4.0.0-alpha1 release commits#3

Closed

openssl-machine wants to merge 2351 commits intomasterfrom

staging-openssl-4.0-2026-03-10

This pull request is big! We're only showing the most recent 250 commits

Commits on Feb 20, 2026

ech_ssl_apis.c: Check some invalid argument passing

t8m
authored and
mattcaswell
committed
ech_store.c: Fix casts and avoid leaks on error return

t8m
authored and
mattcaswell
committed
Fix a client-auth bug introduced by ECH code

sftcd
authored and
mattcaswell
committed
s_client and s_server options for ECH

sftcd
authored and
mattcaswell
committed
ECH: Properly apply libctx and propq from SSL_CTX

t8m
authored and
mattcaswell
committed
ech_read_priv_echconfiglist(): Pass encodedlen to BIO_new_mem_buf()

sftcd
authored and
mattcaswell
committed
Document that SSL_OP_ECH_TRIALDECRYPT can cause DoS in some circumstances

sftcd
authored and
mattcaswell
committed
ssl_choose_server_version(): With ECH check if connection is TLSv1.3

sftcd
authored and
mattcaswell
committed
ech_test.c: Add test for trying ECH with TLSv1.2

sftcd
authored and
mattcaswell
committed
tls_process_server_hello(): With retry config validate the outer hostname

sftcd
authored and
mattcaswell
committed
ossl_ech_get_retry_configs(): Check for integer overflow

sftcd
authored and
mattcaswell
committed
Add tests and documentation and fix a couple of issues identified by added tests

sftcd
authored and
mattcaswell
committed
ech_check_format(): Fix potential out of bounds read

sftcd
authored and
mattcaswell
committed
ECH: avoid pointer aliasing in tls_construct_ctos_psk()

sftcd
authored and
mattcaswell
committed
ECH: change from I-D to RFC 9849 and resolve TODO(ECH) cases

sftcd
authored and
mattcaswell
committed
ECH: Use BIO_puts when appropriate

t8m
authored and
mattcaswell
committed
ECH: Remove whitespace at EOL or EOF

t8m
authored and
mattcaswell
committed
require manual build for external ECH tests

sftcd
authored and
mattcaswell
committed
Removing some more EVP_get_smtbysmth calls
beldmit
committed
Constify X509_REQ_get1_email, X509_get1_email and X509_get1_ocsp.

mbroz
authored and
nhorman
committed
Constify X509_print_fp and X509_print_ex_fp
nhorman
committed

Commits on Feb 21, 2026

New decoder generator returns matched field count
Viktor Dukhovni
committed
SM2 digest sign/verify context initialisation fix
Viktor Dukhovni
committed
Implement default SM2 distinguished identifier
Viktor Dukhovni
committed
New SM2 "tls-version" signature parameter
Viktor Dukhovni
committed
Pass tls-version to cert sign/verify algorithms
Viktor Dukhovni
committed
Use algorithm name macros instead of literals
Viktor Dukhovni
committed
Support for RFC8998 curveSM2 + hybrid
Viktor Dukhovni
committed
Document ECDH over SM2 key exchange.
Viktor Dukhovni
committed
Add curveSM2 and curveSM2MLKEM768 TLS test.

mbroz
authored and
Viktor Dukhovni
committed
New SSL tests for SM2 cert and key exchange
Viktor Dukhovni
committed
Refactor openssl-speed(1)
Viktor Dukhovni
committed
CHANGE log additions
Viktor Dukhovni
committed
X509V3_set_ctx(): Improve error handling using this function, mostly in apps/
DDvO
committed
X509V3_set_nconf(): Improve error handling using this function, mostly in apps/
DDvO
committed

Commits on Feb 22, 2026

Constify X509_chain_check_suiteb

bob-beck
authored and
nhorman
committed
Fix broken strict-warnings build in sskdf and x963kdf
nhorman
committed
Add a changes entry for the x509 time function changes

bob-beck
authored and
nhorman
committed
Return the correct error message in ossl_X509_print_ex_brief

bob-beck
authored and
nhorman
committed
Constify X509_CRL_get0_by_cert
nhorman
committed
Constify X509_CRL_get0_by_cert

Angel Yankov
authored and
nhorman
committed
Correct the instructions for how to run the krb5 external test.

bob-beck
authored and
nhorman
committed

Commits on Feb 23, 2026

cmp_ctx.c OSSL_CMP_CTX_new(): update and/or comment the default PBM parameters chosen
DDvO
committed
OSSL_CRMF_MSG_centralkeygen_requested(): change confusing paramter name 'p10cr' to 'p10'
DDvO
committed
Added BIO_set_send_flags() function to set flags passed to send(), sendto(), and sendmsg().

igus68
authored and
beldmit
committed
preserve data constness when getting issuer name's and subject's hash

dpronin
authored and
nhorman
committed
Fix the uses of X509_check_certificate_times

levitte
authored and
nhorman
committed
Constify various functions that were non const due to extension cache

bob-beck
authored and
nhorman
committed
Constify X509_STORE_add_cert()

bob-beck
authored and
nhorman
committed

Commits on Feb 24, 2026

Update documentation with guidelines for commit and PR messages
paulidale
committed
Added Nvidia/Olympus CPU dispatch to enable optimal SHA3/EOR3 on Vera CPU

izard
authored and
beldmit
committed
Constify X509_find_by_subject
nhorman
committed
Ensure we don't leak heap in ossl_rcu_lock_free
nhorman
committed
Let's support multiple names for certificate verification

bob-beck
authored and
nhorman
committed
Update crypto/x509/v3_utl.c

bob-beck
authored and
nhorman
committed
Update crypto/x509/v3_utl.c

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
derp

bob-beck
authored and
nhorman
committed
Mention ASCII vs Non ASCII localparts

bob-beck
authored and
nhorman
committed
Address Viktor's review around label checks

bob-beck
authored and
nhorman
committed
Ensure we use the correct '@' in an email and raise an error when we fail

bob-beck
authored and
nhorman
committed
Allow for a leading . for wildcard like matches

bob-beck
authored and
nhorman
committed
Add a test for using a leading . for verification of a domain name

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update crypto/x509/x509_vpm.c

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update crypto/x509/x509_vpm.c

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Fix up bug found by nhorman on review. Thanks!

bob-beck
authored and
nhorman
committed
Fix misplaced check spotted by vitkor

bob-beck
authored and
nhorman
committed
Add a changes entry

bob-beck
authored and
nhorman
committed
Update doc/man3/SSL_set1_host.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update ssl/ssl_lib.c

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update doc/man3/X509_VERIFY_PARAM_set_flags.pod

bob-beck
authored and
nhorman
committed
Update CHANGES.md

bob-beck
authored and
nhorman
committed
Update CHANGES.md

bob-beck
authored and
nhorman
committed
Update CHANGES.md

bob-beck
authored and
nhorman
committed
Update CHANGES.md

bob-beck
authored and
nhorman
committed
Correct rename of variable that went one bikeshed too far

bob-beck
authored and
nhorman
committed
Fix being hoist on my own petard by my kind Irish friend.

bob-beck
authored and
nhorman
committed
Revert "Update doc/man3/SSL_set1_host.pod"

bob-beck
authored and
nhorman
committed
Correct synopsis for SSL_set1_ipaddr

bob-beck
authored and
nhorman
committed
Correct man page args to be consistant

bob-beck
authored and
nhorman
committed
Add missing valgrind supressions
nhorman
committed
Fix a legitimate leak in v2i_issuer_sign_tool
nhorman
committed
Add a ci job to validate our suppression file is up to date nightly
nhorman
committed
Constify more X509 arguments and return values

bob-beck
authored and
nhorman
committed
Constify X509_get_ext() and friends..

bob-beck
authored and
nhorman
committed
Patch the kerbeos5 tests

bob-beck
authored and
nhorman
committed
Remove implicit truncation behaviour in ossl_i2c_ASN1_BIT_STRING

bob-beck
authored and
nhorman
committed
Constify X509_OBJECT_[get0|set1]_X509 and friends
nhorman
committed
Constify X509_check[host, email, ip, ip_asc]

bob-beck
authored and
nhorman
committed
Constify X509_get0_trust_*

bob-beck
authored and
nhorman
committed
Constify X509_get_signature_info

bob-beck
authored and
nhorman
committed
Constify X509_get_pubkey_parameters

bob-beck
authored and
nhorman
committed
Removes fixed version TLS methods.

fwh-dc
authored and
nhorman
committed

Commits on Feb 25, 2026

ech_test.c: Fix the test with disabled CHACHA20-POLY1305
t8m
committed
OSSL_HPKE_CTX_new.pod: Correct the valid AEAD names for HPKE
t8m
committed
Removes trailing whitespace from generated pkg-config .pc files

cbaudouinjr
authored and
t8m
committed
Constify X509_NAME

bob-beck
authored and
t8m
committed
Patch krb5 build in external tests

bob-beck
authored and
t8m
committed
Make ASN1_STRING opaque

bob-beck
authored and
t8m
committed
Update oqs-provider to current, which support opaque asn1 strings

bob-beck
authored and
t8m
committed
Skip the oqsprovider test temporarily because it is currently broken

bob-beck
authored and
t8m
committed
krb5 external test: Add patch to use accessors for ASN1_STRING

bob-beck
authored and
t8m
committed
Update rpki-client test to use current release instead of an old one

bob-beck
authored and
t8m
committed
Patch rpki-client-portable to handle bit string changes

bob-beck
authored and
t8m
committed
Patch the pkcs11 provider

bob-beck
authored and
t8m
committed
Constify X509_build_chain()

bob-beck
authored and
t8m
committed
Constify X509_STORE_CTX functions invoving X509 *

bob-beck
authored and
t8m
committed
Patch the krb5 build for X509_STORE_CTX constification

bob-beck
authored and
t8m
committed
doc: fix algorithm and key type names in EVP_PKEY-SLH-DSA

kovan
authored and
t8m
committed
Deprecate ASN1_OBJECT_new().

fwh-dc
authored and
t8m
committed
doc: enumerate and describe known reserved property names

levitte
authored and
t8m
committed
FIPS self tests: fix config options when -no-bulk is used

slontis
authored and
t8m
committed
Fix const qualifiers from strchr where discarded

heitbaum
authored and
t8m
committed
Fix group tuple handling in DEFAULT expansion
Viktor Dukhovni
committed
Add keyshare floating
Viktor Dukhovni
committed
Simplify and expand default group list
Viktor Dukhovni
committed
apps/ech.c: free the resources on option help printing

esyr
authored and
t8m
committed
apps/s_server.c: free ECH storage in ech_load_dir() on return

esyr
authored and
t8m
committed
apps/s_server.c: call OPENSSL_DIR_end after directory traversal in ech_load_dir

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: avoid superfluous extval check in ossl_ech_early_decrypt

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: check WPACKET_get_total_written in ossl_ech_send_grease

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: avoid memory leak in ossl_ech_get_retry_configs()

esyr
authored and
t8m
committed
ssl/ech/ech_store.c: check WPACKET_get_total_written return value

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: avoid truncating time_t value in ossl_ech_status_print

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: avoid NULL dereference in ossl_ech_get_ch_offsets

esyr
authored and
t8m
committed
ssl/ech/ech_internal.c: avoid memory leak on ech_decode_inbound_ech() error path

esyr
authored and
t8m
committed
ssl/ech/ech_store.c: avoid memory leak on error path in OSSL_ECHSTORE_new

esyr
authored and
t8m
committed
ssl/ech/ech_store.c: avoid uninitialised WPACKET use in OSSL_ECHSTORE_new_config

esyr
authored and
t8m
committed
ssl/ech/ech_store.c: avoid NULL dereference in ech_decode_one_entry()

esyr
authored and
t8m
committed
ssl/statem/extensions_clnt.c: superfluous NULL check in tls_construct_ctos_psk()

esyr
authored and
t8m
committed
ssl/statem/extensions_srvr.c: free empty rcfgs in tls_construct_stoc_ech()

esyr
authored and
t8m
committed
ssl/statem/statem_srvr.c: avoid WPACKET momory leak in tls_process_client_hello

esyr
authored and
t8m
committed
test/ech_corrupt_test.c: avoid memory leak in tls_corrupt_write()

esyr
authored and
t8m
committed
test/ech_test.c: avoid memory leaks in ech_api_basic_calls()

esyr
authored and
t8m
committed
evp_kem_init(): Fix copy paste bug when checking decapsulate_init

cuiweixie
authored and
t8m
committed
ssl/ech/ech_store.c: do not raise errors on allocation failures

esyr
authored and
t8m
committed
ssl/ech/ech_store.c: use OPENSSL_malloc_array() in ech_decode_one_entry()

esyr
authored and
t8m
committed
Improved reporting of shared and peer sigalgs

n13l
authored and
t8m
committed
test_sigalgs_available(): Add missing FALLTHROUGH annotation
t8m
committed
constify X509_find_by_issuer_and_serial
nhorman
committed
Remove dead code in ossl_ech_copy_inner2outer
nhorman
committed

Commits on Feb 26, 2026

Commits on Feb 27, 2026

ossl_x509v3_cache_extensions(): Fix regression of no-rfc3779 build
t8m
committed
Added LMS support for OpenSSL commandline signature verification using pkeyutl.

slontis
authored and
mattcaswell
committed
Added LMS SubjectPublicInfo related encoders and decoders.

slontis
authored and
mattcaswell
committed
Added additional TRACE information to Decoders.

slontis
authored and
mattcaswell
committed
Added HSS/LMS OID id-alg-hss-lms-hashsig

slontis
authored and
mattcaswell
committed
Describe X509 constification and ASN1_STRING changes

bob-beck
authored and
nhorman
committed
Add alternate ordering for ossl-guide-migration

bob-beck
authored and
nhorman
committed
CRL: Reject CRLs with malformed Issuing Distribution Point

n13l
authored and
nhorman
committed

Commits on Feb 28, 2026

Ensure TLS 1.3 ciphersuites are actually for TLS 1.3
Viktor Dukhovni
committed
Added -expected-rpks s_client/server option
Viktor Dukhovni
committed
Remove remnant SSL_FIPS flag

paulidale
authored and
beldmit
committed
Remove SSL_TXT_FIPS

paulidale
authored and
beldmit
committed
Add CHANGES entry noting the removal of the SSL_TXT_FIPS option

paulidale
authored and
beldmit
committed
Fixes Coverity issue CID 1681693

igus68
authored and
nhorman
committed
Add a note about commit message titles being 50-70 character in length

paulidale
authored and
nhorman
committed
Fallback implementation of tsan_add now returns value before addition to be consistent with other definitions

fwh-dc
authored and
nhorman
committed
Improved handling of AKID/SKID extensions in CSRs and certs
Viktor Dukhovni
committed
Replace built-in AKID/SKID with configs
Viktor Dukhovni
committed

Commits on Mar 1, 2026

Fix doc name of ML-DSA-MU
Viktor Dukhovni
committed
Fix return values on PKCS7_dataVerfiy
nhorman
committed
Document PKCS7_dataVerify
nhorman
committed
doc: document provider/library context cleanup order requirement

kovan
authored and
nhorman
committed

Commits on Mar 2, 2026

add check before releaseing retry-configs

sftcd
authored and
mattcaswell
committed
adds test of ECH fail then using retry configs

sftcd
authored and
mattcaswell
committed
SHAKE - Fix 390x CI problems for SLH-DSA

slontis
authored and
t8m
committed
copy_email() may leak memory when asked to move data

Sashan
authored and
nhorman
committed
Coverity complains X509_REQ_set_subject_name() return value

Sashan
authored and
nhorman
committed
Make the openssl-ciphers(1) manual page up to date

igus68
authored and
t8m
committed
Polish AKID/SKID handling and related docs

Viktor Dukhovni
authored and
nhorman
committed
ossl_lms_key_to_text(): Fix NULL pointer dereference of `key` argument

Sashan
authored and
t8m
committed
FIPS: Change EC_GROUP_check() so that it fails for explicit curves.

slontis
authored and
t8m
committed
Indicate EOF on fatal error in file or winstore
t8m
committed

Commits on Mar 3, 2026

fix implementation json naming in quic interop tests
nhorman
committed
Add support for dynamic key sizing in hashtable
nhorman
committed
Allow core_namemap to limit hashtable key sizes
nhorman
committed
Adds fixed version tls methods to ossl-removed-api.pod

fwh-dc
authored and
t8m
committed
doc/man7/ossl-removed-api.pod: mention OPENSSL_atexit in the NAME section

esyr
authored and
t8m
committed
openssl-verify.pod.in: Add clarification about the parameters order

igus68
authored and
t8m
committed
X509 returned by X509_REQ_to_X509() should not be (const ...)

Sashan
authored and
t8m
committed

Commits on Mar 4, 2026

Fix bad length computation in HT_COPY_RAW_KEY_CASE

nhorman
authored and
nikolapajkovsky
committed
SSL_get_shared_ciphers(): Return NUL-terminated buffer for no shared ciphers

fwh-dc
authored and
t8m
committed
ech test retry-configs unavailable if server finished corrupted

sftcd
authored and
mattcaswell
committed
Code Comment Correction

zl523856
authored and
t8m
committed
remove OPENSSL_USE_NODELETE from the config

bbolli
authored and
t8m
committed
remove OPENSSL_BUILDING_OPENSSL from the config

bbolli
authored and
t8m
committed
Make X509_up_ref and X509_free take const X509 *

bob-beck
authored and
t8m
committed
FIPS: Disable time/request based reseeding for ECDSA KAT DRBG

ssapalski
authored and
t8m
committed
ECH: Add back code needed for correct ECH backend confirmation

sftcd
authored and
t8m
committed
Adds missing definitions to deprecation.pod

fwh-dc
authored and
t8m
committed
CHANGES.md: Fix 'extention' and 'insenstive' typos

fwh-dc
authored and
t8m
committed
fips: Skip testing RFC 9579 good files as they use short salt & password

xnox
authored and
t8m
committed
fips: Align PKCS5_PBKDF2_HMAC defaults with EVP_KDF-PBKDF2

xnox
authored and
t8m
committed
Deuglify ML-KEM code after reformat

Viktor Dukhovni
authored and
t8m
committed

Commits on Mar 5, 2026

dane_match_cert() should X509_free() on ->mcert instead

Sashan
authored and
nhorman
committed
Ensure fatal errors from the record layer put the state machine into err

igus68
authored and
t8m
committed
SSL_get_error(): Check the error stack only in MSG_FLOW_ERROR state

igus68
authored and
t8m
committed
Proxy.pm: Redirect s_server’s output to stderr

igus68
authored and
t8m
committed
x509: remove erroneous critical extension enforcement

n13l
authored and
t8m
committed
fix project spelling and capitalization

jericson
authored and
mattcaswell
committed
SSL_CONF_cmd.pod: Fix TSL typo

jogme
authored and
t8m
committed
windows-makefile: make clean target less noisy

mbroz
authored and
t8m
committed
Some more X509 extension add/del polish

Viktor Dukhovni
authored and
t8m
committed
CSHAKE: Fix memory leak related to propq.

slontis
authored and
t8m
committed
OSSL_HTTP_REQ_CTX_nbio(): check for clear Content-Type mismatch

tGautot
authored and
t8m
committed

Commits on Mar 6, 2026

Restrict the number of keyshares a server is willing to accept
mattcaswell
committed
Restrict the number of supported groups/sig algs
mattcaswell
committed
Add a test for a large number of sigalgs
mattcaswell
committed
Add a test for a large number of key shares
mattcaswell
committed
Add a CHANGES.md entry for the max key_shares/supported groups/sig algs
mattcaswell
committed
Revert "Make X509_up_ref and X509_free take const X509 *"

bob-beck
authored and
nhorman
committed
Partially revert "Constify X509_STORE_CTX functions invoving X509 *"

esyr
authored and
nhorman
committed
doc/man7/ossl-guide-migration.pod: remove mentions of X509_STORE_CTX funcs

esyr
authored and
nhorman
committed
Un-constify X509_OBJECT_get0_X509 and X509_OBJECT_set1_X509

esyr
authored and
nhorman
committed
document the new build option "enable-static-vcruntime"

ideafarm
authored and
nhorman
committed
Un-constify the return value of X509_find_by_issuer_and_serial()

esyr
authored and
nhorman
committed
Revert "Constify X509_find_by_subject"

esyr
authored and
nhorman
committed

Commits on Mar 10, 2026