2234 Commits

Author	SHA1	Message	Date
Norbert Pocs	871182d29d	Document SSL_CTX_set_min_proto_version defaults ... If the function is not called the settings default to 0. Fixes #10584 Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27410)	2025-04-18 15:43:44 +01:00
Dr. David von Oheimb	b13b8eb95e	ASN1_item_sign.pod: fix description of the algor1, algor2, and signature in/out-parameters ... This provides a fix for the documentation part of #22932. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27372)	2025-04-18 15:38:41 +01:00
Nicolas Blais-Miko	a0ff819e53	Fix silent error in EVP_CIPHER_CTX_get_updated_iv. ... Added new params API function OSSL_PARAM_set_octet_string_or_ptr to only call the correct setter for OSSL_CIPHER_PARAM_IV and OSSL_CIPHER_PARAM_UPDATED_IV. Both OSSL_PARAM_set_octet_string and OSSL_PARAM_set_octet_ptr could be called with only one expected to succeed. This would put a silent error on the error stack when calling EVP_CIPHER_CTX_get_updated_iv. Fixes #27117 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27120)	2025-04-16 08:44:12 +01:00
David Benjamin	4f81470afa	Fix PKCS7_sign and CMS_sign default hash documentation ... Fixes #27291. See issue for details. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27292)	2025-04-15 15:39:59 +01:00
jsondevers	51d194483e	added deprecated note to OPENSSL_instrument_bus docs ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27288)	2025-04-15 15:32:21 +01:00
Tim Perry	03541d7302	Add SSL_CTX_set_ec_point_formats() and SSL_set_ec_point_formats() ... The internal fields and implementation for configuration of this parameter already existed, but was not exposed. This change adds simple setters to allow configuration of this field. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26990)	2025-04-14 14:56:40 +01:00
Matt Caswell	6d8e516e08	Document the state of the object you get from SSL_accept_connection() ... The object may or may not have completed its handshake. See also: https://github.com/openssl/openssl/pull/27239#issuecomment-2772148408 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27283)	2025-04-14 08:52:18 +01:00
Viktor Dukhovni	8d2e4d6d8c	Implement i2d_PKCS8PrivateKey ... Added `i2d_PKCS8PrivateKey(3)` API to complement `i2d_PrivateKey(3)`, the former always outputs PKCS#8. Extended endecoder_test.c to check that `i2d_PKCS8PrivateKey()` produces the expected PKCS#8 output. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27309)	2025-04-11 11:00:27 +01:00
Matt Caswell	9eb21877f5	Link SSL_get_negotiated_group() and SSL_get0_group_name() in the docs ... If you are intereseted in one you might be interested in the other. Fixes #27137 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27210)	2025-04-02 08:47:23 +02:00
Kyle Mullen	b7d3c729b1	Update X509_VERIFY_PARAM_set_flags.pod ... Change description of B<X509_V_FLAG_CRL_CHECK_ALL> to reflect its inability to function without B<X509_V_FLAG_CRL_CHECK> being enabled as well. Fixes #27056 (https://github.com/openssl/openssl/issues/27056) CLA: trivial Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27098)	2025-03-27 10:30:40 +01:00
Frederik Wedel-Heinen	21b170df9f	Adds the concept of thunks to OPENSSL_sk interface ... This allows applications to call functions of correct signature when free'ing OPENSSL_sk items which UBSan complains about. Related to #22896. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27071)	2025-03-24 15:28:34 +01:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Viktor Dukhovni	91c6e157c6	Make group names case-insensitive ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26991)	2025-03-09 23:31:25 +01:00
RSA-1977	8d6fd6142b	Updated SSL_SESSION_get0_hostname() documentation to be consistent with the function ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26559)	2025-03-05 19:12:45 +01:00
Andrew Dinh	b48145cd18	QUIC server post-rebase nits ... - Apply doc nits suggested by Viktor from https://github.com/openssl/openssl/pull/26762 - Update CHANGES.md & NEWS.md saying there is now support for QUIC server - Added copyright header in: test/radix/quic_ops.c Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26944)	2025-03-05 15:02:17 +01:00
Dr. David von Oheimb	1d3da367ab	minor doc fixes for CMP and HTTP ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26924)	2025-03-04 13:58:37 +01:00
Andrew Dinh	2240da83f9	SSL_CTX_set1_curves.pod: Move examples to own section ... Also specify whether server or client preference Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26897)	2025-03-03 09:37:59 +01:00
Andrew Dinh	493e067f90	doc: Add some clarifications for SSL_CTX_set1_curves() ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26897)	2025-03-03 09:37:44 +01:00
Valerii Krygin	f86acc9434	EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677) ... EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions. To achieve this: - Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them. - Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour. - Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`. - Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation. - Add the HISTORY section to EVP_EncodeInit documentation to describe the fix. Other changes: - Update AUTHORS.md - Update the copyright date in the documentation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26678)	2025-02-27 17:38:57 +00:00
Dr. David von Oheimb	253a380bdb	doc/, CHANGES, NEWS: add missing entries and fix existing ones when which CMP feature was added ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26908)	2025-02-27 16:58:47 +01:00
Dmitry Belyavskiy	17bbc16383	EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26832)	2025-02-21 17:58:41 +01:00
Cheng Zhang	db2c54cc92	Added new API to enable 0-RTT for 3rd party QUIC stacks. ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26842)	2025-02-21 12:01:30 +01:00
Viktor Dukhovni	ff20db213d	Typo fix ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26813)	2025-02-20 09:50:53 +11:00
Dr. David von Oheimb	5cba362909	OSSL_CMP_MSG_http_perform(): support using BIO from OSSL_CMP_CTX_set_transfer_cb_arg() ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26628)	2025-02-18 12:19:26 +01:00
slontis	6de411963f	Add SLH-DSA documentation ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:16:04 +01:00
Viktor Dukhovni	d5a4665a21	Case-insensitive sigalgs ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26767)	2025-02-18 14:24:57 +11:00
Neil Horman	3f06ebcfe3	Eliminate SSL_LISTENER_FLAG_NO_ACCEPT flag in QUIC ... We've not implemented it yet, and don't need it for MVP, so move the TODO's to QUIC FUTURE and remove the docs for it. Fixes openssl/project#1074 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26593)	2025-02-17 11:27:34 -05:00
Neil Horman	9d6e5a69db	Remove NEW_TOKEN public api ... @sashan and I were discussing the usefulness of the public facing api for NEW_TOKEN support, and he has concerns over its usefulness and our being stuck with it if we need to make changes later. Given that it is a convience api for using multiple CTX-es to share a cache, its fine if we remove it for now, as that seems like a less common use case. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	e732f4456a	Remove SSL_TOKEN_STORE_HANDLE type ... Replace it with SSL_TOKEN_STORE and make the structure opaque in the public api Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	e521131c60	Rename token_store functions to make them consistent ... we use get0 to get a token store, but set to set it. Since the latter takes a refcount, change that to set1. Also rename the interal quic functions to match. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	3649a47f82	Add docs for token store manipulation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	b33851eb72	Update doc/man3/SSL_new_stream.pod ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26527)	2025-02-17 11:27:33 -05:00
Neil Horman	17dc32c51b	quic-hq-interop: Allow for retries if we've reached our max stream limit ... Several servers defer the sending of max stream frames. For instance quic-go uses a go-routine to do the sending after sufficient existing streams have finished, while mvfst seems to wait for all outstanding streams to be closed before issuing a new batch. This result in the client, if all streams are in use, getting a transient NULL return from SSL_new_stream(). Check for the stream limit being reached and allow a number of retries before giving up to give the server a chance to issue us more streams. Also dead-reckon the batch count of streams we use in parallel to be 1/4 of our total number of available streams (generally hard coded to 100 for most servers) to avoid using all our streams at once. It would be really nice to have an api to expose our negotiated transport parameters so that the application can know what this limit is, but until then we have to just guess. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26527)	2025-02-17 11:27:33 -05:00
Neil Horman	f60a96a2b4	Fix more typos ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	3e124f4bdd	Fix some typos ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	9c189782c9	update docs with reference to SSL_set_ex_data ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	56b6ab094e	Attempt to use NULL listeners to avoid use after free ... As per @sashan suggestion, try pre-creating user ssls with a NULL listener Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	ddfd561f3c	Update man page to note limitations of callbacks for QUIC ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	7502df20bc	rename new_pending_ssl to new_pending_conn ... Make it clear its only announcing connections, not streams Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	016ddac4da	Add docs for new callback registration ... Add docs for SSL_CTX_set_new_pending_ssl_cb Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	b441d20a2f	Add a warning that disabling server validation is not recommended ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26114)	2025-02-17 11:27:33 -05:00
Neil Horman	f443b4048d	Clarify that this validation only relates to retry packets ... Disabling server address validation here only relates to new connections that arrive without a token. Future connections using tokens provided by the server via NEW_TOKEN frames will still be validated Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26114)	2025-02-17 11:27:33 -05:00
Neil Horman	60762be09b	Add a public flag to disable address validation on listeners ... Now that we have the infrastructure to skip address validation, add a public flag to SSL_new_listener and SSL_new_listener_from to allow the skipping of address validation on selected quic listener SSL objects Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26114)	2025-02-17 11:27:33 -05:00
Matt Caswell	6d1646c66e	Add documentation for BIO_dgram_set0_local_addr() ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26066)	2025-02-17 11:27:33 -05:00
Tomas Mraz	84dbca4df0	QUIC: Immediate-Mode Polling various fixups ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25416)	2025-02-17 11:27:33 -05:00
Hugo Landau	b20f557021	QUIC: Update SSL_poll documentation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25416)	2025-02-17 11:27:33 -05:00
Alexandr Nedvedicky	73d7de128b	QUIC Concurrency API: Various minor fixes ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Hugo Landau	89fa427504	Doc fixes ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Hugo Landau	c4d516db6a	QUIC: Update listener documentation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Hugo Landau	3896bff051	QUIC: Add documentation on concurrency model ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00