},
"BC-64" => {
inherit_from => [ "BASE_Windows" ],
sys_id => "WIN64",
bn_ops => "BN_LLONG",
thread_scheme => "winthreads",
cc => "bcc64",
CPP => "cpp64 -oCON -Sc -Sr",
defines => add("WIN32_LEAN_AND_MEAN", "OPENSSL_SYS_WIN64",
"L_ENDIAN", "DSO_WIN32", "_stricmp=stricmp",
"_strnicmp=strnicmp", "_setmode=setmode"),
cflags => picker(default => add("-q -c",
threads("-tM"),
shared("-tR")),
debug => "-Od -v -vi- -D_DEBUG",
release => "-O2"),
bin_cflags => "-tWC",
lib_cflags => shared("-tWD -D_WINDLL -D_DLL"),
coutflag => "-o",
# -Sx isn't documented, but 'cpp64 -H -S' explains it:
#
# -Sx Omit preprocessed text in output
makedepcmd => "cpp64 -oCON -Sx -Hp",
makedep_scheme => "embarcadero",
LD => "ilink64",
LDFLAGS => picker(default => "-x -Gn -q -w-dup",
debug => '-j"$(BDS)\lib\win64\debug" ' .
'-L"$(BDS)\lib\win64\debug" -v',
release => '-j"$(BDS)\lib\win64\release" ' .
'-L"$(BDS)\lib\win64\release"'),
bin_lflags => "-ap -Tpe c0x64.o wildargs.o",
ldoutflag => ",",
ldpostoutflag => ",,",
ld_resp_delim => " +\n",
ex_libs => add(sub {
my @ex_libs = ("import64.a",
($disabled{shared}
? ($disabled{threads} ? "cw64.a" : "cw64mt.a")
: ($disabled{threads} ? "cw64i.a" : "cw64mti.a")));
push @ex_libs, "ws2_32.a" unless $disabled{sock};
return join(" ", @ex_libs);
}),
AR => "tlib",
ARFLAGS => "/P256 /N /u",
ar_resp_delim => " &\n",
RC => "brcc32",
RCFLAGS => '-i"$(BDS)\include\windows\sdk"',
rcoutflag => "-fo",
shared_target => "win-shared",
shared_ldflag => "-aa -Tpd c0d64.o",
lddefflag => ",",
ldresflag => ",",
ld_implib_rule => 'implib -a $< $**',
dso_scheme => "win64",
shared_defflag => '',
perl_platform => 'Windows::cppbuilder',
uplink_arch => 'common',
}
);

31
Configurations/50-nonstop.conf
View file

@ -173,6 +173,15 @@
ex_libs => '-lput',
},
######################################################################
# Build models
'nonstop-model-klt' => {
template => 1,
defines => ['_KLT_MODEL_',
'_REENTRANT', '_THREAD_SUPPORT_FUNCTIONS'],
ex_libs => '-lklt',
},
######################################################################
# Now for the entries themselves, let's combine things!
'nonstop-nsx' => {
@ -211,6 +220,28 @@
multibin => '64-put',
disable => ['atexit'],
},
'nonstop-nsx_64_klt' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-x86_64-oss',
'nonstop-lp64-x86_64',
'nonstop-efloat-x86_64',
'nonstop-model-klt' ],
multilib => '64-klt',
multibin => '64-klt',
disable => ['atexit'],
},
'nonstop-nsx_g' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-x86_64-guardian',
'nonstop-ilp32', 'nonstop-nfloat-x86_64' ],
disable => ['threads','atexit'],
},
'nonstop-nsx_g_tandem' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-x86_64-guardian',
'nonstop-ilp32', 'nonstop-tfloat-x86_64' ],
disable => ['threads','atexit'],
},
'nonstop-nsv' => {
inherit_from => [ 'nonstop-nsx' ],
},

2
Configurations/50-win-clang-cl.conf
View file

@ -11,7 +11,7 @@ my %targets = (
multilib => "-arm64",
asm_arch => "aarch64",
AS => "clang-cl.exe",
ASFLAGS => "/nologo /Zi",
ASFLAGS => "/nologo /Zi --target=arm64-pc-windows-msvc",
asflags => "/c",
asoutflag => "/Fo",
perlasm_scheme => "win64",

7
Configurations/unix-Makefile.tmpl
View file

@ -1173,7 +1173,7 @@ generate_buildinfo: generate_doc_buildinfo
.PHONY: doc-nits md-nits
doc-nits: build_generated_pods ## Evaluate OpenSSL documentation
$(PERL) $(SRCDIR)/util/find-doc-nits -c -n -l -e
$(PERL) $(SRCDIR)/util/find-doc-nits -c -n -l -e -i
# This uses "mdl", the markdownlint application, which is written in ruby.
# The source is at https://github.com/markdownlint/markdownlint
@ -1338,8 +1338,7 @@ errors:
include/internal/asn1.h
include/internal/sslconf.h );
my @cryptoskipheaders = ( @sslheaders_tmpl,
qw( include/openssl/asn1_mac.h
include/openssl/conf_api.h
qw( include/openssl/conf_api.h
include/openssl/ebcdic.h
include/openssl/opensslconf.h
include/openssl/symhacks.h ) );
@ -1746,7 +1745,7 @@ EOF
} elsif ($makedep_scheme eq 'gcc' && !grep /\.rc$/, @srcs) {
$recipe .= <<"EOF";
$obj: $deps
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -c -o \$\@ $srcs
\@touch $dep.tmp
\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
rm -f $dep.tmp; \\

36
Configure
View file

@ -1,6 +1,6 @@
#! /usr/bin/env perl
# -*- mode: perl; -*-
# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -81,6 +81,11 @@ EOF
# enable-demos Enable the building of the example code in the demos directory
# enable-h3demo Enable the http3 demo, which currently only links to the
# external nghttp3 library on unix platforms
#
# enable-hqinterop
# Enable the building of the hq-interop code for construction
# of the interop container
#
# no-hw do not compile support for any crypto hardware.
# [no-]threads [don't] try to create a library that is suitable for
# multithreaded applications (default is "threads" if we
@ -448,6 +453,7 @@ my @disablables = (
"default-thread-pool",
"demos",
"h3demo",
"hqinterop",
"deprecated",
"des",
"devcryptoeng",
@ -472,11 +478,13 @@ my @disablables = (
"fips",
"fips-securitychecks",
"fips-post",
"fips-jitter",
"fuzz-afl",
"fuzz-libfuzzer",
"gost",
"http",
"idea",
"integrity-only-ciphers",
"jitter",
"ktls",
"legacy",
@ -485,6 +493,8 @@ my @disablables = (
"md2",
"md4",
"mdc2",
"ml-dsa",
"ml-kem",
"module",
"msan",
"multiblock",
@ -513,6 +523,7 @@ my @disablables = (
"shared",
"siphash",
"siv",
"slh-dsa",
"sm2",
"sm2-precomp",
"sm3",
@ -525,12 +536,13 @@ my @disablables = (
"ssl-trace",
"static-engine",
"stdio",
"sslkeylog",
"tests",
"tfo",
"thread-pool",
"threads",
"tls",
"integrity-only-ciphers",
"tls-deprecated-ec",
"trace",
"ts",
"ubsan",
@ -573,6 +585,7 @@ my %deprecated_disablables = (
our %disabled = ( # "what" => "comment"
"fips" => "default",
"fips-jitter" => "default",
"asan" => "default",
"brotli" => "default",
"brotli-dynamic" => "default",
@ -581,6 +594,7 @@ our %disabled = ( # "what" => "comment"
"crypto-mdebug-backtrace" => "default",
"demos" => "default",
"h3demo" => "default",
"hqinterop" => "default",
"devcryptoeng" => "default",
"ec_nistp_64_gcc_128" => "default",
"egd" => "default",
@ -596,6 +610,7 @@ our %disabled = ( # "what" => "comment"
"sctp" => "default",
"ssl3" => "default",
"ssl3-method" => "default",
"sslkeylog" => "default",
"tfo" => "default",
"trace" => "default",
"ubsan" => "default",
@ -618,8 +633,8 @@ my @disable_cascades = (
"ec", "engine",
"filenames",
"idea", "ktls",
"md4", "multiblock", "nextprotoneg",
"ocsp", "ocb", "poly1305", "psk",
"md4", "ml-dsa", "ml-kem", "multiblock",
"nextprotoneg", "ocsp", "ocb", "poly1305", "psk",
"rc2", "rc4", "rmd160",
"seed", "siphash", "siv",
"sm3", "sm4", "srp",
@ -635,7 +650,8 @@ my @disable_cascades = (
"brotli" => [ "brotli-dynamic" ],
"zstd" => [ "zstd-dynamic" ],
"des" => [ "mdc2" ],
"ec" => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost", "ecx" ],
"deprecated" => [ "tls-deprecated-ec" ],
"ec" => [ qw(ec2m ecdsa ecdh sm2 gost ecx tls-deprecated-ec) ],
"dgram" => [ "dtls", "quic", "sctp" ],
"sock" => [ "dgram", "tfo" ],
"dtls" => [ @dtls ],
@ -689,7 +705,8 @@ my @disable_cascades = (
"cmp" => [ "crmf" ],
"fips" => [ "fips-securitychecks", "fips-post", "acvp-tests" ],
"fips" => [ "fips-securitychecks", "fips-post", "acvp-tests",
"fips-jitter" ],
"threads" => [ "thread-pool" ],
"thread-pool" => [ "default-thread-pool" ],
@ -957,6 +974,11 @@ while (@argvcopy)
{
delete $disabled{"zstd"};
}
elsif ($1 eq "fips-jitter")
{
delete $disabled{"fips"};
delete $disabled{"jitter"};
}
my $algo = $1;
delete $disabled{$algo};
@ -1918,7 +1940,7 @@ foreach my $what (sort keys %disabled) {
$skipdir{engines} = $what if $what eq 'engine';
$skipdir{"crypto/$skipdir"} = $what
unless $what eq 'async' || $what eq 'err' || $what eq 'dso';
unless $what eq 'async' || $what eq 'err' || $what eq 'dso' || $what eq 'http';
}
}

74
INSTALL.md
View file

@ -536,7 +536,7 @@ shown below:
[random]
seed=JITTER
It uses a statically linked [jitterentropy-library](https://github.com/smuellerDD/jitterentropy-library) as the seed source.
It uses a statically linked [jitterentropy-library] as the seed source.
Additional configuration flags available:
@ -781,6 +781,12 @@ Don't build support for Elliptic Curves.
Don't build support for binary Elliptic Curves
### no-tls-deprecated-ec
Disable legacy TLS EC groups that were deprecated in RFC8422. These are the
Koblitz curves, B<secp160r1>, B<secp160r2>, B<secp192r1>, B<secp224r1>, and the
binary Elliptic curves that would also be disabled by C<no-ec2m>.
### enable-ec_nistp_64_gcc_128
Enable support for optimised implementations of some commonly used NIST
@ -841,6 +847,19 @@ Don't perform FIPS module Power On Self Tests.
This option MUST be used for debugging only as it makes the FIPS provider
non-compliant. It is useful when setting breakpoints in FIPS algorithms.
### enable-fips-jitter
Use the CPU Jitter library as a FIPS validated entropy source.
This option will only produce a compliant FIPS provider if you have:
1. independently performed the required [SP 800-90B] entropy assessments;
2. meet the minimum required entropy as specified by [jitterentropy-library];
3. obtain an [ESV] certificate for the [jitterentropy-library] and
4. have had the resulting FIPS provider certified by the [CMVP].
Failure to do all of these will produce a non-compliant FIPS provider.
### enable-fuzz-libfuzzer, enable-fuzz-afl
Build with support for fuzzing using either libfuzzer or AFL.
@ -872,6 +891,16 @@ Disabling this also disables the legacy algorithms: MD2 (already disabled by def
Don't generate dependencies.
### no-ml-dsa
Disable Module-Lattice-Based Digital Signature Standard (ML-DSA) support.
ML-DSA is based on CRYSTALS-DILITHIUM. See [FIPS 204].
### no-ml-kem
Disable Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
support. ML-KEM is based on CRYSTALS-KYBER. See [FIPS 203].
### no-module
Don't build any dynamically loadable engines.
@ -961,6 +990,11 @@ Do not create shared libraries, only static ones.
See [Notes on shared libraries](#notes-on-shared-libraries) below.
### no-slh-dsa
Disable Stateless Hash Based Digital Signature Standard support.
(SLH-DSA is based on SPHINCS+. See [FIPS 205])
### no-sm2-precomp
Disable using the SM2 precomputed table on aarch64 to make the library smaller.
@ -1065,6 +1099,17 @@ Build with support for the integrated tracing api.
See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
### enable-sslkeylog
Build with support for the SSLKEYLOGFILE environment variable
When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged
during a TLS handshake for use in analysis tools like wireshark. Note that the
use of this mechanism allows for decryption of application payloads found in
captured packets using keys from the key log file and therefore has significant
security consequences. See Section 3 of
[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/)
### no-ts
Don't build Time Stamping (TS) Authority support.
@ -1176,9 +1221,9 @@ Build with support for the specified algorithm.
### no-{algorithm}
no-{aria|bf|blake2|camellia|cast|chacha|cmac|
des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
poly1305|rc2|rc4|rmd160|scrypt|seed|
siphash|siv|sm2|sm3|sm4|whirlpool}
des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ml-dsa|
ml-kem|ocb|poly1305|rc2|rc4|rmd160|scrypt|
seed|siphash|siv|sm2|sm3|sm4|whirlpool}
Build without support for the specified algorithm.
@ -2006,3 +2051,24 @@ is used, as it is the version of the GNU assembler that will be checked.
[10-main.conf]:
Configurations/10-main.conf
[CMVP]:
<https://csrc.nist.gov/projects/cryptographic-module-validation-program>
[ESV]:
<https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations>
[FIPS 203]:
<https://csrc.nist.gov/pubs/fips/203/final>
[FIPS 204]:
<https://csrc.nist.gov/pubs/fips/204/final>
[SP 800-90B]:
<https://csrc.nist.gov/pubs/sp/800/90/b/final>
[jitterentropy-library]:
<https://github.com/smuellerDD/jitterentropy-library>
[FIPS 205]:
<https://csrc.nist.gov/pubs/fips/205/final>

86
NEWS.md
View file

@ -7,6 +7,8 @@ release. For more details please read the CHANGES file.
OpenSSL Releases
----------------
- [OpenSSL 3.5](#openssl-35)
- [OpenSSL 3.4](#openssl-34)
- [OpenSSL 3.3](#openssl-33)
- [OpenSSL 3.2](#openssl-32)
- [OpenSSL 3.1](#openssl-31)
@ -18,16 +20,72 @@ OpenSSL Releases
- [OpenSSL 1.0.0](#openssl-100)
- [OpenSSL 0.9.x](#openssl-09x)
OpenSSL 3.5
-----------
### Major changes between OpenSSL 3.5 and OpenSSL 3.6 [under development]
* none
### Major changes between OpenSSL 3.4 and OpenSSL 3.5 [under development]
OpenSSL 3.5.0 is a feature release adding significant new functionality to
OpenSSL.
This release incorporates the following potentially significant or incompatible
changes:
* Default encryption cipher for the `req`, `cms`, and `smime` applications
changed from `des-ede3-cbc` to `aes-256-cbc`.
* The TLS supported groups list has been changed in favor of PQC support.
* The default TLS keyshares have been changed to offer X25519MLKEM768 and
and X25519.
This release adds the following new features:
* Support for server side QUIC (RFC 9000)
* Support for 3rd party QUIC stacks
* Support for PQC algorithms (ML-KEM, ML-DSA, SLH-DSA)
* Allow the FIPS provider to optionally use the `JITTER` seed source.
Because this seed source is not part of the OpenSSL FIPS validations,
it should only be enabled after the [jitterentropy-library] has been
assessed for entropy quality. Moreover, the FIPS provider including
this entropy source will need to obtain an [ESV] from the [CMVP] before
FIPS compliance can be claimed. Enable this using the configuration
option `enable-fips-jitter`.
* Support for central key generation in CMP
* Support added for opaque symmetric key objects (EVP_SKEY).
* Support for multiple TLS keyshares.
OpenSSL 3.4
-----------
### Major changes between OpenSSL 3.3 and OpenSSL 3.4 [under development]
### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [11 Feb 2025]
OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this
release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
([CVE-2024-12797])
* Fixed timing side-channel in ECDSA signature computation.
([CVE-2024-13176])
### Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]
OpenSSL 3.4.0 is a feature release adding significant new functionality to
OpenSSL.
This release is in development.
This release incorporates the following potentially significant or incompatible
changes:
@ -76,7 +134,7 @@ This release adds the following new features:
* Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
* Support for requesting CRL in CMP
* Support for retrieving certificate request templates and CRLs in CMP
* Support for additional X.509v3 extensions related to Attribute Certificates
@ -88,7 +146,18 @@ This release adds the following new features:
OpenSSL 3.3
-----------
### Major changes between OpenSSL 3.3.1 and OpenSSL 3.3.2 [under development]
### Major changes between OpenSSL 3.3.2 and OpenSSL 3.3.3 [under development]
OpenSSL 3.3.3 is a security patch release. The most severe CVE fixed in this
release is Low.
This release incorporates the following bug fixes and mitigations:
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
([CVE-2024-9143])
### Major changes between OpenSSL 3.3.1 and OpenSSL 3.3.2 [3 Sep 2024]
OpenSSL 3.3.2 is a security patch release. The most severe CVE fixed in this
release is Moderate.
@ -177,6 +246,8 @@ This release adds the following new features:
* Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
* Support for using certificate profiles and extened delayed delivery in CMP
This release incorporates the following potentially significant or incompatible
changes:
@ -1809,6 +1880,8 @@ OpenSSL 0.9.x
<!-- Links -->
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
@ -1986,3 +2059,6 @@ OpenSSL 0.9.x
[CHANGES.md]: ./CHANGES.md
[README-QUIC.md]: ./README-QUIC.md
[issue tracker]: https://github.com/openssl/openssl/issues
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[jitterentropy-library]: https://github.com/smuellerDD/jitterentropy-library

14
NOTES-NONSTOP.md
View file

@ -30,9 +30,16 @@ for each on the TNS/X (L-Series) platform:
* `nonstop-nsx` or default will select an unthreaded 32-bit build.
* `nonstop-nsx_64` selects an unthreaded 64-bit memory and file length build.
* `nonstop-nsx_64_klt` selects the 64-bit memory and file length KLT build.
* `nonstop-nsx_put` selects the PUT build.
* `nonstop-nsx_64_put` selects the 64-bit memory and file length PUT build.
The KLT threading model is a newly released model on NonStop. It implements
kernel-level threading. KLT provides much closer threading to what OpenSSL
uses for Linux-like threading models. KLT continues to use the pthread library
API. There is no supported 32-bit or Guardian builds for KLT. Note: KLT is
not currently available but is planned for post-2024.
The SPT threading model is no longer supported as of OpenSSL 3.2.
The PUT model is incompatible with the QUIC capability. This capability should
@ -124,12 +131,9 @@ correctly, you also need the `COMP_ROOT` set, as in:
`COMP_ROOT` needs to be in Windows form.
`Configure` must specify the `no-makedepend` option otherwise errors will
result when running the build because the c99 cross-compiler does not support
the `gcc -MT` option. An example of a `Configure` command to be run from the
OpenSSL directory is:
An example of a `Configure` command to be run from the OpenSSL directory is:
./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
./Configure nonstop-nsx_64 --with-rand-seed=rdcpu
Do not forget to include any OpenSSL cross-compiling prefix and certificate
options when creating your libraries.

8
NOTES-WINDOWS.md
View file

@ -114,7 +114,7 @@ Can be administratively set, and openssl will take the paths found there as the
values for OPENSSLDIR, ENGINESDIR and MODULESDIR respectively.
To enable the reading of registry keys from windows builds, add
`-DOPENSSL_WINCTX=<string>`to the Configure command line. This define is used
`-DOSSL_WINCTX=<string>`to the Configure command line. This define is used
at build-time to construct library build specific registry key paths of the
format:
`\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\OpenSSL-<version>-<ctx>`
@ -148,8 +148,8 @@ Native builds using Embarcadero C++Builder
=========================================
This toolchain (a descendant of Turbo/Borland C++) is an alternative to MSVC.
OpenSSL currently includes an experimental 32-bit configuration targeting the
Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
OpenSSL currently includes experimental 32-bit and 64-bit configurations targeting the
Clang-based compiler (`bcc32c.exe` and `bcc64.exe`) in v10.3.3 Community Edition.
<https://www.embarcadero.com/products/cbuilder/starter>
1. Install Perl.
@ -158,6 +158,8 @@ Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
3. Go to the root of the OpenSSL source directory and run:
`perl Configure BC-32 --prefix=%CD%`
for Win64 builds use:
`perl Configure BC-64 --prefix=%CD%`
4. `make -N`

16
README-FIPS.md
View file

@ -167,6 +167,22 @@ manual page.
[fips_module(7)]: https://www.openssl.org/docs/manmaster/man7/fips_module.html
Entropy Source
==============
The FIPS provider typically relies on an external entropy source,
specified during OpenSSL build configuration (default: `os`). However, by
enabling the `enable-fips-jitter` option during configuration, an internal
jitter entropy source will be used instead. Note that this will cause
the FIPS provider to operate in a non-compliant mode unless an entropy
assessment [ESV] and validation through the [CMVP] are additionally conducted.
Note that the `enable-fips-jitter` option is only available in OpenSSL
versions 3.5 and later.
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
3rd-Party Vendor Builds
=====================================

33
README.md
View file

@ -5,7 +5,8 @@ Welcome to the OpenSSL Project
[![github actions ci badge]][github actions ci]
![Nightly OS Zoo ci badge](https://github.com/openssl/openssl/actions/workflows/os-zoo.yml/badge.svg)
![Provider Compatibility]( https://github.com/openssl/openssl/actions/workflows/provider-compatibility.yml/badge.svg)
![Provider Compatibility](https://github.com/openssl/openssl/actions/workflows/provider-compatibility.yml/badge.svg)
![Quic Interop](https://github.com/openssl/openssl/actions/workflows/run_quic_interop.yml/badge.svg)
![Daily checks](https://github.com/openssl/openssl/actions/workflows/run-checker-daily.yml/badge.svg)
OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
@ -66,7 +67,7 @@ For Production Use
------------------
Source code tarballs of the official releases can be downloaded from
[www.openssl.org/source](https://www.openssl.org/source).
[openssl-library.org/source/](https://openssl-library.org/source/).
The OpenSSL project does not distribute the toolkit in binary form.
However, for a large variety of operating systems precompiled versions
@ -86,22 +87,18 @@ the source tarballs, having a local copy of the git repository with
the entire project history gives you much more insight into the
code base.
The official OpenSSL Git Repository is located at [git.openssl.org].
There is a GitHub mirror of the repository at [github.com/openssl/openssl],
The main OpenSSL Git repository is private.
There is a public GitHub mirror of it at [github.com/openssl/openssl],
which is updated automatically from the former on every commit.
A local copy of the Git Repository can be obtained by cloning it from
the original OpenSSL repository using
git clone git://git.openssl.org/openssl.git
or from the GitHub mirror using
A local copy of the Git repository can be obtained by cloning it from
the GitHub mirror using
git clone https://github.com/openssl/openssl.git
If you intend to contribute to OpenSSL, either to fix bugs or contribute
new features, you need to fork the OpenSSL repository openssl/openssl on
GitHub and clone your public fork instead.
new features, you need to fork the GitHub mirror and clone your public fork
instead.
git clone https://github.com/yourname/openssl.git
@ -161,7 +158,7 @@ available online.
Demos
-----
The are numerous source code demos for using various OpenSSL capabilities in the
There are numerous source code demos for using various OpenSSL capabilities in the
[demos subfolder](./demos).
Wiki
@ -201,7 +198,7 @@ attempting to develop or distribute cryptographic code.
Copyright
=========
Copyright (c) 1998-2024 The OpenSSL Project Authors
Copyright (c) 1998-2025 The OpenSSL Project Authors
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
@ -213,14 +210,6 @@ All rights reserved.
<https://www.openssl.org>
"OpenSSL Homepage"
[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"
[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"
[github.com/openssl/openssl]:
<https://github.com/openssl/openssl>
"OpenSSL GitHub Mirror"

4
VERSION.dat
View file

@ -1,7 +1,7 @@
MAJOR=3
MINOR=4
MINOR=6
PATCH=0
PRE_RELEASE_TAG=beta1-dev
PRE_RELEASE_TAG=dev
BUILD_METADATA=
RELEASE_DATE=""
SHLIB_VERSION=3

5
apps/asn1parse.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -127,7 +127,8 @@ int asn1parse_main(int argc, char **argv)
dump = strtol(opt_arg(), NULL, 0);
break;
case OPT_STRPARSE:
sk_OPENSSL_STRING_push(osk, opt_arg());
if (sk_OPENSSL_STRING_push(osk, opt_arg()) <= 0)
goto end;
break;
case OPT_GENSTR:
genstr = opt_arg();

2
apps/build.info
View file

@ -16,7 +16,7 @@ $OPENSSLSRC=\
enc.c errstr.c \
genpkey.c kdf.c mac.c nseq.c passwd.c pkcs7.c \
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
s_client.c s_server.c s_time.c sess_id.c skeyutl.c smime.c speed.c \
spkac.c verify.c version.c x509.c rehash.c storeutl.c \
list.c info.c fipsinstall.c pkcs12.c
IF[{- !$disabled{'ec'} -}]

2
apps/ca.c
View file

@ -6,6 +6,8 @@
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

119
apps/cmp.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
@ -10,6 +10,7 @@
*/
/* This app is disabled when OPENSSL_NO_CMP is defined. */
#include "internal/e_os.h"
#include <string.h>
#include <ctype.h>
@ -123,6 +124,8 @@ static char *opt_profile = NULL;
/* certificate enrollment */
static char *opt_newkey = NULL;
static char *opt_newkeypass = NULL;
static int opt_centralkeygen = 0;
static char *opt_newkeyout = NULL;
static char *opt_subject = NULL;
static int opt_days = 0;
static char *opt_reqexts = NULL;
@ -198,6 +201,8 @@ static char *opt_srv_trusted = NULL;
static char *opt_srv_untrusted = NULL;
static char *opt_ref_cert = NULL;
static char *opt_rsp_cert = NULL;
static char *opt_rsp_key = NULL;
static char *opt_rsp_keypass = NULL;
static char *opt_rsp_crl = NULL;
static char *opt_rsp_extracerts = NULL;
static char *opt_rsp_capubs = NULL;
@ -229,7 +234,8 @@ typedef enum OPTION_choice {
OPT_CMD, OPT_INFOTYPE, OPT_PROFILE, OPT_GENINFO,
OPT_TEMPLATE, OPT_KEYSPEC,
OPT_NEWKEY, OPT_NEWKEYPASS, OPT_SUBJECT,
OPT_NEWKEY, OPT_NEWKEYPASS, OPT_CENTRALKEYGEN,
OPT_NEWKEYOUT, OPT_SUBJECT,
OPT_DAYS, OPT_REQEXTS,
OPT_SANS, OPT_SAN_NODEFAULT,
OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,
@ -281,7 +287,8 @@ typedef enum OPTION_choice {
OPT_SRV_REF, OPT_SRV_SECRET,
OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,
OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,
OPT_REF_CERT, OPT_RSP_CERT, OPT_RSP_CRL, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
OPT_REF_CERT, OPT_RSP_CERT, OPT_RSP_KEY, OPT_RSP_KEYPASS,
OPT_RSP_CRL, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
OPT_RSP_NEWWITHNEW, OPT_RSP_NEWWITHOLD, OPT_RSP_OLDWITHNEW,
OPT_POLL_COUNT, OPT_CHECK_AFTER,
OPT_GRANT_IMPLICITCONF,
@ -325,6 +332,10 @@ const OPTIONS cmp_options[] = {
{"newkey", OPT_NEWKEY, 's',
"Private or public key for the requested cert. Default: CSR key or client key"},
{"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},
{"centralkeygen", OPT_CENTRALKEYGEN, '-',
"Request central (server-side) key generation. Default is local generation"},
{"newkeyout", OPT_NEWKEYOUT, 's',
"File to save centrally generated key, in PEM format"},
{"subject", OPT_SUBJECT, 's',
"Distinguished Name (DN) of subject to use in the requested cert template"},
{OPT_MORE_STR, 0, 0,
@ -570,6 +581,12 @@ const OPTIONS cmp_options[] = {
"Certificate to be expected for rr and any oldCertID in kur messages"},
{"rsp_cert", OPT_RSP_CERT, 's',
"Certificate to be returned as mock enrollment result"},
{"rsp_key", OPT_RSP_KEY, 's',
"Private key for the certificate to be returned as mock enrollment result"},
{OPT_MORE_STR, 0, 0,
"Key to be returned for central key pair generation"},
{"rsp_keypass", OPT_RSP_KEYPASS, 's',
"Response private key (and cert) pass phrase source"},
{"rsp_crl", OPT_RSP_CRL, 's',
"CRL to be returned in genp of type crls"},
{"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
@ -629,8 +646,8 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
{&opt_cmd_s}, {&opt_infotype_s}, {&opt_profile}, {&opt_geninfo},
{&opt_template}, {&opt_keyspec},
{&opt_newkey}, {&opt_newkeypass}, {&opt_subject},
{(char **)&opt_days}, {&opt_reqexts},
{&opt_newkey}, {&opt_newkeypass}, {(char **)&opt_centralkeygen},
{&opt_newkeyout}, {&opt_subject}, {(char **)&opt_days}, {&opt_reqexts},
{&opt_sans}, {(char **)&opt_san_nodefault},
{&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},
{(char **)&opt_popo}, {&opt_csr},
@ -682,8 +699,8 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
{&opt_srv_ref}, {&opt_srv_secret},
{&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},
{&opt_srv_trusted}, {&opt_srv_untrusted},
{&opt_ref_cert}, {&opt_rsp_cert}, {&opt_rsp_crl},
{&opt_rsp_extracerts}, {&opt_rsp_capubs},
{&opt_ref_cert}, {&opt_rsp_cert}, {&opt_rsp_key}, {&opt_rsp_keypass},
{&opt_rsp_crl}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
{&opt_rsp_newwithnew}, {&opt_rsp_newwithold}, {&opt_rsp_oldwithnew},
{(char **)&opt_poll_count}, {(char **)&opt_check_after},
@ -1196,11 +1213,25 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
if (opt_rsp_cert == NULL) {
CMP_warn("no -rsp_cert given for mock server");
} else {
if (!setup_cert(srv_ctx, opt_rsp_cert, opt_keypass,
if (!setup_cert(srv_ctx, opt_rsp_cert, opt_rsp_keypass,
"cert the mock server returns on certificate requests",
(add_X509_fn_t)ossl_cmp_mock_srv_set1_certOut))
goto err;
}
if (opt_rsp_key != NULL) {
EVP_PKEY *pkey = load_key_pwd(opt_rsp_key, opt_keyform,
opt_rsp_keypass, engine,
"private key for enrollment cert");
if (pkey == NULL
|| !ossl_cmp_mock_srv_set1_keyOut(srv_ctx, pkey)) {
EVP_PKEY_free(pkey);
goto err;
}
EVP_PKEY_free(pkey);
}
cleanse(opt_rsp_keypass);
if (!setup_mock_crlout(srv_ctx, opt_rsp_crl,
"CRL to be returned by the mock server"))
goto err;
@ -1671,11 +1702,27 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
if (!set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
return 0;
if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
if (opt_reqin == NULL && opt_newkey == NULL
if (opt_reqin == NULL && opt_newkey == NULL && !opt_centralkeygen
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) {
CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, -cert, or -reqin option given, which could provide fallback public key");
CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, -cert, or -reqin option given, which could provide fallback public key."
" Neither central key generation is requested.");
return 0;
}
if (opt_popo == OSSL_CRMF_POPO_NONE && !opt_centralkeygen) {
CMP_info("POPO is disabled, which implies -centralkeygen");
opt_centralkeygen = 1;
}
if (opt_centralkeygen) {
if (opt_popo > OSSL_CRMF_POPO_NONE) {
CMP_err1("-popo value %d is inconsistent with -centralkeygen", opt_popo);
return 0;
}
if (opt_newkeyout == NULL) {
CMP_err("-newkeyout not given, nowhere to save centrally generated key");
return 0;
}
opt_popo = OSSL_CRMF_POPO_NONE;
}
if (opt_newkey == NULL
&& opt_popo != OSSL_CRMF_POPO_NONE
&& opt_popo != OSSL_CRMF_POPO_RAVERIFIED) {
@ -1723,6 +1770,12 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
CMP_warn1("-policies %s", msg);
if (opt_policy_oids != NULL)
CMP_warn1("-policy_oids %s", msg);
if (opt_popo != OSSL_CRMF_POPO_NONE - 1)
CMP_warn1("-popo %s", msg);
if (opt_centralkeygen)
CMP_warn1("-popo -1 or -centralkeygen %s", msg);
if (opt_newkeyout != NULL)
CMP_warn1("-newkeyout %s", msg);
if (opt_cmd != CMP_P10CR) {
if (opt_implicit_confirm)
CMP_warn1("-implicit_confirm %s, and 'p10cr'", msg);
@ -1827,13 +1880,14 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
pkey = load_pubkey(file, format, 0, pass, engine, desc);
priv = 0;
}
cleanse(opt_newkeypass);
if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, priv, pkey)) {
EVP_PKEY_free(pkey);
return 0;
}
} else if (opt_reqin != NULL
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) {
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL
&& !opt_centralkeygen) {
if (!set_fallback_pubkey(ctx))
return 0;
}
@ -2921,13 +2975,18 @@ static int get_opts(int argc, char **argv)
case OPT_KEYSPEC:
opt_keyspec = opt_str();
break;
case OPT_NEWKEY:
opt_newkey = opt_str();
break;
case OPT_NEWKEYPASS:
opt_newkeypass = opt_str();
break;
case OPT_CENTRALKEYGEN:
opt_centralkeygen = 1;
break;
case OPT_NEWKEYOUT:
opt_newkeyout = opt_str();
break;
case OPT_SUBJECT:
opt_subject = opt_str();
break;
@ -3085,6 +3144,12 @@ static int get_opts(int argc, char **argv)
case OPT_RSP_CERT:
opt_rsp_cert = opt_str();
break;
case OPT_RSP_KEY:
opt_rsp_key = opt_str();
break;
case OPT_RSP_KEYPASS:
opt_rsp_keypass = opt_str();
break;
case OPT_RSP_CRL:
opt_rsp_crl = opt_str();
break;
@ -3792,6 +3857,34 @@ int cmp_main(int argc, char **argv)
if (save_free_certs(OSSL_CMP_CTX_get1_caPubs(cmp_ctx),
opt_cacertsout, "CA") < 0)
goto err;
if (opt_centralkeygen) {
EVP_CIPHER *cipher = NULL;
char *pass_string = NULL;
BIO *out;
int result = 1;
EVP_PKEY *new_key = OSSL_CMP_CTX_get0_newPkey(cmp_ctx, 1 /* priv */);
if (new_key == NULL)
goto err;
if ((out = bio_open_owner(opt_newkeyout, FORMAT_PEM, 1)) == NULL)
goto err;
if (opt_newkeypass != NULL) {
pass_string = get_passwd(opt_newkeypass,
"Centrally generated private key password");
cipher = EVP_CIPHER_fetch(app_get0_libctx(), SN_aes_256_cbc, app_get0_propq());
}
CMP_info1("saving centrally generated key to file '%s'", opt_newkeyout);
if (PEM_write_bio_PrivateKey(out, new_key, cipher, NULL, 0, NULL,
(void *)pass_string) <= 0)
result = 0;
BIO_free(out);
clear_free(pass_string);
EVP_CIPHER_free(cipher);
if (!result)
goto err;
}
}
if (!OSSL_CMP_CTX_reinit(cmp_ctx))
goto err;

61
apps/cms.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -69,7 +69,8 @@ typedef enum OPTION_choice {
OPT_DIGEST, OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
OPT_ED_DECRYPT, OPT_ED_ENCRYPT, OPT_DEBUG_DECRYPT, OPT_TEXT,
OPT_ASCIICRLF, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCERTS,
OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_BINARY, OPT_KEYID,
OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_NO_SIGNING_TIME,
OPT_BINARY, OPT_KEYID,
OPT_NOSIGS, OPT_NO_CONTENT_VERIFY, OPT_NO_ATTR_VERIFY, OPT_INDEF,
OPT_NOINDEF, OPT_CRLFEOL, OPT_NOOUT, OPT_RR_PRINT,
OPT_RR_ALL, OPT_RR_FIRST, OPT_RCTFORM, OPT_CERTFILE, OPT_CAFILE,
@ -186,6 +187,8 @@ const OPTIONS cms_options[] = {
"Don't include signer's certificate when signing"},
{"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
{"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
{"no_signing_time", OPT_NO_SIGNING_TIME, '-',
"Omit the signing time attribute"},
{"receipt_request_all", OPT_RR_ALL, '-',
"When signing, create a receipt request for all recipients"},
{"receipt_request_first", OPT_RR_FIRST, '-',
@ -429,6 +432,9 @@ int cms_main(int argc, char **argv)
case OPT_NOSMIMECAP:
flags |= CMS_NOSMIMECAP;
break;
case OPT_NO_SIGNING_TIME:
flags |= CMS_NO_SIGNING_TIME;
break;
case OPT_BINARY:
flags |= CMS_BINARY;
break;
@ -505,13 +511,15 @@ int cms_main(int argc, char **argv)
if (rr_from == NULL
&& (rr_from = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(rr_from, opt_arg());
if (sk_OPENSSL_STRING_push(rr_from, opt_arg()) <= 0)
goto end;
break;
case OPT_RR_TO:
if (rr_to == NULL
&& (rr_to = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(rr_to, opt_arg());
if (sk_OPENSSL_STRING_push(rr_to, opt_arg()) <= 0)
goto end;
break;
case OPT_PRINT:
noout = print = 1;
@ -588,13 +596,15 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (keyfile == NULL)
keyfile = signerfile;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
keyfile = NULL;
}
signerfile = opt_arg();
@ -612,12 +622,14 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
signerfile = NULL;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
keyfile = opt_arg();
break;
@ -671,7 +683,8 @@ int cms_main(int argc, char **argv)
key_param->next = nparam;
key_param = nparam;
}
sk_OPENSSL_STRING_push(key_param->param, opt_arg());
if (sk_OPENSSL_STRING_push(key_param->param, opt_arg()) <= 0)
goto end;
break;
case OPT_V_CASES:
if (!opt_verify(o, vpm))
@ -717,7 +730,6 @@ int cms_main(int argc, char **argv)
}
/* Remaining args are files to process. */
argc = opt_num_rest();
argv = opt_rest();
if ((rr_allorfirst != -1 || rr_from != NULL) && rr_to == NULL) {
@ -758,12 +770,14 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (skkeys == NULL && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
if (keyfile == NULL)
keyfile = signerfile;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
if (sksigners == NULL) {
BIO_printf(bio_err, "No signer certificate specified\n");
@ -822,15 +836,8 @@ int cms_main(int argc, char **argv)
}
if (operation == SMIME_ENCRYPT) {
if (!cipher) {
#ifndef OPENSSL_NO_DES
cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
#else
BIO_printf(bio_err, "No cipher selected\n");
goto end;
#endif
}
if (!cipher)
cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
if (secret_key && !secret_keyid) {
BIO_printf(bio_err, "No secret key id\n");
goto end;
@ -1004,7 +1011,7 @@ int cms_main(int argc, char **argv)
goto end;
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
if (kparam != NULL) {
if (pctx != NULL && kparam != NULL) {
if (!cms_set_pkey_param(pctx, kparam->param))
goto end;
}
@ -1045,8 +1052,15 @@ int cms_main(int argc, char **argv)
pwri_tmp = NULL;
}
if (!(flags & CMS_STREAM)) {
if (!CMS_final(cms, in, NULL, flags))
if (!CMS_final(cms, in, NULL, flags)) {
if (originator != NULL
&& ERR_GET_REASON(ERR_peek_error())
== CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
BIO_printf(bio_err, "Cannot use originator for encryption\n");
goto end;
}
goto end;
}
}
} else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
cms = CMS_EncryptedData_encrypt_ex(in, cipher, secret_key,
@ -1297,6 +1311,7 @@ int cms_main(int argc, char **argv)
X509_free(cert);
X509_free(recip);
X509_free(signer);
X509_free(originator);
EVP_PKEY_free(key);
EVP_CIPHER_free(cipher);
EVP_CIPHER_free(wrap_cipher);

11
apps/crl2pkcs7.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -138,7 +138,9 @@ int crl2pkcs7_main(int argc, char **argv)
if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
goto end;
p7s->crl = crl_stack;
sk_X509_CRL_push(crl_stack, crl);
if (!sk_X509_CRL_push(crl_stack, crl))
goto end;
crl = NULL; /* now part of p7 for OPENSSL_freeing */
}
@ -216,7 +218,10 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
while (sk_X509_INFO_num(sk)) {
xi = sk_X509_INFO_shift(sk);
if (xi->x509 != NULL) {
sk_X509_push(stack, xi->x509);
if (!sk_X509_push(stack, xi->x509)) {
X509_INFO_free(xi);
goto end;
}
xi->x509 = NULL;
count++;
}

226
apps/dgst.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -24,6 +24,9 @@
#undef BUFSIZE
#define BUFSIZE 1024*8
static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *file);
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *md_name,
@ -93,7 +96,7 @@ const OPTIONS dgst_options[] = {
int dgst_main(int argc, char **argv)
{
BIO *in = NULL, *inp, *bmd = NULL, *out = NULL;
BIO *in = NULL, *inp = NULL, *bmd = NULL, *out = NULL;
ENGINE *e = NULL, *impl = NULL;
EVP_PKEY *sigkey = NULL;
STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
@ -111,6 +114,8 @@ int dgst_main(int argc, char **argv)
unsigned char *buf = NULL, *sigbuf = NULL;
int engine_impl = 0;
struct doall_dgst_digests dec;
EVP_MD_CTX *signctx = NULL;
int oneshot_sign = 0;
buf = app_malloc(BUFSIZE, "I/O buffer");
md = (EVP_MD *)EVP_get_digestbyname(argv[0]);
@ -278,8 +283,6 @@ int dgst_main(int argc, char **argv)
}
if (keyfile != NULL) {
int type;
if (want_pub)
sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key");
else
@ -290,14 +293,16 @@ int dgst_main(int argc, char **argv)
*/
goto end;
}
type = EVP_PKEY_get_id(sigkey);
if (type == EVP_PKEY_ED25519 || type == EVP_PKEY_ED448) {
/*
* We implement PureEdDSA for these which doesn't have a separate
* digest, and only supports one shot.
*/
BIO_printf(bio_err, "Key type not supported for this operation\n");
goto end;
{
char def_md[80];
if (EVP_PKEY_get_default_digest_name(sigkey, def_md,
sizeof(def_md)) == 2
&& strcmp(def_md, "UNDEF") == 0)
oneshot_sign = 1;
signctx = EVP_MD_CTX_new();
if (signctx == NULL)
goto end;
}
}
@ -342,7 +347,9 @@ int dgst_main(int argc, char **argv)
EVP_PKEY_CTX *pctx = NULL;
int res;
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
if (oneshot_sign) {
mctx = signctx;
} else if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
BIO_printf(bio_err, "Error getting context\n");
goto end;
}
@ -379,6 +386,11 @@ int dgst_main(int argc, char **argv)
/* we use md as a filter, reading from 'in' */
else {
EVP_MD_CTX *mctx = NULL;
if (oneshot_sign) {
BIO_printf(bio_err, "Oneshot algorithms don't use a digest\n");
goto end;
}
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
BIO_printf(bio_err, "Error getting context\n");
goto end;
@ -407,17 +419,18 @@ int dgst_main(int argc, char **argv)
goto end;
}
}
inp = BIO_push(bmd, in);
if (!oneshot_sign) {
inp = BIO_push(bmd, in);
if (md == NULL) {
EVP_MD_CTX *tctx;
if (md == NULL) {
EVP_MD_CTX *tctx;
BIO_get_md_ctx(bmd, &tctx);
md = EVP_MD_CTX_get1_md(tctx);
BIO_get_md_ctx(bmd, &tctx);
md = EVP_MD_CTX_get1_md(tctx);
}
if (md != NULL)
md_name = EVP_MD_get0_name(md);
}
if (md != NULL)
md_name = EVP_MD_get0_name(md);
if (xoflen > 0) {
if (!EVP_MD_xof(md)) {
BIO_printf(bio_err, "Length can only be specified for XOF\n");
@ -436,8 +449,12 @@ int dgst_main(int argc, char **argv)
if (argc == 0) {
BIO_set_fp(in, stdin, BIO_NOCLOSE);
ret = do_fp(out, buf, inp, separator, out_bin, xoflen, sigkey, sigbuf,
siglen, NULL, md_name, "stdin");
if (oneshot_sign)
ret = do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
sigkey, sigbuf, siglen, NULL, "stdin");
else
ret = do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, NULL, md_name, "stdin");
} else {
const char *sig_name = NULL;
@ -452,9 +469,16 @@ int dgst_main(int argc, char **argv)
ret = EXIT_FAILURE;
continue;
} else {
if (do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
ret = EXIT_FAILURE;
if (oneshot_sign) {
if (do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
sigkey, sigbuf, siglen, sig_name,
argv[i]))
ret = EXIT_FAILURE;
} else {
if (do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
ret = EXIT_FAILURE;
}
}
(void)BIO_reset(bmd);
}
@ -468,6 +492,7 @@ int dgst_main(int argc, char **argv)
BIO_free_all(out);
EVP_MD_free(md);
EVP_PKEY_free(sigkey);
EVP_MD_CTX_free(signctx);
sk_OPENSSL_STRING_free(sigopts);
sk_OPENSSL_STRING_free(macopts);
OPENSSL_free(sigbuf);
@ -544,6 +569,54 @@ static const char *newline_escape_filename(const char *file, int *backslash)
return (const char*)file_cpy;
}
static void print_out(BIO *out, unsigned char *buf, size_t len,
int sep, int binout,
const char *sig_name, const char *md_name, const char *file)
{
int i, backslash = 0;
if (binout) {
BIO_write(out, buf, len);
} else if (sep == 2) {
file = newline_escape_filename(file, &backslash);
if (backslash == 1)
BIO_puts(out, "\\");
for (i = 0; i < (int)len; i++)
BIO_printf(out, "%02x", buf[i]);
BIO_printf(out, " *%s\n", file);
OPENSSL_free((char *)file);
} else {
if (sig_name != NULL) {
BIO_puts(out, sig_name);
if (md_name != NULL)
BIO_printf(out, "-%s", md_name);
BIO_printf(out, "(%s)= ", file);
} else if (md_name != NULL) {
BIO_printf(out, "%s(%s)= ", md_name, file);
} else {
BIO_printf(out, "(%s)= ", file);
}
for (i = 0; i < (int)len; i++) {
if (sep && (i != 0))
BIO_printf(out, ":");
BIO_printf(out, "%02x", buf[i]);
}
BIO_printf(out, "\n");
}
}
static void print_verify_result(BIO *out, int i)
{
if (i > 0)
BIO_printf(out, "Verified OK\n");
else if (i == 0)
BIO_printf(out, "Verification failure\n");
else
BIO_printf(bio_err, "Error verifying data\n");
}
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
EVP_PKEY *key, unsigned char *sigin, int siglen,
@ -551,7 +624,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
const char *file)
{
size_t len = BUFSIZE;
int i, backslash = 0, ret = EXIT_FAILURE;
int i, ret = EXIT_FAILURE;
unsigned char *allocated_buf = NULL;
while (BIO_pending(bp) || !BIO_eof(bp)) {
@ -567,16 +640,9 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
EVP_MD_CTX *ctx;
BIO_get_md_ctx(bp, &ctx);
i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
if (i > 0) {
BIO_printf(out, "Verified OK\n");
} else if (i == 0) {
BIO_printf(out, "Verification failure\n");
goto end;
} else {
BIO_printf(bio_err, "Error verifying data\n");
goto end;
}
ret = EXIT_SUCCESS;
print_verify_result(out, i);
if (i > 0)
ret = EXIT_SUCCESS;
goto end;
}
if (key != NULL) {
@ -617,39 +683,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
if ((int)len < 0)
goto end;
}
if (binout) {
BIO_write(out, buf, len);
} else if (sep == 2) {
file = newline_escape_filename(file, &backslash);
if (backslash == 1)
BIO_puts(out, "\\");
for (i = 0; i < (int)len; i++)
BIO_printf(out, "%02x", buf[i]);
BIO_printf(out, " *%s\n", file);
OPENSSL_free((char *)file);
} else {
if (sig_name != NULL) {
BIO_puts(out, sig_name);
if (md_name != NULL)
BIO_printf(out, "-%s", md_name);
BIO_printf(out, "(%s)= ", file);
} else if (md_name != NULL) {
BIO_printf(out, "%s(%s)= ", md_name, file);
} else {
BIO_printf(out, "(%s)= ", file);
}
for (i = 0; i < (int)len; i++) {
if (sep && (i != 0))
BIO_printf(out, ":");
BIO_printf(out, "%02x", buf[i]);
}
BIO_printf(out, "\n");
}
print_out(out, buf, len, sep, binout, sig_name, md_name, file);
ret = EXIT_SUCCESS;
end:
if (allocated_buf != NULL)
@ -657,3 +691,55 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
return ret;
}
/*
* Some new algorithms only support one shot operations.
* For these we need to buffer all input and then do the sign on the
* total buffered input. These algorithms set a NULL digest name which is
* then used inside EVP_DigestVerify() and EVP_DigestSign().
*/
static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *file)
{
int res, ret = EXIT_FAILURE;
size_t len = 0;
int buflen = 0;
int maxlen = 16 * 1024 * 1024;
uint8_t *buf = NULL, *sig = NULL;
buflen = bio_to_mem(&buf, maxlen, in);
if (buflen <= 0) {
BIO_printf(bio_err, "Read error in %s\n", file);
return ret;
}
if (sigin != NULL) {
res = EVP_DigestVerify(ctx, sigin, siglen, buf, buflen);
print_verify_result(out, res);
if (res > 0)
ret = EXIT_SUCCESS;
goto end;
}
if (key != NULL) {
if (EVP_DigestSign(ctx, NULL, &len, buf, buflen) != 1) {
BIO_printf(bio_err, "Error getting maximum length of signed data\n");
goto end;
}
sig = app_malloc(len, "Signature buffer");
if (EVP_DigestSign(ctx, sig, &len, buf, buflen) != 1) {
BIO_printf(bio_err, "Error signing data\n");
goto end;
}
print_out(out, sig, len, sep, binout, sig_name, NULL, file);
ret = EXIT_SUCCESS;
} else {
BIO_printf(bio_err, "key must be set for one-shot algorithms\n");
goto end;
}
end:
OPENSSL_free(sig);
OPENSSL_clear_free(buf, buflen);
return ret;
}

8
apps/dhparam.c
View file

@ -179,10 +179,6 @@ int dhparam_main(int argc, char **argv)
goto end;
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
/* DH parameters */
if (num && !g)
g = 2;
@ -322,6 +318,10 @@ int dhparam_main(int argc, char **argv)
}
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
if (text)
EVP_PKEY_print_params(out, pkey, 4, NULL);

8
apps/dsaparam.c
View file

@ -150,10 +150,6 @@ int dsaparam_main(int argc, char **argv)
numbits = num;
private = genkey ? 1 : 0;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "DSA", app_get0_propq());
if (ctx == NULL) {
BIO_printf(bio_err,
@ -200,6 +196,10 @@ int dsaparam_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (text) {
EVP_PKEY_print_params(out, params, 0, NULL);
}

28
apps/ecparam.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -67,13 +67,11 @@ const OPTIONS ecparam_options[] = {
static int list_builtin_curves(BIO *out)
{
int ret = 0;
EC_builtin_curve *curves = NULL;
size_t n, crv_len = EC_get_builtin_curves(NULL, 0);
curves = app_malloc((int)sizeof(*curves) * crv_len, "list curves");
if (!EC_get_builtin_curves(curves, crv_len))
goto end;
EC_get_builtin_curves(curves, crv_len);
for (n = 0; n < crv_len; n++) {
const char *comment = curves[n].comment;
@ -87,10 +85,8 @@ static int list_builtin_curves(BIO *out)
BIO_printf(out, " %-10s: ", sname);
BIO_printf(out, "%s\n", comment);
}
ret = 1;
end:
OPENSSL_free(curves);
return ret;
return 1;
}
int ecparam_main(int argc, char **argv)
@ -192,18 +188,18 @@ int ecparam_main(int argc, char **argv)
if (!app_RAND_load())
goto end;
private = genkey ? 1 : 0;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (list_curves) {
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (list_builtin_curves(out))
ret = 0;
goto end;
}
private = genkey ? 1 : 0;
if (curve_name != NULL) {
OSSL_PARAM params[4];
OSSL_PARAM *p = params;
@ -276,8 +272,12 @@ int ecparam_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (text
&& !EVP_PKEY_print_params(out, params_key, 0, NULL)) {
&& EVP_PKEY_print_params(out, params_key, 0, NULL) <= 0) {
BIO_printf(bio_err, "unable to print params\n");
goto end;
}

93
apps/enc.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -49,7 +49,8 @@ typedef enum OPTION_choice {
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
OPT_SALTLEN, OPT_R_ENUM, OPT_PROV_ENUM
OPT_SALTLEN, OPT_R_ENUM, OPT_PROV_ENUM,
OPT_SKEYOPT, OPT_SKEYMGMT
} OPTION_CHOICE;
const OPTIONS enc_options[] = {
@ -105,6 +106,8 @@ const OPTIONS enc_options[] = {
#ifndef OPENSSL_NO_ZLIB
{"z", OPT_Z, '-', "Compress or decompress encrypted data using zlib"},
#endif
{"skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque symmetric key handling"},
{"skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque symmetric key handling"},
{"", OPT_CIPHER, '-', "Any supported cipher"},
OPT_R_OPTIONS,
@ -134,6 +137,7 @@ int enc_main(int argc, char **argv)
int base64 = 0, informat = FORMAT_BINARY, outformat = FORMAT_BINARY;
int ret = 1, inl, nopad = 0;
unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
int rawkey_set = 0;
unsigned char *buff = NULL, salt[EVP_MAX_IV_LENGTH];
int saltlen = 0;
int pbkdf2 = 0;
@ -150,6 +154,10 @@ int enc_main(int argc, char **argv)
BIO *bbrot = NULL;
int do_zstd = 0;
BIO *bzstd = NULL;
STACK_OF(OPENSSL_STRING) *skeyopts = NULL;
const char *skeymgmt = NULL;
EVP_SKEY *skey = NULL;
EVP_SKEYMGMT *mgmt = NULL;
/* first check the command name */
if (strcmp(argv[0], "base64") == 0)
@ -310,6 +318,17 @@ int enc_main(int argc, char **argv)
case OPT_NONE:
cipher = NULL;
break;
case OPT_SKEYOPT:
if ((skeyopts == NULL &&
(skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
BIO_printf(bio_err, "%s: out of memory\n", prog);
goto end;
}
break;
case OPT_SKEYMGMT:
skeymgmt = opt_arg();
break;
case OPT_R_CASES:
if (!opt_rand(o))
goto end;
@ -391,7 +410,7 @@ int enc_main(int argc, char **argv)
str = pass;
}
if ((str == NULL) && (cipher != NULL) && (hkey == NULL)) {
if ((str == NULL) && (cipher != NULL) && (hkey == NULL) && (skeyopts == NULL)) {
if (1) {
#ifndef OPENSSL_NO_UI_CONSOLE
for (;;) {
@ -571,6 +590,7 @@ int enc_main(int argc, char **argv)
/* split and move data back to global buffer */
memcpy(key, tmpkeyiv, iklen);
memcpy(iv, tmpkeyiv+iklen, ivlen);
rawkey_set = 1;
} else {
BIO_printf(bio_err, "*** WARNING : "
"deprecated key derivation used.\n"
@ -581,6 +601,7 @@ int enc_main(int argc, char **argv)
BIO_printf(bio_err, "EVP_BytesToKey failed\n");
goto end;
}
rawkey_set = 1;
}
/*
* zero the complete buffer or the string passed from the command
@ -618,6 +639,16 @@ int enc_main(int argc, char **argv)
}
/* wiping secret data as we no longer need it */
cleanse(hkey);
rawkey_set = 1;
}
/*
* At this moment we know whether we trying to use raw bytes as the key
* or an opaque symmetric key. We do not allow both options simultaneously.
*/
if (rawkey_set > 0 && skeyopts != NULL) {
BIO_printf(bio_err, "Either a raw key or the 'skeyopt' args must be used.\n");
goto end;
}
if ((benc = BIO_new(BIO_f_cipher())) == NULL)
@ -633,24 +664,51 @@ int enc_main(int argc, char **argv)
if (wrap == 1)
EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);
if (!EVP_CipherInit_ex(ctx, cipher, e, NULL, NULL, enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
if (rawkey_set) {
if (!EVP_CipherInit_ex(ctx, cipher, e, key,
(hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
} else {
OSSL_PARAM *params = NULL;
mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
app_get0_propq());
if (mgmt == NULL)
goto end;
params = app_params_new_from_opts(skeyopts,
EVP_SKEYMGMT_get0_imp_settable_params(mgmt));
if (params == NULL)
goto end;
skey = EVP_SKEY_import(app_get0_libctx(), EVP_SKEYMGMT_get0_name(mgmt),
app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
OSSL_PARAM_free(params);
if (skey == NULL) {
BIO_printf(bio_err, "Error creating opaque key object for skeymgmt %s\n",
skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
if (!EVP_CipherInit_SKEY(ctx, cipher, skey,
(hiv == NULL && wrap == 1 ? NULL : iv),
EVP_CIPHER_get_iv_length(cipher), enc, NULL)) {
BIO_printf(bio_err, "Error setting an opaque key for cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
}
if (nopad)
EVP_CIPHER_CTX_set_padding(ctx, 0);
if (!EVP_CipherInit_ex(ctx, NULL, NULL, key,
(hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
if (debug) {
BIO_set_callback_ex(benc, BIO_debug_callback_ex);
BIO_set_callback_arg(benc, (char *)bio_err);
@ -716,6 +774,9 @@ int enc_main(int argc, char **argv)
}
end:
ERR_print_errors(bio_err);
sk_OPENSSL_STRING_free(skeyopts);
EVP_SKEYMGMT_free(mgmt);
EVP_SKEY_free(skey);
OPENSSL_free(strbuf);
OPENSSL_free(buff);
BIO_free(in);

17
apps/engine.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -316,7 +316,8 @@ int engine_main(int argc, char **argv)
* names, and then setup to parse the rest of the line as flags. */
prog = argv[0];
while ((argv1 = argv[1]) != NULL && *argv1 != '-') {
sk_OPENSSL_CSTRING_push(engines, argv1);
if (!sk_OPENSSL_CSTRING_push(engines, argv1))
goto end;
argc--;
argv++;
}
@ -352,10 +353,12 @@ int engine_main(int argc, char **argv)
test_avail++;
break;
case OPT_PRE:
sk_OPENSSL_STRING_push(pre_cmds, opt_arg());
if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0)
goto end;
break;
case OPT_POST:
sk_OPENSSL_STRING_push(post_cmds, opt_arg());
if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0)
goto end;
break;
}
}
@ -370,12 +373,14 @@ int engine_main(int argc, char **argv)
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
goto end;
}
sk_OPENSSL_CSTRING_push(engines, *argv);
if (!sk_OPENSSL_CSTRING_push(engines, *argv))
goto end;
}
if (sk_OPENSSL_CSTRING_num(engines) == 0) {
for (e = ENGINE_get_first(); e != NULL; e = ENGINE_get_next(e)) {
sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e));
if (!sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e)))
goto end;
}
}

66
apps/fipsinstall.c
View file

@ -59,6 +59,7 @@ typedef enum OPTION_choice {
OPT_SSHKDF_KEY_CHECK,
OPT_SSKDF_KEY_CHECK,
OPT_X963KDF_KEY_CHECK,
OPT_X942KDF_KEY_CHECK,
OPT_NO_PBKDF2_LOWER_BOUND_CHECK,
OPT_ECDH_COFACTOR_CHECK,
OPT_SELF_TEST_ONLOAD, OPT_SELF_TEST_ONINSTALL
@ -128,6 +129,8 @@ const OPTIONS fipsinstall_options[] = {
"Enable key check for SSKDF"},
{"x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
"Enable key check for X963KDF"},
{"x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
"Enable key check for X942KDF"},
{"no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
"Disable lower bound check for PBKDF2"},
{"ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
@ -176,6 +179,7 @@ typedef struct {
unsigned int sshkdf_key_check : 1;
unsigned int sskdf_key_check : 1;
unsigned int x963kdf_key_check : 1;
unsigned int x942kdf_key_check : 1;
unsigned int pbkdf2_lower_bound_check : 1;
unsigned int ecdh_cofactor_check : 1;
} FIPS_OPTS;
@ -209,6 +213,7 @@ static const FIPS_OPTS pedantic_opts = {
1, /* sshkdf_key_check */
1, /* sskdf_key_check */
1, /* x963kdf_key_check */
1, /* x942kdf_key_check */
1, /* pbkdf2_lower_bound_check */
1, /* ecdh_cofactor_check */
};
@ -242,6 +247,7 @@ static FIPS_OPTS fips_opts = {
0, /* sshkdf_key_check */
0, /* sskdf_key_check */
0, /* x963kdf_key_check */
0, /* x942kdf_key_check */
1, /* pbkdf2_lower_bound_check */
0, /* ecdh_cofactor_check */
};
@ -278,7 +284,8 @@ err:
return ret;
}
static int load_fips_prov_and_run_self_test(const char *prov_name)
static int load_fips_prov_and_run_self_test(const char *prov_name,
int *is_fips_140_2_prov)
{
int ret = 0;
OSSL_PROVIDER *prov = NULL;
@ -308,7 +315,16 @@ static int load_fips_prov_and_run_self_test(const char *prov_name)
BIO_printf(bio_err, "\t%-10s\t%s\n", "version:", vers);
if (OSSL_PARAM_modified(params + 2))
BIO_printf(bio_err, "\t%-10s\t%s\n", "build:", build);
} else {
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
&vers, sizeof(vers));
*p = OSSL_PARAM_construct_end();
if (!OSSL_PROVIDER_get_params(prov, params)) {
BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
goto end;
}
}
*is_fips_140_2_prov = (strncmp("3.0.", vers, 4) == 0);
ret = 1;
end:
OSSL_PROVIDER_unload(prov);
@ -419,6 +435,8 @@ static int write_config_fips_section(BIO *out, const char *section,
opts->sskdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X963KDF_KEY_CHECK,
opts->x963kdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X942KDF_KEY_CHECK,
opts->x942kdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
opts->pbkdf2_lower_bound_check ? "1" : "0") <= 0
@ -428,7 +446,9 @@ static int write_config_fips_section(BIO *out, const char *section,
module_mac_len))
goto end;
if (install_mac != NULL && install_mac_len > 0) {
if (install_mac != NULL
&& install_mac_len > 0
&& opts->self_test_onload == 0) {
if (!print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
install_mac_len)
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
@ -551,6 +571,7 @@ end:
int fipsinstall_main(int argc, char **argv)
{
int ret = 1, verify = 0, gotkey = 0, gotdigest = 0, pedantic = 0;
int is_fips_140_2_prov = 0, set_selftest_onload_option = 0;
const char *section_name = "fips_sect";
const char *mac_name = "HMAC";
const char *prov_name = "fips";
@ -676,6 +697,9 @@ int fipsinstall_main(int argc, char **argv)
case OPT_X963KDF_KEY_CHECK:
fips_opts.x963kdf_key_check = 1;
break;
case OPT_X942KDF_KEY_CHECK:
fips_opts.x942kdf_key_check = 1;
break;
case OPT_NO_PBKDF2_LOWER_BOUND_CHECK:
if (!check_non_pedantic_fips(pedantic, "no_pbkdf2_lower_bound_check"))
goto end;
@ -723,11 +747,13 @@ int fipsinstall_main(int argc, char **argv)
verify = 1;
break;
case OPT_SELF_TEST_ONLOAD:
set_selftest_onload_option = 1;
fips_opts.self_test_onload = 1;
break;
case OPT_SELF_TEST_ONINSTALL:
if (!check_non_pedantic_fips(pedantic, "self_test_oninstall"))
goto end;
set_selftest_onload_option = 1;
fips_opts.self_test_onload = 0;
break;
}
@ -825,34 +851,43 @@ int fipsinstall_main(int argc, char **argv)
if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
goto end;
if (fips_opts.self_test_onload == 0) {
mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
strlen(INSTALL_STATUS_VAL));
if (mem_bio == NULL) {
BIO_printf(bio_err, "Unable to create memory BIO\n");
goto end;
}
if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
goto end;
} else {
install_mac_len = 0;
/* Calculate the MAC for the indicator status - it may not be used */
mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
strlen(INSTALL_STATUS_VAL));
if (mem_bio == NULL) {
BIO_printf(bio_err, "Unable to create memory BIO\n");
goto end;
}
if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
goto end;
if (verify) {
if (fips_opts.self_test_onload == 1)
install_mac_len = 0;
if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
install_mac, install_mac_len))
goto end;
if (!quiet)
BIO_printf(bio_err, "VERIFY PASSED\n");
} else {
conf = generate_config_and_load(prov_name, section_name, module_mac,
module_mac_len, &fips_opts);
if (conf == NULL)
goto end;
if (!load_fips_prov_and_run_self_test(prov_name))
if (!load_fips_prov_and_run_self_test(prov_name, &is_fips_140_2_prov))
goto end;
/*
* In OpenSSL 3.1 the code was changed so that the status indicator is
* not written out by default since this is a FIPS 140-3 requirement.
* For backwards compatibility - if the detected FIPS provider is 3.0.X
* (Which was a FIPS 140-2 validation), then the indicator status will
* be written to the config file unless 'self_test_onload' is set on the
* command line.
*/
if (set_selftest_onload_option == 0 && is_fips_140_2_prov)
fips_opts.self_test_onload = 0;
fout =
out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
: bio_open_default(out_fname, 'w', FORMAT_TEXT);
@ -860,6 +895,7 @@ int fipsinstall_main(int argc, char **argv)
BIO_printf(bio_err, "Failed to open file\n");
goto end;
}
if (!write_config_fips_section(fout, section_name,
module_mac, module_mac_len, &fips_opts,
install_mac, install_mac_len))

51
apps/genpkey.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -106,7 +106,7 @@ cleanup:
int genpkey_main(int argc, char **argv)
{
CONF *conf = NULL;
BIO *in = NULL, *out = NULL, *outpubkey = NULL;
BIO *mem_out = NULL, *mem_outpubkey = NULL;
ENGINE *e = NULL;
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL;
@ -237,14 +237,16 @@ int genpkey_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
mem_out = BIO_new(BIO_s_mem());
if (mem_out == NULL)
goto end;
BIO_set_mem_eof_return(mem_out, 0);
if (outpubkeyfile != NULL) {
outpubkey = bio_open_owner(outpubkeyfile, outformat, private);
if (outpubkey == NULL)
mem_outpubkey = BIO_new(BIO_s_mem());
if (mem_outpubkey == NULL)
goto end;
BIO_set_mem_eof_return(mem_outpubkey, 0);
}
if (verbose)
@ -257,17 +259,17 @@ int genpkey_main(int argc, char **argv)
goto end;
if (do_param) {
rv = PEM_write_bio_Parameters(out, pkey);
rv = PEM_write_bio_Parameters(mem_out, pkey);
} else if (outformat == FORMAT_PEM) {
assert(private);
rv = PEM_write_bio_PrivateKey(out, pkey, cipher, NULL, 0, NULL, pass);
if (rv > 0 && outpubkey != NULL)
rv = PEM_write_bio_PUBKEY(outpubkey, pkey);
rv = PEM_write_bio_PrivateKey(mem_out, pkey, cipher, NULL, 0, NULL, pass);
if (rv > 0 && mem_outpubkey != NULL)
rv = PEM_write_bio_PUBKEY(mem_outpubkey, pkey);
} else if (outformat == FORMAT_ASN1) {
assert(private);
rv = i2d_PrivateKey_bio(out, pkey);
if (rv > 0 && outpubkey != NULL)
rv = i2d_PUBKEY_bio(outpubkey, pkey);
rv = i2d_PrivateKey_bio(mem_out, pkey);
if (rv > 0 && mem_outpubkey != NULL)
rv = i2d_PUBKEY_bio(mem_outpubkey, pkey);
} else {
BIO_printf(bio_err, "Bad format specified for key\n");
goto end;
@ -282,9 +284,9 @@ int genpkey_main(int argc, char **argv)
if (text) {
if (do_param)
rv = EVP_PKEY_print_params(out, pkey, 0, NULL);
rv = EVP_PKEY_print_params(mem_out, pkey, 0, NULL);
else
rv = EVP_PKEY_print_private(out, pkey, 0, NULL);
rv = EVP_PKEY_print_private(mem_out, pkey, 0, NULL);
if (rv <= 0) {
BIO_puts(bio_err, "Error printing key\n");
@ -294,14 +296,25 @@ int genpkey_main(int argc, char **argv)
end:
sk_OPENSSL_STRING_free(keyopt);
if (ret != 0)
if (ret != 0) {
ERR_print_errors(bio_err);
} else {
if (mem_outpubkey != NULL) {
rv = mem_bio_to_file(mem_outpubkey, outpubkeyfile, outformat, private);
if (!rv)
BIO_printf(bio_err, "Error writing to outpubkey: '%s'. Error: %s\n", outpubkeyfile, strerror(errno));
}
if (mem_out != NULL) {
rv = mem_bio_to_file(mem_out, outfile, outformat, private);
if (!rv)
BIO_printf(bio_err, "Error writing to outfile: '%s'. Error: %s\n", outpubkeyfile, strerror(errno));
}
}
EVP_PKEY_free(pkey);
EVP_PKEY_CTX_free(ctx);
EVP_CIPHER_free(cipher);
BIO_free_all(out);
BIO_free_all(outpubkey);
BIO_free(in);
BIO_free_all(mem_out);
BIO_free_all(mem_outpubkey);
release_engine(e);
OPENSSL_free(pass);
NCONF_free(conf);

5
apps/include/apps.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -10,10 +10,8 @@
#ifndef OSSL_APPS_H
# define OSSL_APPS_H
# include "internal/e_os.h" /* struct timeval for DTLS */
# include "internal/common.h" /* for HAS_PREFIX */
# include "internal/nelem.h"
# include "internal/sockets.h" /* for openssl_fdset() */
# include <assert.h>
# include <stdarg.h>
@ -65,6 +63,7 @@ BIO *dup_bio_err(int format);
BIO *bio_open_owner(const char *filename, int format, int private);
BIO *bio_open_default(const char *filename, char mode, int format);
BIO *bio_open_default_quiet(const char *filename, char mode, int format);
int mem_bio_to_file(BIO *in, const char *filename, int format, int private);
char *app_conf_try_string(const CONF *cnf, const char *group, const char *name);
int app_conf_try_number(const CONF *conf, const char *group, const char *name,
long *result);

3
apps/include/cmp_mock_srv.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -22,6 +22,7 @@ void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
int ossl_cmp_mock_srv_set1_refCert(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey);
int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx, X509_CRL *crl);
int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
STACK_OF(X509) *chain);

5
apps/include/opt.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -295,6 +295,7 @@
# define OPT_PROV_ENUM \
OPT_PROV__FIRST=1600, \
OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, OPT_PROV_PROPQUERY, \
OPT_PROV_PARAM, \
OPT_PROV__LAST
# define OPT_CONFIG_OPTION \
@ -304,12 +305,14 @@
OPT_SECTION("Provider"), \
{ "provider-path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)" }, \
{ "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" }, \
{ "provparam", OPT_PROV_PARAM, 's', "Set a provider key-value parameter" }, \
{ "propquery", OPT_PROV_PROPQUERY, 's', "Property query used when fetching algorithms" }
# define OPT_PROV_CASES \
OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
case OPT_PROV_PROVIDER: \
case OPT_PROV_PROVIDER_PATH: \
case OPT_PROV_PARAM: \
case OPT_PROV_PROPQUERY
/*

7
apps/info.c
View file

@ -14,7 +14,7 @@
typedef enum OPTION_choice {
OPT_COMMON,
OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS
OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS, OPT_WINDOWSCONTEXT
} OPTION_CHOICE;
const OPTIONS info_options[] = {
@ -32,6 +32,7 @@ const OPTIONS info_options[] = {
{"listsep", OPT_LISTSEP, '-', "List separator character"},
{"seeds", OPT_SEEDS, '-', "Seed sources"},
{"cpusettings", OPT_CPUSETTINGS, '-', "CPU settings info"},
{"windowscontext", OPT_WINDOWSCONTEXT, '-', "Windows install context"},
{NULL}
};
@ -85,6 +86,10 @@ opthelp:
type = OPENSSL_INFO_CPU_SETTINGS;
dirty++;
break;
case OPT_WINDOWSCONTEXT:
type = OPENSSL_INFO_WINDOWS_CONTEXT;
dirty++;
break;
}
}
if (!opt_check_rest_arg(NULL))

77
apps/lib/app_provider.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -8,6 +8,7 @@
*/
#include "apps.h"
#include <ctype.h>
#include <string.h>
#include <openssl/err.h>
#include <openssl/provider.h>
@ -65,6 +66,78 @@ static int opt_provider_path(const char *path)
return OSSL_PROVIDER_set_default_search_path(app_get0_libctx(), path);
}
struct prov_param_st {
char *name;
char *key;
char *val;
int found;
};
static int set_prov_param(OSSL_PROVIDER *prov, void *vp)
{
struct prov_param_st *p = (struct prov_param_st *)vp;
if (p->name != NULL && strcmp(OSSL_PROVIDER_get0_name(prov), p->name) != 0)
return 1;
p->found = 1;
return OSSL_PROVIDER_add_conf_parameter(prov, p->key, p->val);
}
static int opt_provider_param(const char *arg)
{
struct prov_param_st p;
char *copy, *tmp;
int ret = 0;
if ((copy = OPENSSL_strdup(arg)) == NULL
|| (p.val = strchr(copy, '=')) == NULL) {
opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
opt_getprog(), arg);
goto end;
}
/* Drop whitespace on both sides of the '=' sign */
*(tmp = p.val++) = '\0';
while (tmp > copy && isspace(_UC(*--tmp)))
*tmp = '\0';
while (isspace(_UC(*p.val)))
++p.val;
/*
* Split the key on ':', to get the optional provider, empty or missing
* means all.
*/
if ((p.key = strchr(copy, ':')) != NULL) {
*p.key++ = '\0';
p.name = *copy != '\0' ? copy : NULL;
} else {
p.name = NULL;
p.key = copy;
}
/* The key must not be empty */
if (*p.key == '\0') {
opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
opt_getprog(), arg);
goto end;
}
p.found = 0;
ret = OSSL_PROVIDER_do_all(app_get0_libctx(), set_prov_param, (void *)&p);
if (ret == 0) {
opt_printf_stderr("%s: Error setting provider '%s' parameter '%s'\n",
opt_getprog(), p.name, p.key);
} else if (p.found == 0) {
opt_printf_stderr("%s: No provider named '%s' is loaded\n",
opt_getprog(), p.name);
ret = 0;
}
end:
OPENSSL_free(copy);
return ret;
}
int opt_provider(int opt)
{
const int given = provider_option_given;
@ -78,6 +151,8 @@ int opt_provider(int opt)
return app_provider_load(app_get0_libctx(), opt_arg());
case OPT_PROV_PROVIDER_PATH:
return opt_provider_path(opt_arg());
case OPT_PROV_PARAM:
return opt_provider_param(opt_arg());
case OPT_PROV_PROPQUERY:
return app_set_propq(opt_arg());
}

1
apps/lib/app_rand.c
View file

@ -7,6 +7,7 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h" /* LIST_SEPARATOR_CHAR */
#include "apps.h"
#include <openssl/bio.h>
#include <openssl/err.h>

113
apps/lib/apps.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -48,6 +48,9 @@
#include "s_apps.h"
#include "apps.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#include "internal/e_os.h"
#ifdef _WIN32
static int WIN32_rename(const char *from, const char *to);
# define rename(from, to) WIN32_rename((from), (to))
@ -189,7 +192,11 @@ int set_nameopt(const char *arg)
unsigned long get_nameopt(void)
{
return
nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | ASN1_STRFLGS_UTF8_CONVERT;
nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN
| ASN1_STRFLGS_ESC_CTRL
| ASN1_STRFLGS_UTF8_CONVERT
| ASN1_STRFLGS_DUMP_UNKNOWN
| ASN1_STRFLGS_DUMP_DER;
}
void dump_cert_text(BIO *out, X509 *x)
@ -895,11 +902,15 @@ static const char *format2string(int format)
return "PEM";
case FORMAT_ASN1:
return "DER";
case FORMAT_PVK:
return "PVK";
case FORMAT_MSBLOB:
return "MSBLOB";
}
return NULL;
}
/* Set type expectation, but clear it if objects of different types expected. */
/* Set type expectation, but set to 0 if objects of multiple types expected. */
#define SET_EXPECT(val) \
(expect = expect < 0 ? (val) : (expect == (val) ? (val) : 0))
#define SET_EXPECT1(pvar, val) \
@ -907,6 +918,7 @@ static const char *format2string(int format)
*(pvar) = NULL; \
SET_EXPECT(val); \
}
/* Provide (error msg) text for some of the credential types to be loaded. */
#define FAIL_NAME \
(ppkey != NULL ? "private key" : ppubkey != NULL ? "public key" : \
pparams != NULL ? "key parameters" : \
@ -914,7 +926,9 @@ static const char *format2string(int format)
pcrl != NULL ? "CRL" : pcrls != NULL ? "CRLs" : NULL)
/*
* Load those types of credentials for which the result pointer is not NULL.
* Reads from stdio if uri is NULL and maybe_stdin is nonzero.
* Reads from stdin if 'uri' is NULL and 'maybe_stdin' is nonzero.
* 'format' parameter may be FORMAT_PEM, FORMAT_ASN1, or 0 for no hint.
* desc may contain more detail on the credential(s) to be loaded for error msg
* For non-NULL ppkey, pcert, and pcrl the first suitable value found is loaded.
* If pcerts is non-NULL and *pcerts == NULL then a new cert list is allocated.
* If pcerts is non-NULL then all available certificates are appended to *pcerts
@ -942,24 +956,38 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
OSSL_PARAM itp[2];
const OSSL_PARAM *params = NULL;
/* 'failed' describes type of credential to load for potential error msg */
if (failed == NULL) {
if (!quiet)
BIO_printf(bio_err, "Internal error: nothing to load from %s\n",
BIO_printf(bio_err, "Internal error: nothing was requested to load from %s\n",
uri != NULL ? uri : "<stdin>");
return 0;
}
/* suppress any extraneous errors left over from failed parse attempts */
ERR_set_mark();
SET_EXPECT1(ppkey, OSSL_STORE_INFO_PKEY);
SET_EXPECT1(ppubkey, OSSL_STORE_INFO_PUBKEY);
SET_EXPECT1(pparams, OSSL_STORE_INFO_PARAMS);
SET_EXPECT1(pcert, OSSL_STORE_INFO_CERT);
/*
* Up to here, the follwing holds.
* If just one of the ppkey, ppubkey, pparams, and pcert function parameters
* is nonzero, expect > 0 indicates which type of credential is expected.
* If expect == 0, more than one of them is nonzero (multiple types expected).
*/
if (pcerts != NULL) {
if (*pcerts == NULL && (*pcerts = sk_X509_new_null()) == NULL) {
if (!quiet)
BIO_printf(bio_err, "Out of memory loading");
goto end;
}
/*
* Adapt the 'expect' variable:
* set to OSSL_STORE_INFO_CERT if no other type is expected so far,
* otherwise set to 0 (indicating that multiple types are expected).
*/
SET_EXPECT(OSSL_STORE_INFO_CERT);
}
SET_EXPECT1(pcrl, OSSL_STORE_INFO_CRL);
@ -969,6 +997,11 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
BIO_printf(bio_err, "Out of memory loading");
goto end;
}
/*
* Adapt the 'expect' variable:
* set to OSSL_STORE_INFO_CRL if no other type is expected so far,
* otherwise set to 0 (indicating that multiple types are expected).
*/
SET_EXPECT(OSSL_STORE_INFO_CRL);
}
@ -1008,6 +1041,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
BIO_printf(bio_err, "Could not open file or uri for loading");
goto end;
}
/* expect == 0 means here multiple types of credentials are to be loaded */
if (expect > 0 && !OSSL_STORE_expect(ctx, expect)) {
if (!quiet)
BIO_printf(bio_err, "Internal error trying to load");
@ -1015,6 +1049,8 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
}
failed = NULL;
/* from here, failed != NULL only if actually an error has been detected */
while ((ppkey != NULL || ppubkey != NULL || pparams != NULL
|| pcert != NULL || pcerts != NULL || pcrl != NULL || pcrls != NULL)
&& !OSSL_STORE_eof(ctx)) {
@ -1084,7 +1120,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
ncrls += ok;
break;
default:
/* skip any other type */
/* skip any other type; ok stays == 1 */
break;
}
OSSL_STORE_INFO_free(info);
@ -1098,18 +1134,22 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
end:
OSSL_STORE_close(ctx);
if (ncerts > 0)
pcerts = NULL;
if (ncrls > 0)
pcrls = NULL;
/* see if any of the requested types of credentials was not found */
if (failed == NULL) {
if (ncerts > 0)
pcerts = NULL;
if (ncrls > 0)
pcrls = NULL;
failed = FAIL_NAME;
if (failed != NULL && !quiet)
BIO_printf(bio_err, "Could not find");
}
if (failed != NULL && !quiet) {
unsigned long err = ERR_peek_last_error();
/* continue the error message with the type of credential affected */
if (desc != NULL && strstr(desc, failed) != NULL) {
BIO_printf(bio_err, " %s", desc);
} else {
@ -2184,7 +2224,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "Hostname %s does%s match certificate\n",
checkhost, valid_host == 1 ? "" : " NOT");
ret = ret && valid_host;
ret = ret && valid_host > 0;
}
if (checkemail != NULL) {
@ -2192,7 +2232,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "Email %s does%s match certificate\n",
checkemail, valid_mail ? "" : " NOT");
ret = ret && valid_mail;
ret = ret && valid_mail > 0;
}
if (checkip != NULL) {
@ -2200,7 +2240,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "IP %s does%s match certificate\n",
checkip, valid_ip ? "" : " NOT");
ret = ret && valid_ip;
ret = ret && valid_ip > 0;
}
return ret;
@ -2483,18 +2523,24 @@ static STACK_OF(X509_CRL) *crls_http_cb(const X509_STORE_CTX *ctx,
crldp = X509_get_ext_d2i(x, NID_crl_distribution_points, NULL, NULL);
crl = load_crl_crldp(crldp);
sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
if (!crl) {
sk_X509_CRL_free(crls);
return NULL;
}
sk_X509_CRL_push(crls, crl);
if (crl == NULL || !sk_X509_CRL_push(crls, crl))
goto error;
/* Try to download delta CRL */
crldp = X509_get_ext_d2i(x, NID_freshest_crl, NULL, NULL);
crl = load_crl_crldp(crldp);
sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
if (crl)
sk_X509_CRL_push(crls, crl);
if (crl != NULL && !sk_X509_CRL_push(crls, crl))
goto error;
return crls;
error:
X509_CRL_free(crl);
sk_X509_CRL_free(crls);
return NULL;
}
void store_setup_crl_download(X509_STORE *st)
@ -3193,6 +3239,32 @@ BIO *bio_open_default_quiet(const char *filename, char mode, int format)
return bio_open_default_(filename, mode, format, 1);
}
int mem_bio_to_file(BIO *in, const char *filename, int format, int private)
{
int rv = 0, ret = 0;
BIO *out = NULL;
BUF_MEM *mem_buffer = NULL;
rv = BIO_get_mem_ptr(in, &mem_buffer);
if (rv <= 0) {
BIO_puts(bio_err, "Error reading mem buffer\n");
goto end;
}
out = bio_open_owner(filename, format, private);
if (out == NULL)
goto end;
rv = BIO_write(out, mem_buffer->data, mem_buffer->length);
if (rv < 0 || (size_t)rv != mem_buffer->length)
BIO_printf(bio_err, "Error writing to output file: '%s'\n", filename);
else
ret = 1;
end:
if (!ret)
ERR_print_errors(bio_err);
BIO_free_all(out);
return ret;
}
void wait_for_async(SSL *s)
{
/* On Windows select only works for sockets, so we simply don't wait */
@ -3464,6 +3536,7 @@ int opt_legacy_okay(void)
{
int provider_options = opt_provider_option_given();
int libctx = app_get0_libctx() != NULL || app_get0_propq() != NULL;
/*
* Having a provider option specified or a custom library context or
* property query, is a sure sign we're not using legacy.

38
apps/lib/cmp_mock_srv.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -19,6 +19,7 @@
typedef struct {
X509 *refCert; /* cert to expect for oldCertID in kur/rr msg */
X509 *certOut; /* certificate to be returned in cp/ip/kup msg */
EVP_PKEY *keyOut; /* Private key to be returned for central keygen */
X509_CRL *crlOut; /* CRL to be returned in genp for crls */
STACK_OF(X509) *chainOut; /* chain of certOut to add to extraCerts field */
STACK_OF(X509) *caPubsOut; /* used in caPubs of ip and in caCerts of genp */
@ -87,6 +88,21 @@ static mock_srv_ctx *mock_srv_ctx_new(void)
DEFINE_OSSL_SET1_CERT(refCert)
DEFINE_OSSL_SET1_CERT(certOut)
int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
if (ctx == NULL) {
ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return 0;
}
if (pkey != NULL && !EVP_PKEY_up_ref(pkey))
return 0;
EVP_PKEY_free(ctx->keyOut);
ctx->keyOut = pkey;
return 1;
}
int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx,
X509_CRL *crl)
{
@ -273,8 +289,9 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
STACK_OF(X509) **caPubs)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
int bodytype;
int bodytype, central_keygen;
OSSL_CMP_PKISI *si = NULL;
EVP_PKEY *keyOut = NULL;
if (ctx == NULL || cert_req == NULL
|| certOut == NULL || chainOut == NULL || caPubs == NULL) {
@ -358,6 +375,23 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
&& (*certOut = X509_dup(ctx->certOut)) == NULL)
/* Should return a cert produced from request template, see FR #16054 */
goto err;
central_keygen = OSSL_CRMF_MSG_centralkeygen_requested(crm, p10cr);
if (central_keygen < 0)
goto err;
if (central_keygen == 1
&& (ctx->keyOut == NULL
|| (keyOut = EVP_PKEY_dup(ctx->keyOut)) == NULL
|| !OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
1 /* priv */, keyOut))) {
EVP_PKEY_free(keyOut);
goto err;
}
/*
* Note that this uses newPkey to return the private key
* and does not check whether the 'popo' field is absent.
*/
if (ctx->chainOut != NULL
&& (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
goto err;

1
apps/lib/engine_loader.c
View file

@ -14,6 +14,7 @@
*/
#define OPENSSL_SUPPRESS_DEPRECATED
#include "internal/e_os.h"
#include "apps.h"
#ifndef OPENSSL_NO_ENGINE

9
apps/lib/http_server.c
View file

@ -18,8 +18,10 @@
#endif
#include <ctype.h>
#include "internal/e_os.h"
#include "http_server.h"
#include "internal/sockets.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#include <openssl/err.h>
#include <openssl/trace.h>
#include <openssl/rand.h>
@ -202,8 +204,9 @@ BIO *http_server_init(const char *prog, const char *port, int verb)
goto err;
acbio = BIO_new(BIO_s_accept());
if (acbio == NULL
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
|| BIO_set_accept_name(acbio, name) < 0) {
|| BIO_set_accept_ip_family(acbio, BIO_FAMILY_IPANY) <= 0 /* IPv4/6 */
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) <= 0
|| BIO_set_accept_name(acbio, name) <= 0) {
log_HTTP(prog, LOG_ERR, "error setting up accept BIO");
goto err;
}

5
apps/lib/names.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -22,7 +22,8 @@ void collect_names(const char *name, void *vdata)
{
STACK_OF(OPENSSL_CSTRING) *names = vdata;
sk_OPENSSL_CSTRING_push(names, name);
/* A failure to push cannot be handled so we ignore the result. */
(void)sk_OPENSSL_CSTRING_push(names, name);
}
void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names)

57
apps/lib/s_cb.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -243,10 +243,10 @@ static const char *get_sigtype(int nid)
return "ECDSA";
case NID_ED25519:
return "Ed25519";
return "ed25519";
case NID_ED448:
return "Ed448";
return "ed448";
case NID_id_GostR3410_2001:
return "gost2001";
@ -292,6 +292,26 @@ static int do_print_sigalgs(BIO *out, SSL *s, int shared)
SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL, &rsign, &rhash);
if (i)
BIO_puts(out, ":");
switch (rsign | rhash << 8) {
case 0x0809:
BIO_puts(out, "rsa_pss_pss_sha256");
continue;
case 0x080a:
BIO_puts(out, "rsa_pss_pss_sha384");
continue;
case 0x080b:
BIO_puts(out, "rsa_pss_pss_sha512");
continue;
case 0x081a:
BIO_puts(out, "ecdsa_brainpoolP256r1_sha256");
continue;
case 0x081b:
BIO_puts(out, "ecdsa_brainpoolP384r1_sha384");
continue;
case 0x081c:
BIO_puts(out, "ecdsa_brainpoolP512r1_sha512");
continue;
}
sstr = get_sigtype(sign_nid);
if (sstr)
BIO_printf(out, "%s", sstr);
@ -396,16 +416,28 @@ int ssl_print_groups(BIO *out, SSL *s, int noshared)
int ssl_print_tmp_key(BIO *out, SSL *s)
{
const char *keyname;
EVP_PKEY *key;
if (!SSL_get_peer_tmp_key(s, &key))
if (!SSL_get_peer_tmp_key(s, &key)) {
if (SSL_version(s) == TLS1_3_VERSION)
BIO_printf(out, "Negotiated TLS1.3 group: %s\n",
SSL_group_to_name(s, SSL_get_negotiated_group(s)));
return 1;
BIO_puts(out, "Server Temp Key: ");
}
BIO_puts(out, "Peer Temp Key: ");
switch (EVP_PKEY_get_id(key)) {
case EVP_PKEY_RSA:
BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_get_bits(key));
break;
case EVP_PKEY_KEYMGMT:
if ((keyname = EVP_PKEY_get0_type_name(key)) == NULL)
keyname = "?";
BIO_printf(out, "%s\n", keyname);
break;
case EVP_PKEY_DH:
BIO_printf(out, "DH, %d bits\n", EVP_PKEY_get_bits(key));
break;
@ -1274,6 +1306,7 @@ void print_verify_detail(SSL *s, BIO *bio)
void print_ssl_summary(SSL *s)
{
const char *sigalg;
const SSL_CIPHER *c;
X509 *peer = SSL_get0_peer_certificate(s);
EVP_PKEY *peer_rpk = SSL_get0_peer_rpk(s);
@ -1291,13 +1324,13 @@ void print_ssl_summary(SSL *s)
BIO_puts(bio_err, "\n");
if (SSL_get_peer_signature_nid(s, &nid))
BIO_printf(bio_err, "Hash used: %s\n", OBJ_nid2sn(nid));
if (SSL_get_peer_signature_type_nid(s, &nid))
BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid));
if (SSL_get0_peer_signature_name(s, &sigalg))
BIO_printf(bio_err, "Signature type: %s\n", sigalg);
print_verify_detail(s, bio_err);
} else if (peer_rpk != NULL) {
BIO_printf(bio_err, "Peer used raw public key\n");
if (SSL_get_peer_signature_type_nid(s, &nid))
BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid));
if (SSL_get0_peer_signature_name(s, &sigalg))
BIO_printf(bio_err, "Signature type: %s\n", sigalg);
print_verify_detail(s, bio_err);
} else {
BIO_puts(bio_err, "No peer certificate or raw public key\n");
@ -1306,12 +1339,8 @@ void print_ssl_summary(SSL *s)
ssl_print_point_formats(bio_err, s);
if (SSL_is_server(s))
ssl_print_groups(bio_err, s, 1);
else
ssl_print_tmp_key(bio_err, s);
#else
if (!SSL_is_server(s))
ssl_print_tmp_key(bio_err, s);
#endif
ssl_print_tmp_key(bio_err, s);
}
int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str,

16
apps/lib/s_socket.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -37,9 +37,10 @@ typedef unsigned int u_int;
#ifndef OPENSSL_NO_SOCK
# include "internal/e_os.h"
# include "apps.h"
# include "s_apps.h"
# include "internal/sockets.h"
# include "internal/sockets.h" /* for openssl_fdset() */
# include <openssl/bio.h>
# include <openssl/err.h>
@ -410,6 +411,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
BIO_closesocket(asock);
break;
}
if (naccept != -1)
naccept--;
if (naccept == 0)
BIO_closesocket(asock);
BIO_set_tcp_ndelay(sock, 1);
i = (*cb)(sock, type, protocol, context);
@ -440,11 +447,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
BIO_closesocket(sock);
} else {
if (naccept != -1)
naccept--;
i = (*cb)(asock, type, protocol, context);
}
if (naccept != -1)
naccept--;
if (i < 0 || naccept == 0) {
BIO_closesocket(asock);
ret = i;

10
apps/lib/vms_term_sock.c
View file

@ -353,7 +353,7 @@ static int CreateSocketPair (int SocketFamily,
/*
** Get the binary (64-bit) time of the specified timeout value
*/
sprintf (AscTimeBuff, "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
BIO_snprintf(AscTimeBuff, sizeof(AscTimeBuff), "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
AscTimeDesc.dsc$w_length = strlen (AscTimeBuff);
AscTimeDesc.dsc$a_pointer = AscTimeBuff;
status = sys$bintim (&AscTimeDesc, BinTimeBuff);
@ -567,10 +567,10 @@ static void LogMessage (char *msg, ...)
/*
** Format the message buffer
*/
sprintf (MsgBuff, "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
LocTime->tm_mday, Month[LocTime->tm_mon],
(LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
LocTime->tm_sec, pid, msg);
BIO_snprintf(MsgBuff, sizeof(MsgBuff), "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
LocTime->tm_mday, Month[LocTime->tm_mon],
(LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
LocTime->tm_sec, pid, msg);
/*
** Get any variable arguments and add them to the print of the message

226
apps/list.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -10,6 +10,8 @@
/* We need to use some deprecated APIs */
#define OPENSSL_SUPPRESS_DEPRECATED
#include "internal/e_os.h"
#include <string.h>
#include <openssl/evp.h>
#include <openssl/err.h>
@ -21,6 +23,8 @@
#include <openssl/store.h>
#include <openssl/core_names.h>
#include <openssl/rand.h>
#include <openssl/safestack.h>
#include <openssl/ssl.h>
#include <openssl/tls1.h>
#include "apps.h"
#include "app_params.h"
@ -54,6 +58,7 @@ IS_FETCHABLE(mac, EVP_MAC)
IS_FETCHABLE(kdf, EVP_KDF)
IS_FETCHABLE(rand, EVP_RAND)
IS_FETCHABLE(keymgmt, EVP_KEYMGMT)
IS_FETCHABLE(skeymgmt, EVP_SKEYMGMT)
IS_FETCHABLE(signature, EVP_SIGNATURE)
IS_FETCHABLE(kem, EVP_KEM)
IS_FETCHABLE(asym_cipher, EVP_ASYM_CIPHER)
@ -99,8 +104,9 @@ static void collect_ciphers(EVP_CIPHER *cipher, void *stack)
STACK_OF(EVP_CIPHER) *cipher_stack = stack;
if (is_cipher_fetchable(cipher)
&& sk_EVP_CIPHER_push(cipher_stack, cipher) > 0)
EVP_CIPHER_up_ref(cipher);
&& EVP_CIPHER_up_ref(cipher)
&& sk_EVP_CIPHER_push(cipher_stack, cipher) <= 0)
EVP_CIPHER_free(cipher); /* up-ref successful but push to stack failed */
}
static void list_ciphers(const char *prefix)
@ -183,8 +189,9 @@ static void collect_digests(EVP_MD *digest, void *stack)
STACK_OF(EVP_MD) *digest_stack = stack;
if (is_digest_fetchable(digest)
&& sk_EVP_MD_push(digest_stack, digest) > 0)
EVP_MD_up_ref(digest);
&& EVP_MD_up_ref(digest)
&& sk_EVP_MD_push(digest_stack, digest) <= 0)
EVP_MD_free(digest); /* up-ref successful but push to stack failed */
}
static void list_digests(const char *prefix)
@ -315,8 +322,9 @@ static void collect_kdfs(EVP_KDF *kdf, void *stack)
STACK_OF(EVP_KDF) *kdf_stack = stack;
if (is_kdf_fetchable(kdf)
&& sk_EVP_KDF_push(kdf_stack, kdf) > 0)
EVP_KDF_up_ref(kdf);
&& EVP_KDF_up_ref(kdf)
&& sk_EVP_KDF_push(kdf_stack, kdf) <= 0)
EVP_KDF_free(kdf); /* up-ref successful but push to stack failed */
}
static void list_kdfs(void)
@ -385,8 +393,9 @@ static void collect_rands(EVP_RAND *rand, void *stack)
STACK_OF(EVP_RAND) *rand_stack = stack;
if (is_rand_fetchable(rand)
&& sk_EVP_RAND_push(rand_stack, rand) > 0)
EVP_RAND_up_ref(rand);
&& EVP_RAND_up_ref(rand)
&& sk_EVP_RAND_push(rand_stack, rand) <= 0)
EVP_RAND_free(rand); /* up-ref successful but push to stack failed */
}
static void list_random_generators(void)
@ -511,8 +520,9 @@ static void collect_encoders(OSSL_ENCODER *encoder, void *stack)
STACK_OF(OSSL_ENCODER) *encoder_stack = stack;
if (is_encoder_fetchable(encoder)
&& sk_OSSL_ENCODER_push(encoder_stack, encoder) > 0)
OSSL_ENCODER_up_ref(encoder);
&& OSSL_ENCODER_up_ref(encoder)
&& sk_OSSL_ENCODER_push(encoder_stack, encoder) <= 0)
OSSL_ENCODER_free(encoder); /* up-ref successful but push to stack failed */
}
static void list_encoders(void)
@ -576,8 +586,9 @@ static void collect_decoders(OSSL_DECODER *decoder, void *stack)
STACK_OF(OSSL_DECODER) *decoder_stack = stack;
if (is_decoder_fetchable(decoder)
&& sk_OSSL_DECODER_push(decoder_stack, decoder) > 0)
OSSL_DECODER_up_ref(decoder);
&& OSSL_DECODER_up_ref(decoder)
&& sk_OSSL_DECODER_push(decoder_stack, decoder) <= 0)
OSSL_DECODER_free(decoder); /* up-ref successful but push to stack failed */
}
static void list_decoders(void)
@ -638,8 +649,9 @@ static void collect_keymanagers(EVP_KEYMGMT *km, void *stack)
STACK_OF(EVP_KEYMGMT) *km_stack = stack;
if (is_keymgmt_fetchable(km)
&& sk_EVP_KEYMGMT_push(km_stack, km) > 0)
EVP_KEYMGMT_up_ref(km);
&& EVP_KEYMGMT_up_ref(km)
&& sk_EVP_KEYMGMT_push(km_stack, km) <= 0)
EVP_KEYMGMT_free(km); /* up-ref successful but push to stack failed */
}
static void list_keymanagers(void)
@ -688,6 +700,61 @@ static void list_keymanagers(void)
sk_EVP_KEYMGMT_pop_free(km_stack, EVP_KEYMGMT_free);
}
DEFINE_STACK_OF(EVP_SKEYMGMT)
static int skeymanager_cmp(const EVP_SKEYMGMT * const *a,
const EVP_SKEYMGMT * const *b)
{
return strcmp(OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*a)),
OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*b)));
}
static void collect_skeymanagers(EVP_SKEYMGMT *km, void *stack)
{
STACK_OF(EVP_SKEYMGMT) *km_stack = stack;
if (is_skeymgmt_fetchable(km)
&& sk_EVP_SKEYMGMT_push(km_stack, km) > 0)
EVP_SKEYMGMT_up_ref(km);
}
static void list_skeymanagers(void)
{
int i;
STACK_OF(EVP_SKEYMGMT) *km_stack = sk_EVP_SKEYMGMT_new(skeymanager_cmp);
EVP_SKEYMGMT_do_all_provided(app_get0_libctx(), collect_skeymanagers,
km_stack);
sk_EVP_SKEYMGMT_sort(km_stack);
for (i = 0; i < sk_EVP_SKEYMGMT_num(km_stack); i++) {
EVP_SKEYMGMT *k = sk_EVP_SKEYMGMT_value(km_stack, i);
STACK_OF(OPENSSL_CSTRING) *names = NULL;
if (select_name != NULL && !EVP_SKEYMGMT_is_a(k, select_name))
continue;
names = sk_OPENSSL_CSTRING_new(name_cmp);
if (names != NULL && EVP_SKEYMGMT_names_do_all(k, collect_names, names)) {
const char *desc = EVP_SKEYMGMT_get0_description(k);
BIO_printf(bio_out, " Name: ");
if (desc != NULL)
BIO_printf(bio_out, "%s", desc);
else
BIO_printf(bio_out, "%s", sk_OPENSSL_CSTRING_value(names, 0));
BIO_printf(bio_out, "\n");
BIO_printf(bio_out, " Type: Provider Algorithm\n");
BIO_printf(bio_out, " IDs: ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(k)));
}
sk_OPENSSL_CSTRING_free(names);
}
sk_EVP_SKEYMGMT_pop_free(km_stack, EVP_SKEYMGMT_free);
}
DEFINE_STACK_OF(EVP_SIGNATURE)
static int signature_cmp(const EVP_SIGNATURE * const *a,
const EVP_SIGNATURE * const *b)
@ -701,8 +768,9 @@ static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
STACK_OF(EVP_SIGNATURE) *sig_stack = stack;
if (is_signature_fetchable(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) > 0)
EVP_SIGNATURE_up_ref(sig);
&& EVP_SIGNATURE_up_ref(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
EVP_SIGNATURE_free(sig); /* up-ref successful but push to stack failed */
}
static void list_signatures(void)
@ -774,6 +842,42 @@ static int list_tls_sigalg_caps(OSSL_PROVIDER *provider, void *cbdata)
return 1;
}
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
static void list_tls_groups(int version, int all)
{
SSL_CTX *ctx = NULL;
STACK_OF(OPENSSL_CSTRING) *groups;
size_t i, num;
if ((groups = sk_OPENSSL_CSTRING_new_null()) == NULL) {
BIO_printf(bio_err, "ERROR: Memory allocation\n");
return;
}
if ((ctx = SSL_CTX_new(TLS_method())) == NULL) {
BIO_printf(bio_err, "ERROR: Memory allocation\n");
goto err;
}
if (!SSL_CTX_set_min_proto_version(ctx, version)
|| !SSL_CTX_set_max_proto_version(ctx, version)) {
BIO_printf(bio_err, "ERROR: setting TLS protocol version\n");
goto err;
}
if (!SSL_CTX_get0_implemented_groups(ctx, all, groups)) {
BIO_printf(bio_err, "ERROR: getting implemented TLS group list\n");
goto err;
}
num = sk_OPENSSL_CSTRING_num(groups);
for (i = 0; i < num; ++i) {
BIO_printf(bio_out, "%s%c", sk_OPENSSL_CSTRING_value(groups, i),
(i < num - 1) ? ':' : '\n');
}
err:
SSL_CTX_free(ctx);
sk_OPENSSL_CSTRING_free(groups);
return;
}
#endif
static void list_tls_signatures(void)
{
int tls_sigalg_listed = 0;
@ -787,8 +891,9 @@ static void list_tls_signatures(void)
OPENSSL_free(builtin_sigalgs);
}
/* As built-in providers don't have this capability, never error */
OSSL_PROVIDER_do_all(NULL, list_tls_sigalg_caps, &tls_sigalg_listed);
if (!OSSL_PROVIDER_do_all(NULL, list_tls_sigalg_caps, &tls_sigalg_listed))
BIO_printf(bio_err,
"ERROR: could not list all provider signature algorithms\n");
if (tls_sigalg_listed < 2)
BIO_printf(bio_out,
"\nNo TLS sig algs registered by currently active providers");
@ -808,8 +913,9 @@ static void collect_kem(EVP_KEM *kem, void *stack)
STACK_OF(EVP_KEM) *kem_stack = stack;
if (is_kem_fetchable(kem)
&& sk_EVP_KEM_push(kem_stack, kem) > 0)
EVP_KEM_up_ref(kem);
&& EVP_KEM_up_ref(kem)
&& sk_EVP_KEM_push(kem_stack, kem) <= 0)
EVP_KEM_free(kem); /* up-ref successful but push to stack failed */
}
static void list_kems(void)
@ -867,8 +973,9 @@ static void collect_asymciph(EVP_ASYM_CIPHER *asym_cipher, void *stack)
STACK_OF(EVP_ASYM_CIPHER) *asym_cipher_stack = stack;
if (is_asym_cipher_fetchable(asym_cipher)
&& sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) > 0)
EVP_ASYM_CIPHER_up_ref(asym_cipher);
&& EVP_ASYM_CIPHER_up_ref(asym_cipher)
&& sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) <= 0)
EVP_ASYM_CIPHER_free(asym_cipher); /* up-ref successful but push to stack failed */
}
static void list_asymciphers(void)
@ -929,8 +1036,9 @@ static void collect_kex(EVP_KEYEXCH *kex, void *stack)
STACK_OF(EVP_KEYEXCH) *kex_stack = stack;
if (is_keyexch_fetchable(kex)
&& sk_EVP_KEYEXCH_push(kex_stack, kex) > 0)
EVP_KEYEXCH_up_ref(kex);
&& EVP_KEYEXCH_up_ref(kex)
&& sk_EVP_KEYEXCH_push(kex_stack, kex) <= 0)
EVP_KEYEXCH_free(kex); /* up-ref successful but push to stack failed */
}
static void list_keyexchanges(void)
@ -1209,8 +1317,9 @@ static void collect_store_loaders(OSSL_STORE_LOADER *store, void *stack)
{
STACK_OF(OSSL_STORE_LOADER) *store_stack = stack;
if (sk_OSSL_STORE_LOADER_push(store_stack, store) > 0)
OSSL_STORE_LOADER_up_ref(store);
if (OSSL_STORE_LOADER_up_ref(store)
&& sk_OSSL_STORE_LOADER_push(store_stack, store) <= 0)
OSSL_STORE_LOADER_free(store); /* up-ref successful but push to stack failed */
}
static void list_store_loaders(void)
@ -1508,10 +1617,20 @@ typedef enum HELPLIST_CHOICE {
OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_DISABLED,
OPT_KDF_ALGORITHMS, OPT_RANDOM_INSTANCES, OPT_RANDOM_GENERATORS,
OPT_ENCODERS, OPT_DECODERS, OPT_KEYMANAGERS, OPT_KEYEXCHANGE_ALGORITHMS,
OPT_SKEYMANAGERS,
OPT_KEM_ALGORITHMS, OPT_SIGNATURE_ALGORITHMS,
OPT_TLS_SIGNATURE_ALGORITHMS, OPT_ASYM_CIPHER_ALGORITHMS,
OPT_STORE_LOADERS, OPT_PROVIDER_INFO, OPT_OBJECTS,
OPT_SELECT_NAME,
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
OPT_ALL_TLS_GROUPS, OPT_TLS_GROUPS,
# if !defined(OPENSSL_NO_TLS1_2)
OPT_TLS1_2,
# endif
# if !defined(OPENSSL_NO_TLS1_3)
OPT_TLS1_3,
# endif
#endif
#ifndef OPENSSL_NO_DEPRECATED_3_0
OPT_ENGINES,
#endif
@ -1553,6 +1672,7 @@ const OPTIONS list_options[] = {
{"encoders", OPT_ENCODERS, '-', "List of encoding methods" },
{"decoders", OPT_DECODERS, '-', "List of decoding methods" },
{"key-managers", OPT_KEYMANAGERS, '-', "List of key managers" },
{"skey-managers", OPT_SKEYMANAGERS, '-', "List of symmetric key managers" },
{"key-exchange-algorithms", OPT_KEYEXCHANGE_ALGORITHMS, '-',
"List of key exchange algorithms" },
{"kem-algorithms", OPT_KEM_ALGORITHMS, '-',
@ -1569,6 +1689,20 @@ const OPTIONS list_options[] = {
"List of public key methods"},
{"store-loaders", OPT_STORE_LOADERS, '-',
"List of store loaders"},
#if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
{"tls-groups", OPT_TLS_GROUPS, '-',
"List implemented TLS key exchange 'groups'" },
{"all-tls-groups", OPT_ALL_TLS_GROUPS, '-',
"List implemented TLS key exchange 'groups' and all aliases" },
# ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-',
"When listing 'groups', list those compatible with TLS1.2"},
# endif
# ifndef OPENSSL_NO_TLS1_3
{"tls1_3", OPT_TLS1_3, '-',
"When listing 'groups', list those compatible with TLS1.3"},
# endif
#endif
{"providers", OPT_PROVIDER_INFO, '-',
"List of provider information"},
#ifndef OPENSSL_NO_DEPRECATED_3_0
@ -1591,6 +1725,14 @@ int list_main(int argc, char **argv)
HELPLIST_CHOICE o;
int one = 0, done = 0;
int print_newline = 0;
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
int all_tls_groups = 0;
# if !defined(OPENSSL_NO_TLS1_3)
unsigned int tls_version = TLS1_3_VERSION;
# else
unsigned int tls_version = TLS1_2_VERSION;
# endif
#endif
struct {
unsigned int commands:1;
unsigned int all_algorithms:1;
@ -1605,10 +1747,12 @@ int list_main(int argc, char **argv)
unsigned int encoder_algorithms:1;
unsigned int decoder_algorithms:1;
unsigned int keymanager_algorithms:1;
unsigned int skeymanager_algorithms:1;
unsigned int signature_algorithms:1;
unsigned int tls_signature_algorithms:1;
unsigned int keyexchange_algorithms:1;
unsigned int kem_algorithms:1;
unsigned int tls_groups:1;
unsigned int asym_cipher_algorithms:1;
unsigned int pk_algorithms:1;
unsigned int pk_method:1;
@ -1677,6 +1821,9 @@ opthelp:
case OPT_KEYMANAGERS:
todo.keymanager_algorithms = 1;
break;
case OPT_SKEYMANAGERS:
todo.skeymanager_algorithms = 1;
break;
case OPT_SIGNATURE_ALGORITHMS:
todo.signature_algorithms = 1;
break;
@ -1689,6 +1836,25 @@ opthelp:
case OPT_KEM_ALGORITHMS:
todo.kem_algorithms = 1;
break;
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
case OPT_TLS_GROUPS:
todo.tls_groups = 1;
break;
case OPT_ALL_TLS_GROUPS:
all_tls_groups = 1;
todo.tls_groups = 1;
break;
# if !defined(OPENSSL_NO_TLS1_2)
case OPT_TLS1_2:
tls_version = TLS1_2_VERSION;
break;
# endif
# if !defined(OPENSSL_NO_TLS1_3)
case OPT_TLS1_3:
tls_version = TLS1_3_VERSION;
break;
# endif
#endif
case OPT_ASYM_CIPHER_ALGORITHMS:
todo.asym_cipher_algorithms = 1;
break;
@ -1798,6 +1964,8 @@ opthelp:
MAYBE_ADD_NL(list_decoders());
if (todo.keymanager_algorithms)
MAYBE_ADD_NL(list_keymanagers());
if (todo.skeymanager_algorithms)
MAYBE_ADD_NL(list_skeymanagers());
if (todo.signature_algorithms)
MAYBE_ADD_NL(list_signatures());
if (todo.tls_signature_algorithms)
@ -1808,6 +1976,10 @@ opthelp:
MAYBE_ADD_NL(list_keyexchanges());
if (todo.kem_algorithms)
MAYBE_ADD_NL(list_kems());
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
if (todo.tls_groups)
MAYBE_ADD_NL(list_tls_groups(tls_version, all_tls_groups));
#endif
if (todo.pk_algorithms)
MAYBE_ADD_NL(list_pkey());
if (todo.pk_method)

12
apps/ocsp.c
View file

@ -553,10 +553,6 @@ int ocsp_main(int argc, char **argv)
&& respin == NULL && !(port != NULL && ridx_filename != NULL))
goto opthelp;
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req == NULL && (add_nonce != 2))
add_nonce = 0;
@ -709,6 +705,10 @@ redo_accept:
}
}
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req_text && req != NULL)
OCSP_REQUEST_print(out, req, 0);
@ -1049,6 +1049,10 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
}
bs = OCSP_BASICRESP_new();
if (bs == NULL) {
*resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs);
goto end;
}
thisupd = X509_gmtime_adj(NULL, 0);
if (ndays != -1)
nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL);

4
apps/openssl-vms.cnf
View file

@ -342,8 +342,8 @@ path = pkix/
# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature
unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected
extracertsout = insta.extracerts.pem
# Client authentication

2
apps/openssl.c
View file

@ -7,6 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include "internal/common.h"

4
apps/openssl.cnf
View file

@ -342,8 +342,8 @@ path = pkix/
# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature
unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected
extracertsout = insta.extracerts.pem
# Client authentication

6
apps/passwd.c
View file

@ -369,8 +369,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
if (magic_len > 0)
salt_out += 2 + magic_len;
if (salt_len > 8)
goto err;
assert(salt_len <= 8);
md = EVP_MD_CTX_new();
if (md == NULL
@ -589,7 +588,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
OPENSSL_strlcat(out_buf, ascii_dollar, sizeof(out_buf));
if (rounds_custom) {
char tmp_buf[80]; /* "rounds=999999999" */
sprintf(tmp_buf, "rounds=%u", rounds);
BIO_snprintf(tmp_buf, sizeof(tmp_buf), "rounds=%u", rounds);
#ifdef CHARSET_EBCDIC
/* In case we're really on a ASCII based platform and just pretend */
if (tmp_buf[0] != 0x72) /* ASCII 'r' */

23
apps/pkcs12.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -328,7 +328,8 @@ int pkcs12_main(int argc, char **argv)
if (canames == NULL
&& (canames = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(canames, opt_arg());
if (sk_OPENSSL_STRING_push(canames, opt_arg()) <= 0)
goto end;
break;
case OPT_IN:
infile = opt_arg();
@ -799,16 +800,20 @@ int pkcs12_main(int argc, char **argv)
BIO_printf(bio_err, ", Unsupported KDF or params for PBMAC1\n");
} else {
const ASN1_OBJECT *prfobj;
int prfnid;
BIO_printf(bio_err, " using PBKDF2, Iteration %ld\n",
ASN1_INTEGER_get(pbkdf2_param->iter));
BIO_printf(bio_err, "Key length: %ld, Salt length: %d\n",
ASN1_INTEGER_get(pbkdf2_param->keylength),
ASN1_STRING_length(pbkdf2_param->salt->value.octet_string));
X509_ALGOR_get0(&prfobj, NULL, NULL, pbkdf2_param->prf);
BIO_printf(bio_err, "PBKDF2 PRF: ");
i2a_ASN1_OBJECT(bio_err, prfobj);
BIO_printf(bio_err, "\n");
if (pbkdf2_param->prf == NULL) {
prfnid = NID_hmacWithSHA1;
} else {
X509_ALGOR_get0(&prfobj, NULL, NULL, pbkdf2_param->prf);
prfnid = OBJ_obj2nid(prfobj);
}
BIO_printf(bio_err, "PBKDF2 PRF: %s\n", OBJ_nid2sn(prfnid));
}
PBKDF2PARAM_free(pbkdf2_param);
} else {
@ -825,6 +830,12 @@ int pkcs12_main(int argc, char **argv)
const ASN1_OBJECT *macobj;
PKCS12_get0_mac(NULL, &macalgid, NULL, NULL, p12);
if (macalgid == NULL) {
BIO_printf(bio_err, "Warning: MAC is absent!\n");
goto dump;
}
X509_ALGOR_get0(&macobj, NULL, NULL, macalgid);
if (OBJ_obj2nid(macobj) != NID_pbmac1) {

8
apps/pkcs8.c
View file

@ -227,9 +227,6 @@ int pkcs8_main(int argc, char **argv)
informat == FORMAT_UNDEF ? FORMAT_PEM : informat);
if (in == NULL)
goto end;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (topk8) {
pkey = load_key(infile, informat, 1, passin, e, "key");
@ -240,6 +237,8 @@ int pkcs8_main(int argc, char **argv)
ERR_print_errors(bio_err);
goto end;
}
if ((out = bio_open_owner(outfile, outformat, private)) == NULL)
goto end;
if (nocrypt) {
assert(private);
if (outformat == FORMAT_PEM) {
@ -361,6 +360,9 @@ int pkcs8_main(int argc, char **argv)
}
assert(private);
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (outformat == FORMAT_PEM) {
if (traditional)
PEM_write_bio_PrivateKey_traditional(out, pkey, NULL, NULL, 0,

8
apps/pkey.c
View file

@ -208,10 +208,6 @@ int pkey_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (pubin)
pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
else
@ -219,6 +215,10 @@ int pkey_main(int argc, char **argv)
if (pkey == NULL)
goto end;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
#ifndef OPENSSL_NO_EC
if (asn1_encoding != NULL || point_format != NULL) {
OSSL_PARAM params[3], *p = params;

6
apps/pkeyparam.c
View file

@ -97,9 +97,6 @@ int pkeyparam_main(int argc, char **argv)
in = bio_open_default(infile, 'r', FORMAT_PEM);
if (in == NULL)
goto end;
out = bio_open_default(outfile, 'w', FORMAT_PEM);
if (out == NULL)
goto end;
pkey = PEM_read_bio_Parameters_ex(in, NULL, app_get0_libctx(),
app_get0_propq());
if (pkey == NULL) {
@ -107,6 +104,9 @@ int pkeyparam_main(int argc, char **argv)
ERR_print_errors(bio_err);
goto end;
}
out = bio_open_default(outfile, 'w', FORMAT_PEM);
if (out == NULL)
goto end;
if (check) {
if (e == NULL)

224
apps/pkeyutl.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -20,12 +20,15 @@
#define KEY_PUBKEY 2
#define KEY_CERT 3
static EVP_PKEY *get_pkey(const char *kdfalg,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e);
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e,
const int impl, int rawin, EVP_PKEY **ppkey,
EVP_MD_CTX *mctx, const char *digestname, const char *kemop,
OSSL_LIB_CTX *libctx, const char *propq);
int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY *pkey /* ownership is passed to ctx */,
EVP_MD_CTX *mctx, const char *digestname,
const char *kemop, OSSL_LIB_CTX *libctx, const char *propq);
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE *e);
@ -40,6 +43,17 @@ static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
int filesize, unsigned char *sig, int siglen,
unsigned char **out, size_t *poutlen);
static int only_nomd(EVP_PKEY *pkey)
{
#define MADE_UP_MAX_MD_NAME_LEN 100
char defname[MADE_UP_MAX_MD_NAME_LEN];
int deftype;
deftype = EVP_PKEY_get_default_digest_name(pkey, defname, sizeof(defname));
return deftype == 2 /* Mandatory */
&& strcmp(defname, "UNDEF") == 0;
}
typedef enum OPTION_choice {
OPT_COMMON,
OPT_ENGINE, OPT_ENGINE_IMPL, OPT_IN, OPT_OUT,
@ -65,14 +79,13 @@ const OPTIONS pkeyutl_options[] = {
{"verify", OPT_VERIFY, '-', "Verify with public key"},
{"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"},
{"decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key"},
{"derive", OPT_DERIVE, '-', "Derive shared secret"},
{"derive", OPT_DERIVE, '-', "Derive shared secret from own and peer (EC)DH keys"},
{"decap", OPT_DECAP, '-', "Decapsulate shared secret"},
{"encap", OPT_ENCAP, '-', "Encapsulate shared secret"},
OPT_CONFIG_OPTION,
OPT_SECTION("Input"),
{"in", OPT_IN, '<', "Input file - default stdin"},
{"rawin", OPT_RAWIN, '-', "Indicate the input data is in raw form"},
{"inkey", OPT_INKEY, 's', "Input key, by default private key"},
{"pubin", OPT_PUBIN, '-', "Input key is a public key"},
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
@ -86,14 +99,17 @@ const OPTIONS pkeyutl_options[] = {
OPT_SECTION("Output"),
{"out", OPT_OUT, '>', "Output file - default stdout"},
{"secret", OPT_SECOUT, '>', "File to store secret on encapsulation"},
{"asn1parse", OPT_ASN1PARSE, '-', "asn1parse the output data"},
{"asn1parse", OPT_ASN1PARSE, '-',
"parse the output as ASN.1 data to check its DER encoding and print errors"},
{"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
{"verifyrecover", OPT_VERIFYRECOVER, '-',
"Verify with public key, recover original data"},
"Verify RSA signature, recovering original signature input data"},
OPT_SECTION("Signing/Derivation/Encapsulation"),
{"rawin", OPT_RAWIN, '-',
"Indicate that the signature/verification input data is not yet hashed"},
{"digest", OPT_DIGEST, 's',
"Specify the digest algorithm when signing the raw input data"},
"The digest algorithm to use for signing/verifying raw input data. Implies -rawin"},
{"pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value"},
{"pkeyopt_passin", OPT_PKEYOPT_PASSIN, 's',
"Public key option that is read as a passphrase argument opt:passphrase"},
@ -229,6 +245,7 @@ int pkeyutl_main(int argc, char **argv)
pkey_op = EVP_PKEY_OP_DECAPSULATE;
break;
case OPT_ENCAP:
key_type = KEY_PUBKEY;
pkey_op = EVP_PKEY_OP_ENCAPSULATE;
break;
case OPT_KEMOP:
@ -277,25 +294,8 @@ int pkeyutl_main(int argc, char **argv)
if (!app_RAND_load())
goto end;
if (rawin && pkey_op != EVP_PKEY_OP_SIGN && pkey_op != EVP_PKEY_OP_VERIFY) {
BIO_printf(bio_err,
"%s: -rawin can only be used with -sign or -verify\n",
prog);
goto opthelp;
}
if (digestname != NULL && !rawin) {
BIO_printf(bio_err,
"%s: -digest can only be used with -rawin\n",
prog);
goto opthelp;
}
if (rawin && rev) {
BIO_printf(bio_err, "%s: -rev cannot be used with raw input\n",
prog);
goto opthelp;
}
if (digestname != NULL)
rawin = 1;
if (kdfalg != NULL) {
if (kdflen == 0) {
@ -309,7 +309,41 @@ int pkeyutl_main(int argc, char **argv)
goto opthelp;
} else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: no peer key given (-peerkey parameter).\n", prog);
"%s: -peerkey option not allowed without -derive.\n", prog);
goto opthelp;
} else if (peerkey == NULL && pkey_op == EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: missing -peerkey option for -derive operation.\n", prog);
goto opthelp;
}
pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op, e);
if (pkey_op == EVP_PKEY_OP_VERIFYRECOVER && !EVP_PKEY_is_a(pkey, "RSA")) {
BIO_printf(bio_err, "%s: -verifyrecover can be used only with RSA\n", prog);
goto end;
}
if (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY) {
if (only_nomd(pkey)) {
if (digestname != NULL) {
const char *alg = EVP_PKEY_get0_type_name(pkey);
BIO_printf(bio_err,
"%s: -digest (prehash) is not supported with %s\n",
prog, alg != NULL ? alg : "(unknown key type)");
goto end;
}
rawin = 1;
}
} else if (digestname != NULL || rawin) {
BIO_printf(bio_err,
"%s: -digest and -rawin can only be used with -sign or -verify\n", prog);
goto opthelp;
}
if (rawin && rev) {
BIO_printf(bio_err, "%s: -rev cannot be used with raw input\n", prog);
goto opthelp;
}
@ -319,8 +353,7 @@ int pkeyutl_main(int argc, char **argv)
goto end;
}
}
ctx = init_ctx(kdfalg, &keysize, inkey, keyform, key_type,
passinarg, pkey_op, e, engine_impl, rawin, &pkey,
ctx = init_ctx(kdfalg, &keysize, pkey_op, e, engine_impl, rawin, pkey,
mctx, digestname, kemop, libctx, app_get0_propq());
if (ctx == NULL) {
BIO_printf(bio_err, "%s: Error initializing context\n", prog);
@ -374,8 +407,10 @@ int pkeyutl_main(int argc, char **argv)
goto end;
}
} else {
/* Get password as a passin argument: First split option name
* and passphrase argument into two strings */
/*
* Get password as a passin argument: First split option name
* and passphrase argument into two strings
*/
*passin = 0;
passin++;
if (app_passwd(passin, NULL, &passwd, NULL) == 0) {
@ -416,17 +451,31 @@ int pkeyutl_main(int argc, char **argv)
if (in == NULL)
goto end;
}
out = bio_open_default(outfile, 'w', FORMAT_BINARY);
if (out == NULL)
goto end;
if (pkey_op == EVP_PKEY_OP_ENCAPSULATE) {
if (secoutfile == NULL) {
BIO_printf(bio_err, "Encapsulation requires '-secret' argument\n");
if (pkey_op == EVP_PKEY_OP_DECAPSULATE && outfile != NULL) {
if (secoutfile != NULL) {
BIO_printf(bio_err, "%s: Decapsulation produces only a shared "
"secret and no output. The '-out' option "
"is not applicable.\n", prog);
goto end;
}
secout = bio_open_default(secoutfile, 'w', FORMAT_BINARY);
if (secout == NULL)
if ((out = bio_open_owner(outfile, 'w', FORMAT_BINARY)) == NULL)
goto end;
} else {
out = bio_open_default(outfile, 'w', FORMAT_BINARY);
if (out == NULL)
goto end;
}
if (pkey_op == EVP_PKEY_OP_ENCAPSULATE
|| pkey_op == EVP_PKEY_OP_DECAPSULATE) {
if (secoutfile == NULL && pkey_op == EVP_PKEY_OP_ENCAPSULATE) {
BIO_printf(bio_err, "KEM-based shared-secret derivation requires "
"the '-secret <file>' option\n");
goto end;
}
/* For backwards compatibility, default decap secrets to the output */
if (secoutfile != NULL
&& (secout = bio_open_owner(secoutfile, 'w', FORMAT_BINARY)) == NULL)
goto end;
}
@ -457,6 +506,7 @@ int pkeyutl_main(int argc, char **argv)
size_t i;
unsigned char ctmp;
size_t l = (size_t)buf_inlen;
for (i = 0; i < l / 2; i++) {
ctmp = buf_in[i];
buf_in[i] = buf_in[l - 1 - i];
@ -467,12 +517,13 @@ int pkeyutl_main(int argc, char **argv)
/* Sanity check the input if the input is not raw */
if (!rawin
&& buf_inlen > EVP_MAX_MD_SIZE
&& (pkey_op == EVP_PKEY_OP_SIGN
|| pkey_op == EVP_PKEY_OP_VERIFY)) {
BIO_printf(bio_err,
"Error: The input data looks too long to be a hash\n");
goto end;
&& (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY)) {
if (buf_inlen > EVP_MAX_MD_SIZE) {
BIO_printf(bio_err,
"Error: The non-raw input data length %d is too long - max supported hashed size is %d\n",
buf_inlen, EVP_MAX_MD_SIZE);
goto end;
}
}
if (pkey_op == EVP_PKEY_OP_VERIFY) {
@ -503,8 +554,12 @@ int pkeyutl_main(int argc, char **argv)
rv = do_keyop(ctx, pkey_op, NULL, (size_t *)&buf_outlen,
buf_in, (size_t)buf_inlen, NULL, (size_t *)&secretlen);
}
if (rv > 0 && buf_outlen != 0) {
buf_out = app_malloc(buf_outlen, "buffer output");
if (rv > 0
&& (secretlen > 0 || (pkey_op != EVP_PKEY_OP_ENCAPSULATE
&& pkey_op != EVP_PKEY_OP_DECAPSULATE))
&& (buf_outlen > 0 || pkey_op == EVP_PKEY_OP_DECAPSULATE)) {
if (buf_outlen > 0)
buf_out = app_malloc(buf_outlen, "buffer output");
if (secretlen > 0)
secret = app_malloc(secretlen, "secret output");
rv = do_keyop(ctx, pkey_op,
@ -530,14 +585,16 @@ int pkeyutl_main(int argc, char **argv)
} else {
BIO_write(out, buf_out, buf_outlen);
}
/* Backwards compatible decap output fallback */
if (secretlen > 0)
BIO_write(secout, secret, secretlen);
BIO_write(secout ? secout : out, secret, secretlen);
end:
if (ret != 0)
ERR_print_errors(bio_err);
EVP_MD_CTX_free(mctx);
EVP_PKEY_CTX_free(ctx);
EVP_PKEY_free(pkey);
EVP_MD_free(md);
release_engine(e);
BIO_free(in);
@ -553,29 +610,23 @@ int pkeyutl_main(int argc, char **argv)
return ret;
}
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY **ppkey, EVP_MD_CTX *mctx, const char *digestname,
const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
static EVP_PKEY *get_pkey(const char *kdfalg,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e)
{
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL;
ENGINE *impl = NULL;
char *passin = NULL;
int rv = -1;
X509 *x;
if (((pkey_op == EVP_PKEY_OP_SIGN) || (pkey_op == EVP_PKEY_OP_DECRYPT)
|| (pkey_op == EVP_PKEY_OP_DERIVE))
&& (key_type != KEY_PRIVKEY && kdfalg == NULL)) {
BIO_printf(bio_err, "A private key is needed for this operation\n");
goto end;
return NULL;
}
if (!app_passwd(passinarg, NULL, &passin, NULL)) {
BIO_printf(bio_err, "Error getting password\n");
goto end;
return NULL;
}
switch (key_type) {
case KEY_PRIVKEY:
@ -598,6 +649,20 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
break;
}
OPENSSL_free(passin);
return pkey;
}
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY *pkey /* ownership is passed to ctx */,
EVP_MD_CTX *mctx, const char *digestname,
const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
{
EVP_PKEY_CTX *ctx = NULL;
ENGINE *impl = NULL;
int rv = -1;
#ifndef OPENSSL_NO_ENGINE
if (engine_impl)
@ -612,7 +677,7 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
if (kdfnid == NID_undef) {
BIO_printf(bio_err, "The given KDF \"%s\" is unknown.\n",
kdfalg);
goto end;
return NULL;
}
}
if (impl != NULL)
@ -621,20 +686,17 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq);
} else {
if (pkey == NULL)
goto end;
return NULL;
*pkeysize = EVP_PKEY_get_size(pkey);
if (impl != NULL)
ctx = EVP_PKEY_CTX_new(pkey, impl);
else
ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
if (ppkey != NULL)
*ppkey = pkey;
EVP_PKEY_free(pkey);
}
if (ctx == NULL)
goto end;
return NULL;
if (rawin) {
EVP_MD_CTX_set_pkey_ctx(mctx, ctx);
@ -696,18 +758,16 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
ctx = NULL;
}
end:
OPENSSL_free(passin);
return ctx;
}
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE *e)
{
EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx);
EVP_PKEY *peer = NULL;
ENGINE *engine = NULL;
int ret;
int ret = 1;
if (peerform == FORMAT_ENGINE)
engine = e;
@ -716,8 +776,14 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
BIO_printf(bio_err, "Error reading peer key %s\n", file);
return 0;
}
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
if (strcmp(EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey)) != 0) {
BIO_printf(bio_err,
"Type of peer public key: %s does not match type of private key: %s\n",
EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey));
ret = 0;
} else {
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
}
EVP_PKEY_free(peer);
return ret;
@ -729,6 +795,7 @@ static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
unsigned char *secret, size_t *pseclen)
{
int rv = 0;
switch (pkey_op) {
case EVP_PKEY_OP_VERIFYRECOVER:
rv = EVP_PKEY_verify_recover(ctx, out, poutlen, in, inlen);
@ -755,7 +822,7 @@ static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
break;
case EVP_PKEY_OP_DECAPSULATE:
rv = EVP_PKEY_decapsulate(ctx, out, poutlen, in, inlen);
rv = EVP_PKEY_decapsulate(ctx, secret, pseclen, in, inlen);
break;
}
@ -775,8 +842,7 @@ static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
int buf_len = 0;
/* Some algorithms only support oneshot digests */
if (EVP_PKEY_get_id(pkey) == EVP_PKEY_ED25519
|| EVP_PKEY_get_id(pkey) == EVP_PKEY_ED448) {
if (only_nomd(pkey)) {
if (filesize < 0) {
BIO_printf(bio_err,
"Error: unable to determine file size for oneshot operation\n");

8
apps/prime.c
View file

@ -145,10 +145,14 @@ opthelp:
}
BN_print(bio_out, bn);
r = BN_check_prime(bn, NULL, NULL);
if (r < 0) {
BIO_printf(bio_err, "Error checking prime\n");
goto end;
}
BIO_printf(bio_out, " (%s) %s prime\n",
argv[0],
BN_check_prime(bn, NULL, NULL)
? "is" : "is not");
r == 1 ? "is" : "is not");
}
}

6
apps/rehash.c
View file

@ -8,6 +8,7 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h" /* LIST_SEPARATOR_CHAR */
#include "apps.h"
#include "progs.h"
@ -562,6 +563,11 @@ int rehash_main(int argc, char **argv)
} else if ((env = getenv(X509_get_default_cert_dir_env())) != NULL) {
char lsc[2] = { LIST_SEPARATOR_CHAR, '\0' };
m = OPENSSL_strdup(env);
if (m == NULL) {
BIO_puts(bio_err, "out of memory\n");
errs = 1;
goto end;
}
for (e = strtok(m, lsc); e != NULL; e = strtok(NULL, lsc))
errs += do_dir(e, h);
OPENSSL_free(m);

15
apps/req.c
View file

@ -81,6 +81,7 @@ static int batch = 0;
typedef enum OPTION_choice {
OPT_COMMON,
OPT_CIPHER,
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY,
OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT,
OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY,
@ -98,6 +99,7 @@ typedef enum OPTION_choice {
const OPTIONS req_options[] = {
OPT_SECTION("General"),
{"help", OPT_HELP, '-', "Display this summary"},
{"cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption"},
#ifndef OPENSSL_NO_ENGINE
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
{"keygen_engine", OPT_KEYGEN_ENGINE, 's',
@ -250,7 +252,7 @@ int req_main(int argc, char **argv)
LHASH_OF(OPENSSL_STRING) *addexts = NULL;
X509 *new_x509 = NULL, *CAcert = NULL;
X509_REQ *req = NULL;
EVP_CIPHER *cipher = NULL;
const EVP_CIPHER *cipher = NULL;
int ext_copy = EXT_COPY_UNSET;
BIO *addext_bio = NULL;
char *extsect = NULL;
@ -273,9 +275,7 @@ int req_main(int argc, char **argv)
long newkey_len = -1;
unsigned long chtype = MBSTRING_ASC, reqflag = 0;
#ifndef OPENSSL_NO_DES
cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
#endif
cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
opt_set_unknown_name("digest");
prog = opt_init(argc, argv, req_options);
@ -491,6 +491,13 @@ int req_main(int argc, char **argv)
case OPT_PRECERT:
newreq = precert = 1;
break;
case OPT_CIPHER:
cipher = EVP_get_cipherbyname(opt_arg());
if (cipher == NULL) {
BIO_printf(bio_err, "Unknown cipher: %s\n", opt_arg());
goto opthelp;
}
break;
case OPT_MD:
digest = opt_unknown();
break;

6
apps/s_client.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2005 Nokia. All rights reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -16,6 +16,7 @@
#include <errno.h>
#include <openssl/e_os2.h>
#include "internal/nelem.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#ifndef OPENSSL_NO_SOCK
@ -207,7 +208,8 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
const SSL_CIPHER *cipher = NULL;
if (psksess != NULL) {
SSL_SESSION_up_ref(psksess);
if (!SSL_SESSION_up_ref(psksess))
goto err;
usesess = psksess;
} else {
long key_len;

54
apps/s_server.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@ -9,6 +9,8 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
@ -22,6 +24,7 @@
#include <openssl/async.h>
#include <openssl/ssl.h>
#include <openssl/decoder.h>
#include "internal/sockets.h" /* for openssl_fdset() */
#ifndef OPENSSL_NO_SOCK
@ -206,7 +209,9 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
}
if (psksess != NULL) {
SSL_SESSION_up_ref(psksess);
if (!SSL_SESSION_up_ref(psksess))
return 0;
*sess = psksess;
return 1;
}
@ -1754,9 +1759,9 @@ int s_server_main(int argc, char *argv[])
goto end;
}
#endif
if (early_data && (www > 0 || rev)) {
if (early_data && rev) {
BIO_printf(bio_err,
"Can't use -early_data in combination with -www, -WWW, -HTTP, or -rev\n");
"Can't use -early_data in combination with -rev\n");
goto end;
}
@ -3153,7 +3158,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
int i, j, k, dot;
SSL *con;
const SSL_CIPHER *c;
BIO *io, *ssl_bio, *sbio;
BIO *io, *ssl_bio, *sbio, *edio;
#ifdef RENEG
int total_bytes = 0;
#endif
@ -3175,7 +3180,8 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
p = buf = app_malloc(bufsize + 1, "server www buffer");
io = BIO_new(BIO_f_buffer());
ssl_bio = BIO_new(BIO_f_ssl());
if ((io == NULL) || (ssl_bio == NULL))
edio = BIO_new(BIO_s_mem());
if ((io == NULL) || (ssl_bio == NULL) || (edio == NULL))
goto err;
if (s_nbio) {
@ -3235,6 +3241,12 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
goto err;
io = BIO_push(filter, io);
filter = BIO_new(BIO_f_ebcdic_filter());
if (filter == NULL)
goto err;
edio = BIO_push(filter, edio);
#endif
if (s_debug) {
@ -3251,8 +3263,35 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
}
if (early_data) {
int edret = SSL_READ_EARLY_DATA_ERROR;
size_t readbytes;
while (edret != SSL_READ_EARLY_DATA_FINISH) {
for (;;) {
edret = SSL_read_early_data(con, buf, bufsize, &readbytes);
if (edret != SSL_READ_EARLY_DATA_ERROR)
break;
switch (SSL_get_error(con, 0)) {
case SSL_ERROR_WANT_WRITE:
case SSL_ERROR_WANT_ASYNC:
case SSL_ERROR_WANT_READ:
/* Just keep trying - busy waiting */
continue;
default:
BIO_printf(bio_err, "Error reading early data\n");
ERR_print_errors(bio_err);
goto err;
}
}
if (readbytes > 0)
BIO_write(edio, buf, (int)readbytes);
}
}
for (;;) {
i = BIO_gets(io, buf, bufsize + 1);
i = BIO_gets(!BIO_eof(edio) ? edio : io, buf, bufsize + 1);
if (i < 0) { /* error */
if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) {
if (!s_quiet)
@ -3592,6 +3631,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
OPENSSL_free(buf);
BIO_free(ssl_bio);
BIO_free_all(io);
BIO_free_all(edio);
return ret;
}

135
apps/skeyutl.c Normal file
View file

@ -0,0 +1,135 @@
/*
* Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include "apps.h"
#include "progs.h"
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/evp.h>
typedef enum OPTION_choice {
OPT_COMMON,
OPT_PROV_ENUM,
OPT_CIPHER,
OPT_SKEYOPT, OPT_SKEYMGMT, OPT_GENKEY
} OPTION_CHOICE;
const OPTIONS skeyutl_options[] = {
OPT_SECTION("General"),
{"help", OPT_HELP, '-', "Display this summary"},
{"skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque keys handling"},
{"skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque keys handling"},
{"genkey", OPT_GENKEY, '-', "Generate an opaque symmetric key"},
{"cipher", OPT_CIPHER, 's', "The cipher to generate key for"},
OPT_PROV_OPTIONS,
{NULL}
};
int skeyutl_main(int argc, char **argv)
{
EVP_CIPHER *cipher = NULL;
int ret = 1;
OPTION_CHOICE o;
int genkey = 0;
char *prog, *ciphername = NULL;
STACK_OF(OPENSSL_STRING) *skeyopts = NULL;
const char *skeymgmt = NULL;
EVP_SKEY *skey = NULL;
EVP_SKEYMGMT *mgmt = NULL;
prog = opt_init(argc, argv, skeyutl_options);
while ((o = opt_next()) != OPT_EOF) {
switch (o) {
case OPT_EOF:
case OPT_ERR:
opthelp:
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
goto end;
case OPT_HELP:
opt_help(skeyutl_options);
ret = 0;
goto end;
case OPT_GENKEY:
genkey = 1;
break;
case OPT_CIPHER:
ciphername = opt_arg();
break;
case OPT_SKEYOPT:
if ((skeyopts == NULL &&
(skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
BIO_printf(bio_err, "%s: out of memory\n", prog);
goto end;
}
break;
case OPT_SKEYMGMT:
skeymgmt = opt_arg();
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
/* Get the cipher name, either from progname (if set) or flag. */
if (!opt_cipher_any(ciphername, &cipher))
goto opthelp;
if (cipher == NULL && skeymgmt == NULL) {
BIO_printf(bio_err, "Either -skeymgmt -or -cipher option should be specified\n");
goto end;
}
if (genkey) {
OSSL_PARAM *params = NULL;
mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
app_get0_propq());
if (mgmt == NULL)
goto end;
params = app_params_new_from_opts(skeyopts,
EVP_SKEYMGMT_get0_gen_settable_params(mgmt));
skey = EVP_SKEY_generate(app_get0_libctx(),
skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
app_get0_propq(), params);
OSSL_PARAM_free(params);
if (skey == NULL) {
BIO_printf(bio_err, "Error creating opaque key for skeymgmt %s\n",
skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
ERR_print_errors(bio_err);
} else {
const char *key_name = EVP_SKEY_get0_key_id(skey);
BIO_printf(bio_out, "An opaque key identified by %s is created\n",
key_name ? key_name : "<unknown>");
BIO_printf(bio_out, "Provider: %s\n", EVP_SKEY_get0_provider_name(skey));
BIO_printf(bio_out, "Key management: %s\n", EVP_SKEY_get0_skeymgmt_name(skey));
ret = 0;
}
goto end;
} else {
BIO_printf(bio_err, "Key generation is the only supported operation as of now\n");
}
end:
ERR_print_errors(bio_err);
sk_OPENSSL_STRING_free(skeyopts);
EVP_SKEYMGMT_free(mgmt);
EVP_SKEY_free(skey);
EVP_CIPHER_free(cipher);
return ret;
}

30
apps/smime.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -315,13 +315,15 @@ int smime_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (keyfile == NULL)
keyfile = signerfile;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
keyfile = NULL;
}
signerfile = opt_arg();
@ -346,12 +348,14 @@ int smime_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
signerfile = NULL;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
keyfile = opt_arg();
break;
@ -424,12 +428,14 @@ int smime_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (!skkeys && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
if (!keyfile)
keyfile = signerfile;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
if (sksigners == NULL) {
BIO_printf(bio_err, "No signer certificate specified\n");
@ -471,14 +477,8 @@ int smime_main(int argc, char **argv)
}
if (operation == SMIME_ENCRYPT) {
if (cipher == NULL) {
#ifndef OPENSSL_NO_DES
cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
#else
BIO_printf(bio_err, "No cipher selected\n");
goto end;
#endif
}
if (cipher == NULL)
cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
encerts = sk_X509_new_null();
if (encerts == NULL)
goto end;

416
apps/speed.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -26,6 +26,7 @@
/* We need to use some deprecated APIs */
#define OPENSSL_SUPPRESS_DEPRECATED
#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
@ -514,6 +515,14 @@ static double sigs_results[MAX_SIG_NUM][3]; /* keygen, sign, verify */
#define COND(unused_cond) (run && count < (testmode ? 1 : INT_MAX))
#define COUNT(d) (count)
#define TAG_LEN 16 /* 16 bytes tag length works for all AEAD modes */
#define AEAD_IVLEN 12 /* 12 bytes iv length works for all AEAD modes */
static unsigned int mode_op; /* AE Mode of operation */
static unsigned int aead = 0; /* AEAD flag */
static unsigned char aead_iv[AEAD_IVLEN]; /* For AEAD modes */
static unsigned char aad[EVP_AEAD_TLS1_AAD_LEN] = { 0xcc };
typedef struct loopargs_st {
ASYNC_JOB *inprogress_job;
ASYNC_WAIT_CTX *wait_ctx;
@ -522,6 +531,7 @@ typedef struct loopargs_st {
unsigned char *buf_malloc;
unsigned char *buf2_malloc;
unsigned char *key;
unsigned char tag[TAG_LEN];
size_t buflen;
size_t sigsize;
size_t encsize;
@ -874,12 +884,8 @@ static int EVP_Update_loop(void *args)
unsigned char *buf = tempargs->buf;
EVP_CIPHER_CTX *ctx = tempargs->ctx;
int outl, count, rc;
unsigned char faketag[16] = { 0xcc };
if (decrypt) {
if (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER) {
(void)EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, sizeof(faketag), faketag);
}
for (count = 0; COND(c[D_EVP][testnum]); count++) {
rc = EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
if (rc != 1) {
@ -907,44 +913,71 @@ static int EVP_Update_loop(void *args)
}
/*
* To make AEAD benchmarking more relevant perform TLS-like operations,
* 13-byte AAD followed by payload. But don't use TLS-formatted AAD, as
* payload length is not actually limited by 16KB...
* CCM does not support streaming. For the purpose of performance measurement,
* each message is encrypted using the same (key,iv)-pair. Do not use this
* code in your application.
*/
static int EVP_Update_loop_ccm(void *args)
static int EVP_Update_loop_aead_enc(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
unsigned char *buf = tempargs->buf;
unsigned char *key = tempargs->key;
EVP_CIPHER_CTX *ctx = tempargs->ctx;
int outl, count, realcount = 0, final;
unsigned char tag[12];
int outl, count, realcount = 0;
if (decrypt) {
for (count = 0; COND(c[D_EVP][testnum]); count++) {
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, sizeof(tag),
tag) > 0
/* reset iv */
&& EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, iv) > 0
/* counter is reset on every update */
&& EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]) > 0)
realcount++;
for (count = 0; COND(c[D_EVP][testnum]); count++) {
/* Set length of iv (Doesn't apply to SIV mode) */
if (mode_op != EVP_CIPH_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
sizeof(aead_iv), NULL)) {
BIO_printf(bio_err, "\nFailed to set iv length\n");
dofail();
exit(1);
}
}
} else {
for (count = 0; COND(c[D_EVP][testnum]); count++) {
/* restore iv length field */
if (EVP_EncryptUpdate(ctx, NULL, &outl, NULL, lengths[testnum]) > 0
/* counter is reset on every update */
&& EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum]) > 0)
realcount++;
/* Set tag_len (Not for GCM/SIV at encryption stage) */
if (mode_op != EVP_CIPH_GCM_MODE
&& mode_op != EVP_CIPH_SIV_MODE
&& mode_op != EVP_CIPH_GCM_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
TAG_LEN, NULL)) {
BIO_printf(bio_err, "\nFailed to set tag length\n");
dofail();
exit(1);
}
}
if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, aead_iv, -1)) {
BIO_printf(bio_err, "\nFailed to set key and iv\n");
dofail();
exit(1);
}
/* Set total length of input. Only required for CCM */
if (mode_op == EVP_CIPH_CCM_MODE) {
if (!EVP_EncryptUpdate(ctx, NULL, &outl,
NULL, lengths[testnum])) {
BIO_printf(bio_err, "\nCouldn't set input text length\n");
dofail();
exit(1);
}
}
if (aead) {
if (!EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) {
BIO_printf(bio_err, "\nCouldn't insert AAD when encrypting\n");
dofail();
exit(1);
}
}
if (!EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum])) {
BIO_printf(bio_err, "\nFailed to encrypt the data\n");
dofail();
exit(1);
}
if (EVP_EncryptFinal_ex(ctx, buf, &outl))
realcount++;
}
if (decrypt)
final = EVP_DecryptFinal_ex(ctx, buf, &outl);
else
final = EVP_EncryptFinal_ex(ctx, buf, &outl);
if (final == 0)
BIO_printf(bio_err, "Error finalizing ccm loop\n");
return realcount;
}
@ -952,34 +985,87 @@ static int EVP_Update_loop_ccm(void *args)
* To make AEAD benchmarking more relevant perform TLS-like operations,
* 13-byte AAD followed by payload. But don't use TLS-formatted AAD, as
* payload length is not actually limited by 16KB...
* CCM does not support streaming. For the purpose of performance measurement,
* each message is decrypted using the same (key,iv)-pair. Do not use this
* code in your application.
* For decryption, we will use buf2 to preserve the input text in buf.
*/
static int EVP_Update_loop_aead(void *args)
static int EVP_Update_loop_aead_dec(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
unsigned char *buf = tempargs->buf;
unsigned char *outbuf = tempargs->buf2;
unsigned char *key = tempargs->key;
unsigned char tag[TAG_LEN];
EVP_CIPHER_CTX *ctx = tempargs->ctx;
int outl, count, realcount = 0;
unsigned char aad[13] = { 0xcc };
unsigned char faketag[16] = { 0xcc };
if (decrypt) {
for (count = 0; COND(c[D_EVP][testnum]); count++) {
if (EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, iv) > 0
&& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
sizeof(faketag), faketag) > 0
&& EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad)) > 0
&& EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]) > 0
&& EVP_DecryptFinal_ex(ctx, buf + outl, &outl) > 0)
realcount++;
for (count = 0; COND(c[D_EVP][testnum]); count++) {
/* Set the length of iv (Doesn't apply to SIV mode) */
if (mode_op != EVP_CIPH_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
sizeof(aead_iv), NULL)) {
BIO_printf(bio_err, "\nFailed to set iv length\n");
dofail();
exit(1);
}
}
} else {
for (count = 0; COND(c[D_EVP][testnum]); count++) {
if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv) > 0
&& EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad)) > 0
&& EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum]) > 0
&& EVP_EncryptFinal_ex(ctx, buf + outl, &outl) > 0)
realcount++;
/* Set the tag length (Doesn't apply to SIV mode) */
if (mode_op != EVP_CIPH_SIV_MODE
&& mode_op != EVP_CIPH_GCM_MODE
&& mode_op != EVP_CIPH_GCM_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
TAG_LEN, NULL)) {
BIO_printf(bio_err, "\nFailed to set tag length\n");
dofail();
exit(1);
}
}
if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, aead_iv, -1)) {
BIO_printf(bio_err, "\nFailed to set key and iv\n");
dofail();
exit(1);
}
/* Set iv before decryption (Doesn't apply to SIV mode) */
if (mode_op != EVP_CIPH_SIV_MODE) {
if (!EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, aead_iv)) {
BIO_printf(bio_err, "\nFailed to set iv\n");
dofail();
exit(1);
}
}
memcpy(tag, tempargs->tag, TAG_LEN);
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
TAG_LEN, tag)) {
BIO_printf(bio_err, "\nFailed to set tag\n");
dofail();
exit(1);
}
/* Set the total length of cipher text. Only required for CCM */
if (mode_op == EVP_CIPH_CCM_MODE) {
if (!EVP_DecryptUpdate(ctx, NULL, &outl,
NULL, lengths[testnum])) {
BIO_printf(bio_err, "\nCouldn't set cipher text length\n");
dofail();
exit(1);
}
}
if (aead) {
if (!EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) {
BIO_printf(bio_err, "\nCouldn't insert AAD when decrypting\n");
dofail();
exit(1);
}
}
if (!EVP_DecryptUpdate(ctx, outbuf, &outl, buf, lengths[testnum])) {
BIO_printf(bio_err, "\nFailed to decrypt the data\n");
dofail();
exit(1);
}
if (EVP_DecryptFinal_ex(ctx, outbuf, &outl))
realcount++;
}
return realcount;
}
@ -1444,6 +1530,24 @@ static int SIG_verify_loop(void *args)
return count;
}
static int check_block_size(EVP_CIPHER_CTX *ctx, int length)
{
const EVP_CIPHER *ciph = EVP_CIPHER_CTX_get0_cipher(ctx);
int blocksize = EVP_CIPHER_CTX_get_block_size(ctx);
if (ciph == NULL || blocksize <= 0) {
BIO_printf(bio_err, "\nInvalid cipher!\n");
return 0;
}
if (length % blocksize != 0) {
BIO_printf(bio_err,
"\nRequested encryption length not a multiple of block size for %s!\n",
EVP_CIPHER_get0_name(ciph));
return 0;
}
return 1;
}
static int run_benchmark(int async_jobs,
int (*loop_function) (void *), loopargs_t *loopargs)
{
@ -1713,9 +1817,9 @@ static void collect_kem(EVP_KEM *kem, void *stack)
STACK_OF(EVP_KEM) *kem_stack = stack;
if (is_kem_fetchable(kem)
&& sk_EVP_KEM_push(kem_stack, kem) > 0) {
EVP_KEM_up_ref(kem);
}
&& EVP_KEM_up_ref(kem)
&& sk_EVP_KEM_push(kem_stack, kem) <= 0)
EVP_KEM_free(kem); /* up-ref successful but push to stack failed */
}
static int kem_locate(const char *algo, unsigned int *idx)
@ -1745,8 +1849,9 @@ static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
STACK_OF(EVP_SIGNATURE) *sig_stack = stack;
if (is_signature_fetchable(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) > 0)
EVP_SIGNATURE_up_ref(sig);
&& EVP_SIGNATURE_up_ref(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
EVP_SIGNATURE_free(sig); /* up-ref successful but push to stack failed */
}
static int sig_locate(const char *algo, unsigned int *idx)
@ -1784,14 +1889,14 @@ int speed_main(int argc, char **argv)
OPTION_CHOICE o;
int async_init = 0, multiblock = 0, pr_header = 0;
uint8_t doit[ALGOR_NUM] = { 0 };
int ret = 1, misalign = 0, lengths_single = 0, aead = 0;
int ret = 1, misalign = 0, lengths_single = 0;
STACK_OF(EVP_KEM) *kem_stack = NULL;
STACK_OF(EVP_SIGNATURE) *sig_stack = NULL;
long count = 0;
unsigned int size_num = SIZE_NUM;
unsigned int i, k, loopargs_len = 0, async_jobs = 0;
unsigned int idx;
int keylen;
int keylen = 0;
int buflen;
size_t declen;
BIGNUM *bn = NULL;
@ -2623,13 +2728,13 @@ int speed_main(int argc, char **argv)
if (doit[D_HMAC]) {
static const char hmac_key[] = "This is a key...";
int len = strlen(hmac_key);
size_t hmac_name_len = sizeof("hmac()") + strlen(evp_mac_mdname);
OSSL_PARAM params[3];
if (evp_mac_mdname == NULL)
goto end;
evp_hmac_name = app_malloc(sizeof("hmac()") + strlen(evp_mac_mdname),
"HMAC name");
sprintf(evp_hmac_name, "hmac(%s)", evp_mac_mdname);
evp_hmac_name = app_malloc(hmac_name_len, "HMAC name");
BIO_snprintf(evp_hmac_name, hmac_name_len, "hmac(%s)", evp_mac_mdname);
names[D_HMAC] = evp_hmac_name;
params[0] =
@ -2664,6 +2769,8 @@ int speed_main(int argc, char **argv)
}
algindex = D_CBC_DES;
for (testnum = 0; st && testnum < size_num; testnum++) {
if (!check_block_size(loopargs[0].ctx, lengths[testnum]))
break;
print_message(names[D_CBC_DES], lengths[testnum], seconds.sym);
Time_F(START);
count = run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
@ -2684,6 +2791,8 @@ int speed_main(int argc, char **argv)
}
algindex = D_EDE3_DES;
for (testnum = 0; st && testnum < size_num; testnum++) {
if (!check_block_size(loopargs[0].ctx, lengths[testnum]))
break;
print_message(names[D_EDE3_DES], lengths[testnum], seconds.sym);
Time_F(START);
count =
@ -2708,6 +2817,8 @@ int speed_main(int argc, char **argv)
}
for (testnum = 0; st && testnum < size_num; testnum++) {
if (!check_block_size(loopargs[0].ctx, lengths[testnum]))
break;
print_message(names[algindex], lengths[testnum], seconds.sym);
Time_F(START);
count =
@ -2733,6 +2844,8 @@ int speed_main(int argc, char **argv)
}
for (testnum = 0; st && testnum < size_num; testnum++) {
if (!check_block_size(loopargs[0].ctx, lengths[testnum]))
break;
print_message(names[algindex], lengths[testnum], seconds.sym);
Time_F(START);
count =
@ -2757,6 +2870,8 @@ int speed_main(int argc, char **argv)
}
for (testnum = 0; st && testnum < size_num; testnum++) {
if (!check_block_size(loopargs[0].ctx, lengths[testnum]))
break;
print_message(names[algindex], lengths[testnum], seconds.sym);
Time_F(START);
count =
@ -2810,12 +2925,20 @@ int speed_main(int argc, char **argv)
}
}
/*-
* There are three scenarios for D_EVP:
* 1- Using authenticated encryption (AE) e.g. CCM, GCM, OCB etc.
* 2- Using AE + associated data (AD) i.e. AEAD using CCM, GCM, OCB etc.
* 3- Not using AE or AD e.g. ECB, CBC, CFB etc.
*/
if (doit[D_EVP]) {
if (evp_cipher != NULL) {
int (*loopfunc) (void *) = EVP_Update_loop;
int (*loopfunc) (void *);
int outlen = 0;
unsigned int ae_mode = 0;
if (multiblock && (EVP_CIPHER_get_flags(evp_cipher) &
EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
if (multiblock && (EVP_CIPHER_get_flags(evp_cipher)
& EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
multiblock_speed(evp_cipher, lengths_single, &seconds);
ret = 0;
goto end;
@ -2823,16 +2946,27 @@ int speed_main(int argc, char **argv)
names[D_EVP] = EVP_CIPHER_get0_name(evp_cipher);
if (EVP_CIPHER_get_mode(evp_cipher) == EVP_CIPH_CCM_MODE) {
loopfunc = EVP_Update_loop_ccm;
} else if (aead && (EVP_CIPHER_get_flags(evp_cipher) &
EVP_CIPH_FLAG_AEAD_CIPHER)) {
loopfunc = EVP_Update_loop_aead;
mode_op = EVP_CIPHER_get_mode(evp_cipher);
if (aead) {
if (lengths == lengths_list) {
lengths = aead_lengths_list;
size_num = OSSL_NELEM(aead_lengths_list);
}
}
if (mode_op == EVP_CIPH_GCM_MODE
|| mode_op == EVP_CIPH_CCM_MODE
|| mode_op == EVP_CIPH_OCB_MODE
|| mode_op == EVP_CIPH_SIV_MODE
|| mode_op == EVP_CIPH_GCM_SIV_MODE) {
ae_mode = 1;
if (decrypt)
loopfunc = EVP_Update_loop_aead_dec;
else
loopfunc = EVP_Update_loop_aead_enc;
} else {
loopfunc = EVP_Update_loop;
}
for (testnum = 0; testnum < size_num; testnum++) {
print_message(names[D_EVP], lengths[testnum], seconds.sym);
@ -2843,38 +2977,145 @@ int speed_main(int argc, char **argv)
BIO_printf(bio_err, "\nEVP_CIPHER_CTX_new failure\n");
exit(1);
}
/*
* For AE modes, we must first encrypt the data to get
* a valid tag that enables us to decrypt. If we don't
* encrypt first, we won't have a valid tag that enables
* authenticity and hence decryption will fail.
*/
if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher, NULL,
NULL, iv, decrypt ? 0 : 1)) {
BIO_printf(bio_err, "\nEVP_CipherInit_ex failure\n");
NULL, NULL, ae_mode ? 1 : !decrypt)) {
BIO_printf(bio_err, "\nCouldn't init the context\n");
dofail();
exit(1);
}
/* Padding isn't needed */
EVP_CIPHER_CTX_set_padding(loopargs[k].ctx, 0);
keylen = EVP_CIPHER_CTX_get_key_length(loopargs[k].ctx);
loopargs[k].key = app_malloc(keylen, "evp_cipher key");
EVP_CIPHER_CTX_rand_key(loopargs[k].ctx, loopargs[k].key);
if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
loopargs[k].key, NULL, -1)) {
BIO_printf(bio_err, "\nEVP_CipherInit_ex failure\n");
dofail();
exit(1);
}
OPENSSL_clear_free(loopargs[k].key, keylen);
/* GCM-SIV/SIV mode only allows for a single Update operation */
if (EVP_CIPHER_get_mode(evp_cipher) == EVP_CIPH_SIV_MODE
|| EVP_CIPHER_get_mode(evp_cipher) == EVP_CIPH_GCM_SIV_MODE)
(void)EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
EVP_CTRL_SET_SPEED, 1, NULL);
if (!ae_mode) {
if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
loopargs[k].key, iv, -1)) {
BIO_printf(bio_err, "\nFailed to set the key\n");
dofail();
exit(1);
}
} else if (mode_op == EVP_CIPH_SIV_MODE
|| mode_op == EVP_CIPH_GCM_SIV_MODE) {
EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
EVP_CTRL_SET_SPEED, 1, NULL);
}
if (ae_mode && decrypt) {
/* Set length of iv (Doesn't apply to SIV mode) */
if (mode_op != EVP_CIPH_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
EVP_CTRL_AEAD_SET_IVLEN,
sizeof(aead_iv), NULL)) {
BIO_printf(bio_err, "\nFailed to set iv length\n");
dofail();
exit(1);
}
}
/* Set tag_len (Not for GCM/SIV at encryption stage) */
if (mode_op != EVP_CIPH_GCM_MODE
&& mode_op != EVP_CIPH_SIV_MODE
&& mode_op != EVP_CIPH_GCM_SIV_MODE) {
if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
EVP_CTRL_AEAD_SET_TAG,
TAG_LEN, NULL)) {
BIO_printf(bio_err,
"\nFailed to set tag length\n");
dofail();
exit(1);
}
}
if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
loopargs[k].key, aead_iv, -1)) {
BIO_printf(bio_err, "\nFailed to set the key\n");
dofail();
exit(1);
}
/* Set total length of input. Only required for CCM */
if (mode_op == EVP_CIPH_CCM_MODE) {
if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
&outlen, NULL,
lengths[testnum])) {
BIO_printf(bio_err,
"\nCouldn't set input text length\n");
dofail();
exit(1);
}
}
if (aead) {
if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
&outlen, aad, sizeof(aad))) {
BIO_printf(bio_err,
"\nCouldn't insert AAD when encrypting\n");
dofail();
exit(1);
}
}
if (!EVP_EncryptUpdate(loopargs[k].ctx, loopargs[k].buf,
&outlen, loopargs[k].buf,
lengths[testnum])) {
BIO_printf(bio_err,
"\nFailed to to encrypt the data\n");
dofail();
exit(1);
}
if (!EVP_EncryptFinal_ex(loopargs[k].ctx,
loopargs[k].buf, &outlen)) {
BIO_printf(bio_err,
"\nFailed finalize the encryption\n");
dofail();
exit(1);
}
if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx, EVP_CTRL_AEAD_GET_TAG,
TAG_LEN, &loopargs[k].tag)) {
BIO_printf(bio_err, "\nFailed to get the tag\n");
dofail();
exit(1);
}
EVP_CIPHER_CTX_free(loopargs[k].ctx);
loopargs[k].ctx = EVP_CIPHER_CTX_new();
if (loopargs[k].ctx == NULL) {
BIO_printf(bio_err,
"\nEVP_CIPHER_CTX_new failure\n");
exit(1);
}
if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher,
NULL, NULL, NULL, 0)) {
BIO_printf(bio_err,
"\nFailed initializing the context\n");
dofail();
exit(1);
}
EVP_CIPHER_CTX_set_padding(loopargs[k].ctx, 0);
/* GCM-SIV/SIV only allows for a single Update operation */
if (mode_op == EVP_CIPH_SIV_MODE
|| mode_op == EVP_CIPH_GCM_SIV_MODE)
EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
EVP_CTRL_SET_SPEED, 1, NULL);
}
}
Time_F(START);
count = run_benchmark(async_jobs, loopfunc, loopargs);
d = Time_F(STOP);
for (k = 0; k < loopargs_len; k++)
for (k = 0; k < loopargs_len; k++) {
OPENSSL_clear_free(loopargs[k].key, keylen);
EVP_CIPHER_CTX_free(loopargs[k].ctx);
}
print_result(D_EVP, testnum, count, d);
}
} else if (evp_md_name != NULL) {
@ -2893,6 +3134,7 @@ int speed_main(int argc, char **argv)
}
if (doit[D_EVP_CMAC]) {
size_t len = sizeof("cmac()") + strlen(evp_mac_ciphername);
OSSL_PARAM params[3];
EVP_CIPHER *cipher = NULL;
@ -2905,9 +3147,8 @@ int speed_main(int argc, char **argv)
BIO_printf(bio_err, "\nRequested CMAC cipher with unsupported key length.\n");
goto end;
}
evp_cmac_name = app_malloc(sizeof("cmac()")
+ strlen(evp_mac_ciphername), "CMAC name");
sprintf(evp_cmac_name, "cmac(%s)", evp_mac_ciphername);
evp_cmac_name = app_malloc(len, "CMAC name");
BIO_snprintf(evp_cmac_name, len, "cmac(%s)", evp_mac_ciphername);
names[D_EVP_CMAC] = evp_cmac_name;
params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_CIPHER,
@ -2992,7 +3233,7 @@ int speed_main(int argc, char **argv)
&& EVP_PKEY_CTX_set_rsa_keygen_bits(genctx, rsa_keys[testnum].bits) > 0
&& EVP_PKEY_CTX_set1_rsa_keygen_pubexp(genctx, bn) > 0
&& EVP_PKEY_CTX_set_rsa_keygen_primes(genctx, primes) > 0
&& EVP_PKEY_keygen(genctx, &rsa_key);
&& EVP_PKEY_keygen(genctx, &rsa_key) > 0;
BN_free(bn);
bn = NULL;
EVP_PKEY_CTX_free(genctx);
@ -4852,7 +5093,6 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
print_message(alg_name, mblengths[j], seconds->sym);
Time_F(START);
for (count = 0; run && COND(count); count++) {
unsigned char aad[EVP_AEAD_TLS1_AAD_LEN];
EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM mb_param;
size_t len = mblengths[j];
int packlen;

22
apps/storeutl.c
View file

@ -18,9 +18,11 @@
static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
int expected, int criterion, OSSL_STORE_SEARCH *search,
int text, int noout, int recursive, int indent, BIO *out,
int text, int noout, int recursive, int indent, const char *outfile,
const char *prog, OSSL_LIB_CTX *libctx);
static BIO *out = NULL;
typedef enum OPTION_choice {
OPT_COMMON,
OPT_ENGINE, OPT_OUT, OPT_PASSIN,
@ -71,7 +73,6 @@ int storeutl_main(int argc, char *argv[])
{
int ret = 1, noout = 0, text = 0, recursive = 0;
char *outfile = NULL, *passin = NULL, *passinarg = NULL;
BIO *out = NULL;
ENGINE *e = NULL;
OPTION_CHOICE o;
char *prog;
@ -311,13 +312,9 @@ int storeutl_main(int argc, char *argv[])
pw_cb_data.password = passin;
pw_cb_data.prompt_info = argv[0];
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
ret = process(argv[0], get_ui_method(), &pw_cb_data,
expected, criterion, search,
text, noout, recursive, 0, out, prog, libctx);
text, noout, recursive, 0, outfile, prog, libctx);
end:
EVP_MD_free(digest);
@ -348,7 +345,7 @@ static int indent_printf(int indent, BIO *bio, const char *format, ...)
static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
int expected, int criterion, OSSL_STORE_SEARCH *search,
int text, int noout, int recursive, int indent, BIO *out,
int text, int noout, int recursive, int indent, const char *outfile,
const char *prog, OSSL_LIB_CTX *libctx)
{
OSSL_STORE_CTX *store_ctx = NULL;
@ -427,6 +424,13 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
indent_printf(indent, bio_out, "%d: %s\n", items, infostr);
}
if (out == NULL) {
if ((out = bio_open_default(outfile, 'w', FORMAT_TEXT)) == NULL) {
ret++;
goto end2;
}
}
/*
* Unfortunately, PEM_X509_INFO_write_bio() is sorely lacking in
* functionality, so we must figure out how exactly to write things
@ -438,7 +442,7 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
const char *suburi = OSSL_STORE_INFO_get0_NAME(info);
ret += process(suburi, uimeth, uidata,
expected, criterion, search,
text, noout, recursive, indent + 2, out, prog,
text, noout, recursive, indent + 2, outfile, prog,
libctx);
}
break;

4
apps/ts.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -1017,7 +1017,7 @@ static X509_STORE *create_cert_store(const char *CApath, const char *CAfile,
BIO_printf(bio_err, "memory allocation failure\n");
goto err;
}
if (X509_LOOKUP_load_store_ex(lookup, CAstore, libctx, propq) <= 0) {
if (X509_LOOKUP_add_store_ex(lookup, CAstore, libctx, propq) <= 0) {
BIO_printf(bio_err, "Error loading store URI %s\n", CAstore);
goto err;
}

21
apps/version.c
View file

@ -56,7 +56,6 @@ int version_main(int argc, char **argv)
#endif
char *prog;
OPTION_CHOICE o;
const char *tmp;
prog = opt_init(argc, argv, version_options);
while ((o = opt_next()) != OPT_EOF) {
@ -134,18 +133,12 @@ opthelp:
}
if (cflags)
printf("%s\n", OpenSSL_version(OPENSSL_CFLAGS));
if (dir) {
tmp = OpenSSL_version(OPENSSL_DIR);
printf("OPENSSLDIR: %s\n", tmp == NULL ? "Undefined" : tmp);
}
if (engdir) {
tmp = OpenSSL_version(OPENSSL_ENGINES_DIR);
printf("ENGINESDIR: %s\n", tmp == NULL ? "Undefined" : tmp);
}
if (moddir) {
tmp = OpenSSL_version(OPENSSL_MODULES_DIR);
printf("MODULESDIR: %s\n", tmp == NULL ? "Undefined" : tmp);
}
if (dir)
printf("%s\n", OpenSSL_version(OPENSSL_DIR));
if (engdir)
printf("%s\n", OpenSSL_version(OPENSSL_ENGINES_DIR));
if (moddir)
printf("%s\n", OpenSSL_version(OPENSSL_MODULES_DIR));
if (seed) {
const char *src = OPENSSL_info(OPENSSL_INFO_SEED_SOURCE);
printf("Seeding source: %s\n", src ? src : "N/A");
@ -154,7 +147,7 @@ opthelp:
printf("%s\n", OpenSSL_version(OPENSSL_CPU_INFO));
#if defined(_WIN32)
if (windows)
printf("OSSL_WINCTX: %s\n", OpenSSL_version(OPENSSL_WINCTX));
printf("%s\n", OpenSSL_version(OPENSSL_WINCTX));
#endif
ret = 0;
end:

8
apps/x509.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -453,7 +453,8 @@ int x509_main(int argc, char **argv)
prog, opt_arg());
goto opthelp;
}
sk_ASN1_OBJECT_push(trust, objtmp);
if (!sk_ASN1_OBJECT_push(trust, objtmp))
goto end;
trustout = 1;
break;
case OPT_ADDREJECT:
@ -464,7 +465,8 @@ int x509_main(int argc, char **argv)
prog, opt_arg());
goto opthelp;
}
sk_ASN1_OBJECT_push(reject, objtmp);
if (!sk_ASN1_OBJECT_push(trust, objtmp))
goto end;
trustout = 1;
break;
case OPT_SETALIAS:

4
configdata.pm.in
View file

@ -145,7 +145,7 @@ _____
# defined in one template stick around for the
# next, making them combinable
PACKAGE => 'OpenSSL::safe')
or die $Text::Template::ERROR;
or die $OpenSSL::Template::ERROR;
close BUILDFILE;
rename("$buildfile.new", $buildfile)
or die "Trying to rename $buildfile.new to $buildfile: $!";
@ -167,7 +167,7 @@ _____
# defined in one template stick around for the
# next, making them combinable
PACKAGE => 'OpenSSL::safe')
or die $Text::Template::ERROR;
or die $OpenSSL::Template::ERROR;
close CONFIGURATION_H;
# When using stat() on Windows, we can get it to perform better by

2872
crypto/aes/asm/aesni-xts-avx512.pl Normal file
View file

File diff suppressed because it is too large Load diff

20
crypto/aes/asm/aesv8-armx.pl
View file

@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2014-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -106,13 +106,21 @@ my ($zero,$rcon,$mask,$in0,$in1,$tmp,$key)=
$flavour=~/64/? map("q$_",(0..6)) : map("q$_",(0..3,8..10));
#
# This file generates .s file for 64-bit and 32-bit CPUs.
# We don't implement .rodata on 32-bit CPUs yet.
#
$code.=".rodata\n" if ($flavour =~ /64/);
$code.=<<___;
.align 5
.Lrcon:
.long 0x01,0x01,0x01,0x01
.long 0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d // rotate-n-splat
.long 0x1b,0x1b,0x1b,0x1b
___
$code.=".previous\n" if ($flavour =~ /64/);
$code.=<<___;
.globl ${prefix}_set_encrypt_key
.type ${prefix}_set_encrypt_key,%function
.align 5
@ -139,7 +147,15 @@ $code.=<<___;
tst $bits,#0x3f
b.ne .Lenc_key_abort
___
$code.=<<___ if ($flavour =~ /64/);
adrp $ptr,.Lrcon
add $ptr,$ptr,:lo12:.Lrcon
___
$code.=<<___ if ($flavour =~ /32/);
adr $ptr,.Lrcon
___
$code.=<<___;
cmp $bits,#192
veor $zero,$zero,$zero
@ -2493,7 +2509,7 @@ ${prefix}_ctr32_encrypt_blocks_unroll12_eor3:
ldp d8,d9,[sp, #16]
ldp d10,d11,[sp, #32]
ldp d12,d13,[sp, #48]
ldp d15,d16,[sp, #64]
ldp d14,d15,[sp, #64]
ldr x29,[sp],#80
ret
.size ${prefix}_ctr32_encrypt_blocks_unroll12_eor3,.-${prefix}_ctr32_encrypt_blocks_unroll12_eor3

28
crypto/aes/asm/bsaes-armv8.pl
View file

@ -1,5 +1,5 @@
#!/usr/bin/env perl
# Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -32,7 +32,7 @@ sub data
}
__END__
// Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
// Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
//
// Licensed under the OpenSSL license (the "License"). You may not use
// this file except in compliance with the License. You can obtain a copy
@ -78,7 +78,8 @@ __END__
// other SIMD registers corrupted
_bsaes_decrypt8:
ldr q8, [x9], #16
adr x11, .LM0ISR
adrp x11, .LM0ISR
add x11, x11, #:lo12:.LM0ISR
movi v9.16b, #0x55
ldr q10, [x11], #16
movi v16.16b, #0x33
@ -494,9 +495,10 @@ _bsaes_decrypt8:
ret
.size _bsaes_decrypt8,.-_bsaes_decrypt8
.type _bsaes_const,%object
.rodata
.type _bsaes_consts,%object
.align 6
_bsaes_const:
_bsaes_consts:
// InvShiftRows constants
// Used in _bsaes_decrypt8, which assumes contiguity
// .LM0ISR used with round 0 key
@ -532,7 +534,9 @@ _bsaes_const:
.quad 0x090d01050c000408, 0x03070b0f060a0e02
.align 6
.size _bsaes_const,.-_bsaes_const
.size _bsaes_consts,.-_bsaes_consts
.previous
.type _bsaes_encrypt8,%function
.align 4
@ -548,7 +552,8 @@ _bsaes_const:
// other SIMD registers corrupted
_bsaes_encrypt8:
ldr q8, [x9], #16
adr x11, .LM0SR
adrp x11, .LM0SR
add x11, x11, #:lo12:.LM0SR
ldr q9, [x11], #16
_bsaes_encrypt8_alt:
eor v0.16b, v0.16b, v8.16b
@ -952,9 +957,11 @@ _bsaes_encrypt8_alt:
// other SIMD registers corrupted
_bsaes_key_convert:
#ifdef __AARCH64EL__
adr x11, .LM0_littleendian
adrp x11, .LM0_littleendian
add x11, x11, #:lo12:.LM0_littleendian
#else
adr x11, .LM0_bigendian
adrp x11, .LM0_bigendian
add x11, x11, #:lo12:.LM0_bigendian
#endif
ldr q0, [x9], #16 // load round 0 key
ldr q1, [x11] // .LM0
@ -998,7 +1005,8 @@ _bsaes_key_convert:
// don't save last round key
#ifdef __AARCH64EL__
rev32 v15.16b, v15.16b
adr x11, .LM0_bigendian
adrp x11, .LM0_bigendian
add x11, x11, #:lo12:.LM0_bigendian
#endif
ret
.size _bsaes_key_convert,.-_bsaes_key_convert

55
crypto/aes/asm/vpaes-armv8.pl
View file

@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -55,7 +55,7 @@ open OUT,"| \"$^X\" $xlate $flavour \"$output\""
$code.=<<___;
#include "arm_arch.h"
.text
.rodata
.type _vpaes_consts,%object
.align 7 // totally strategic alignment
@ -146,6 +146,9 @@ _vpaes_consts:
.asciz "Vector Permutation AES for ARMv8, Mike Hamburg (Stanford University)"
.size _vpaes_consts,.-_vpaes_consts
.align 6
.text
___
{
@ -165,7 +168,8 @@ $code.=<<___;
.type _vpaes_encrypt_preheat,%function
.align 4
_vpaes_encrypt_preheat:
adr x10, .Lk_inv
adrp x10, .Lk_inv
add x10, x10, :lo12:.Lk_inv
movi v17.16b, #0x0f
ld1 {v18.2d-v19.2d}, [x10],#32 // .Lk_inv
ld1 {v20.2d-v23.2d}, [x10],#64 // .Lk_ipt, .Lk_sbo
@ -193,7 +197,8 @@ _vpaes_encrypt_preheat:
_vpaes_encrypt_core:
mov x9, $key
ldr w8, [$key,#240] // pull rounds
adr x11, .Lk_mc_forward+16
adrp x11, .Lk_mc_forward+16
add x11, x11, :lo12:.Lk_mc_forward+16
// vmovdqa .Lk_ipt(%rip), %xmm2 # iptlo
ld1 {v16.2d}, [x9], #16 // vmovdqu (%r9), %xmm5 # round0 key
and v1.16b, v7.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1
@ -280,7 +285,8 @@ vpaes_encrypt:
_vpaes_encrypt_2x:
mov x9, $key
ldr w8, [$key,#240] // pull rounds
adr x11, .Lk_mc_forward+16
adrp x11, .Lk_mc_forward+16
add x11, x11, :lo12:.Lk_mc_forward+16
// vmovdqa .Lk_ipt(%rip), %xmm2 # iptlo
ld1 {v16.2d}, [x9], #16 // vmovdqu (%r9), %xmm5 # round0 key
and v1.16b, v14.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1
@ -383,9 +389,11 @@ _vpaes_encrypt_2x:
.type _vpaes_decrypt_preheat,%function
.align 4
_vpaes_decrypt_preheat:
adr x10, .Lk_inv
adrp x10, .Lk_inv
add x10, x10, :lo12:.Lk_inv
movi v17.16b, #0x0f
adr x11, .Lk_dipt
adrp x11, .Lk_dipt
add x11, x11, :lo12:.Lk_dipt
ld1 {v18.2d-v19.2d}, [x10],#32 // .Lk_inv
ld1 {v20.2d-v23.2d}, [x11],#64 // .Lk_dipt, .Lk_dsbo
ld1 {v24.2d-v27.2d}, [x11],#64 // .Lk_dsb9, .Lk_dsbd
@ -407,10 +415,12 @@ _vpaes_decrypt_core:
// vmovdqa .Lk_dipt(%rip), %xmm2 # iptlo
lsl x11, x8, #4 // mov %rax, %r11; shl \$4, %r11
eor x11, x11, #0x30 // xor \$0x30, %r11
adr x10, .Lk_sr
adrp x10, .Lk_sr
add x10, x10, :lo12:.Lk_sr
and x11, x11, #0x30 // and \$0x30, %r11
add x11, x11, x10
adr x10, .Lk_mc_forward+48
adrp x10, .Lk_mc_forward+48
add x10, x10, :lo12:.Lk_mc_forward+48
ld1 {v16.2d}, [x9],#16 // vmovdqu (%r9), %xmm4 # round0 key
and v1.16b, v7.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1
@ -518,10 +528,12 @@ _vpaes_decrypt_2x:
// vmovdqa .Lk_dipt(%rip), %xmm2 # iptlo
lsl x11, x8, #4 // mov %rax, %r11; shl \$4, %r11
eor x11, x11, #0x30 // xor \$0x30, %r11
adr x10, .Lk_sr
adrp x10, .Lk_sr
add x10, x10, :lo12:.Lk_sr
and x11, x11, #0x30 // and \$0x30, %r11
add x11, x11, x10
adr x10, .Lk_mc_forward+48
adrp x10, .Lk_mc_forward+48
add x10, x10, :lo12:.Lk_mc_forward+48
ld1 {v16.2d}, [x9],#16 // vmovdqu (%r9), %xmm4 # round0 key
and v1.16b, v14.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1
@ -657,14 +669,18 @@ $code.=<<___;
.type _vpaes_key_preheat,%function
.align 4
_vpaes_key_preheat:
adr x10, .Lk_inv
adrp x10, .Lk_inv
add x10, x10, :lo12:.Lk_inv
movi v16.16b, #0x5b // .Lk_s63
adr x11, .Lk_sb1
adrp x11, .Lk_sb1
add x11, x11, :lo12:.Lk_sb1
movi v17.16b, #0x0f // .Lk_s0F
ld1 {v18.2d-v21.2d}, [x10] // .Lk_inv, .Lk_ipt
adr x10, .Lk_dksd
adrp x10, .Lk_dksd
add x10, x10, :lo12:.Lk_dksd
ld1 {v22.2d-v23.2d}, [x11] // .Lk_sb1
adr x11, .Lk_mc_forward
adrp x11, .Lk_mc_forward
add x11, x11, :lo12:.Lk_mc_forward
ld1 {v24.2d-v27.2d}, [x10],#64 // .Lk_dksd, .Lk_dksb
ld1 {v28.2d-v31.2d}, [x10],#64 // .Lk_dkse, .Lk_dks9
ld1 {v8.2d}, [x10] // .Lk_rcon
@ -688,7 +704,8 @@ _vpaes_schedule_core:
bl _vpaes_schedule_transform
mov v7.16b, v0.16b // vmovdqa %xmm0, %xmm7
adr x10, .Lk_sr // lea .Lk_sr(%rip),%r10
adrp x10, .Lk_sr // lea .Lk_sr(%rip),%r10
add x10, x10, :lo12:.Lk_sr
add x8, x8, x10
cbnz $dir, .Lschedule_am_decrypting
@ -814,12 +831,14 @@ _vpaes_schedule_core:
.align 4
.Lschedule_mangle_last:
// schedule last round key from xmm0
adr x11, .Lk_deskew // lea .Lk_deskew(%rip),%r11 # prepare to deskew
adrp x11, .Lk_deskew // lea .Lk_deskew(%rip),%r11 # prepare to deskew
add x11, x11, :lo12:.Lk_deskew
cbnz $dir, .Lschedule_mangle_last_dec
// encrypting
ld1 {v1.2d}, [x8] // vmovdqa (%r8,%r10),%xmm1
adr x11, .Lk_opt // lea .Lk_opt(%rip), %r11 # prepare to output transform
adrp x11, .Lk_opt // lea .Lk_opt(%rip), %r11 # prepare to output transform
add x11, x11, :lo12:.Lk_opt
add $out, $out, #32 // add \$32, %rdx
tbl v0.16b, {v0.16b}, v1.16b // vpshufb %xmm1, %xmm0, %xmm0 # output permute

8
crypto/aes/asm/vpaes-loongarch64.pl
View file

@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -29,9 +29,9 @@
($vr0,$vr1,$vr2,$vr3,$vr4,$vr5,$vr6,$vr7,$vr8,$vr9,$vr10,$vr11,$vr12,$vr13,$vr14,$vr15,$vr16,$vr17,$vr18,$vr19)=map("\$vr$_",(0..19));
($fp)=map("\$r$_",(22));
for (@ARGV) { $output=$_ if (/\w[\w\-]*\.\w+$/); }
open STDOUT,">$output";
while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
# $output is the last argument if it looks like a file (it has an extension)
my $output;
$output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
open STDOUT,">$output";
$PREFIX="vpaes";

5
crypto/aes/build.info
View file

@ -9,7 +9,8 @@ IF[{- !$disabled{asm} -}]
$AESASM_x86_64=\
aes-x86_64.s vpaes-x86_64.s bsaes-x86_64.s aesni-x86_64.s \
aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s
aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s \
aesni-xts-avx512.s
$AESDEF_x86_64=AES_ASM VPAES_ASM BSAES_ASM
$AESASM_ia64=aes_core.c aes_cbc.c aes-ia64.s
@ -145,6 +146,8 @@ INCLUDE[bsaes-armv7.o]=..
GENERATE[aes-s390x.S]=asm/aes-s390x.pl
INCLUDE[aes-s390x.o]=..
GENERATE[aesni-xts-avx512.s]=asm/aesni-xts-avx512.pl
GENERATE[aes-c64xplus.S]=asm/aes-c64xplus.pl
GENERATE[vpaes-loongarch64.S]=asm/vpaes-loongarch64.pl

3
crypto/armcap.c
View file

@ -300,7 +300,8 @@ void OPENSSL_cpuid_setup(void)
if ((sysctlbyname("machdep.cpu.brand_string", uarch, &len, NULL, 0) == 0) &&
((strncmp(uarch, "Apple M1", 8) == 0) ||
(strncmp(uarch, "Apple M2", 8) == 0) ||
(strncmp(uarch, "Apple M3", 8) == 0))) {
(strncmp(uarch, "Apple M3", 8) == 0) ||
(strncmp(uarch, "Apple M4", 8) == 0))) {
OPENSSL_armcap_P |= ARMV8_UNROLL8_EOR3;
OPENSSL_armcap_P |= ARMV8_HAVE_SHA3_AND_WORTH_USING;
}

1
crypto/armv4cpuid.pl
View file

@ -293,6 +293,7 @@ atomic_add_spinlock:
#endif
.extern OPENSSL_armcap_P
.hidden OPENSSL_armcap_P
___
print $code;

Some files were not shown because too many files have changed in this diff Show more