diff --git a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm index 342baff185b4..794e2fbadfc0 100644 --- a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2255,6 +2255,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2291,6 +2294,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4949,6 +4955,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4985,6 +4994,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h index 8fb459eda8aa..ad498bcd8698 100644 --- a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86" -#define DATE "built on: Wed Jun 17 17:24:13 2026 UTC" +#define DATE "built on: Tue Aug 25 12:44:29 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm index 8da34b75ff22..6a5d9a71556e 100644 --- a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2255,6 +2255,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2291,6 +2294,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4949,6 +4955,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4985,6 +4994,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h index aaf1250c2eb9..886d18c40c7a 100644 --- a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86" -#define DATE "built on: Wed Jun 17 17:24:28 2026 UTC" +#define DATE "built on: Tue Aug 25 12:44:44 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm index 1abbedbdd1f2..594e50c9e1dd 100644 --- a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -229,7 +229,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2197,6 +2197,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2233,6 +2236,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4891,6 +4897,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4927,6 +4936,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11230,6 +11242,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11266,6 +11281,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13924,6 +13942,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13960,6 +13981,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16357,6 +16381,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16369,6 +16394,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18477,6 +18503,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18489,6 +18516,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h index 7194e465d77f..ffb93d229d90 100644 --- a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86" -#define DATE "built on: Wed Jun 17 17:24:40 2026 UTC" +#define DATE "built on: Tue Aug 25 12:44:58 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm index 85988b43ff28..419e74c894d5 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2262,6 +2262,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2298,6 +2301,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4956,6 +4962,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4992,6 +5001,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11367,6 +11379,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11403,6 +11418,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14061,6 +14079,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14097,6 +14118,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16494,6 +16518,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16506,6 +16531,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18617,6 +18643,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18629,6 +18656,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h index 90c939e43e74..53b792b74d2a 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86_64" -#define DATE "built on: Wed Jun 17 17:24:50 2026 UTC" +#define DATE "built on: Tue Aug 25 12:45:12 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm index 0a29d771007c..e9b4820b24d3 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2262,6 +2262,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2298,6 +2301,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4956,6 +4962,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4992,6 +5001,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11367,6 +11379,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11403,6 +11418,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14061,6 +14079,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14097,6 +14118,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16494,6 +16518,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16506,6 +16531,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18617,6 +18643,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18629,6 +18656,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h index 3844ec592bb9..9ead0cd60d51 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86_64" -#define DATE "built on: Wed Jun 17 17:25:05 2026 UTC" +#define DATE "built on: Tue Aug 25 12:45:34 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm index 228a341abe41..22ca6435e306 100644 --- a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -229,7 +229,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -289,11 +289,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "BSD-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2198,6 +2198,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2234,6 +2237,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4892,6 +4898,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4928,6 +4937,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11231,6 +11243,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11267,6 +11282,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13925,6 +13943,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13961,6 +13982,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16358,6 +16382,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16370,6 +16395,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18478,6 +18504,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18490,6 +18517,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h index 12358c812fdd..10b8da56e43e 100644 --- a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: BSD-x86_64" -#define DATE "built on: Wed Jun 17 17:25:17 2026 UTC" +#define DATE "built on: Tue Aug 25 12:45:51 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm index 80bcccf1ac5f..878ab12b42ec 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm @@ -179,7 +179,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -241,7 +241,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -300,11 +300,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN32", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -319,7 +319,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x562840350400)", + "RANLIB" => "CODE(0x557949e58080)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2297,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2333,6 +2336,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4991,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5027,6 +5036,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11362,6 +11374,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11398,6 +11413,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14056,6 +14074,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14092,6 +14113,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16505,6 +16529,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16517,6 +16542,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18634,6 +18660,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18646,6 +18673,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h index b911d0bf0f48..7d155abc0f17 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:32:43 2026 UTC" +#define DATE "built on: Tue Aug 25 12:57:17 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm index 187188b3bbeb..1d364782e66c 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm @@ -179,7 +179,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -241,7 +241,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -300,11 +300,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN32", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -319,7 +319,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x5cdb439ab740)", + "RANLIB" => "CODE(0x5638823c9d80)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2297,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2333,6 +2336,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4991,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5027,6 +5036,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11362,6 +11374,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11398,6 +11413,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14056,6 +14074,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14092,6 +14113,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16505,6 +16529,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16517,6 +16542,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18634,6 +18660,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18646,6 +18673,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h index 75e1b25e955b..12162fc406ed 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:32:51 2026 UTC" +#define DATE "built on: Tue Aug 25 12:57:30 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm index 008cef87f42b..6fbad93147c4 100644 --- a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm @@ -177,7 +177,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -240,7 +240,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -300,11 +300,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN32", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -319,7 +319,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x5d62f9217618)", + "RANLIB" => "CODE(0x5602eb82b768)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2239,6 +2239,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2275,6 +2278,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4933,6 +4939,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4969,6 +4978,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11282,6 +11294,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11318,6 +11333,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13976,6 +13994,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14012,6 +14033,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16425,6 +16449,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16437,6 +16462,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18551,6 +18577,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18563,6 +18590,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h index d1043a5a91ce..1076ee612fc8 100644 --- a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:33:00 2026 UTC" +#define DATE "built on: Tue Aug 25 12:57:43 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm index c141dc5f2515..f70c0340bbfc 100644 --- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm @@ -177,7 +177,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -238,7 +238,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -298,11 +298,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN64-ARM", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -315,7 +315,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x64360b888a98)", + "RANLIB" => "CODE(0x56183358b738)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2231,6 +2231,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2267,6 +2270,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4925,6 +4931,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4961,6 +4970,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11274,6 +11286,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11310,6 +11325,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13968,6 +13986,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14004,6 +14025,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16417,6 +16441,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16429,6 +16454,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18543,6 +18569,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18555,6 +18582,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h index b23392930c57..bfad73d12312 100644 --- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: VC-WIN64-ARM" -#define DATE "built on: Wed Jun 17 17:33:08 2026 UTC" +#define DATE "built on: Tue Aug 25 12:57:55 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm index 3705788690f3..3134fb366bd3 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm @@ -181,7 +181,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -243,7 +243,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -302,11 +302,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN64A", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -321,7 +321,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x5a2068d5ea10)", + "RANLIB" => "CODE(0x5592d548ade0)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2306,6 +2306,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2342,6 +2345,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -5000,6 +5006,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5036,6 +5045,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11411,6 +11423,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11447,6 +11462,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14105,6 +14123,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14141,6 +14162,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16554,6 +16578,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16566,6 +16591,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18683,6 +18709,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18695,6 +18722,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h index 506df0c1ddd6..705ec9d68ae9 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:32:08 2026 UTC" +#define DATE "built on: Tue Aug 25 12:56:25 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm index cd968483272e..7d5bd45a75ea 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm @@ -181,7 +181,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -243,7 +243,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -302,11 +302,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN64A", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -321,7 +321,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x5d5b7ba1e5b0)", + "RANLIB" => "CODE(0x55f18d21c250)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2306,6 +2306,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2342,6 +2345,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -5000,6 +5006,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5036,6 +5045,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11411,6 +11423,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11447,6 +11462,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14105,6 +14123,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14141,6 +14162,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16554,6 +16578,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16566,6 +16591,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18683,6 +18709,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18695,6 +18722,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h index 4d7faba72e21..4de5fe8cb9d3 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:32:21 2026 UTC" +#define DATE "built on: Tue Aug 25 12:56:45 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm index 492610f4d3a4..d59c1907066e 100644 --- a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm +++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm @@ -179,7 +179,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -242,7 +242,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -302,11 +302,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "VC-WIN64A", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "lib", @@ -321,7 +321,7 @@ our %target = ( "LDFLAGS" => "/nologo /debug", "MT" => "mt", "MTFLAGS" => "-nologo", - "RANLIB" => "CODE(0x604cad97f898)", + "RANLIB" => "CODE(0x562b96496f28)", "RC" => "rc", "_conf_fname_int" => [ "Configurations/00-base-templates.conf", @@ -2242,6 +2242,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2278,6 +2281,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4936,6 +4942,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4972,6 +4981,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11285,6 +11297,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11321,6 +11336,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13979,6 +13997,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14015,6 +14036,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16428,6 +16452,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16440,6 +16465,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18554,6 +18580,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18566,6 +18593,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h index 181d4009e5ba..501ff4ff3cea 100644 --- a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: " -#define DATE "built on: Wed Jun 17 17:32:34 2026 UTC" +#define DATE "built on: Tue Aug 25 12:57:05 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h index 2ffd28f17e80..5baff3e0aff8 100644 --- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h index 0e7eb9dfb947..0614d70ba587 100644 --- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm index 68b9777e535f..1813e7209f1e 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm +++ b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "aix64-gcc-as", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar -X64", @@ -2238,6 +2238,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2274,6 +2277,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4932,6 +4938,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4968,6 +4977,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h index 49891a932261..450ad65f9999 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: aix64-gcc-as" -#define DATE "built on: Wed Jun 17 17:23:40 2026 UTC" +#define DATE "built on: Tue Aug 25 12:43:47 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm index 67f115d1e503..dd38a916ea8a 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "aix64-gcc-as", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar -X64", @@ -2238,6 +2238,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2274,6 +2277,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4932,6 +4938,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4968,6 +4977,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h index 2459c161c06b..40dc642f2c0a 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: aix64-gcc-as" -#define DATE "built on: Wed Jun 17 17:23:50 2026 UTC" +#define DATE "built on: Tue Aug 25 12:44:02 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm index 7515010ba0f6..bf64eea2a7a4 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm +++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -232,7 +232,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "aix64-gcc-as", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar -X64", @@ -2201,6 +2201,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2237,6 +2240,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4895,6 +4901,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4931,6 +4940,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11233,6 +11245,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11269,6 +11284,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13927,6 +13945,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13963,6 +13984,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16360,6 +16384,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16372,6 +16397,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18480,6 +18506,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18492,6 +18519,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h index 1de51d59c916..e709d7858d94 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: aix64-gcc-as" -#define DATE "built on: Wed Jun 17 17:24:01 2026 UTC" +#define DATE "built on: Tue Aug 25 12:44:16 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm index c68598a373e0..8fde2f3d2912 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm +++ b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin-i386-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2258,6 +2258,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2294,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4952,6 +4958,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4988,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11303,6 +11315,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11339,6 +11354,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13997,6 +14015,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14033,6 +14054,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16416,6 +16440,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16428,6 +16453,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18531,6 +18557,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18543,6 +18570,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h index 3015418c1d9b..488900f6e0de 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin-i386-cc" -#define DATE "built on: Wed Jun 17 17:26:03 2026 UTC" +#define DATE "built on: Tue Aug 25 12:46:57 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm index 89949092c2ad..0541cb93d1be 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin-i386-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2258,6 +2258,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2294,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4952,6 +4958,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4988,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11303,6 +11315,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11339,6 +11354,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13997,6 +14015,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14033,6 +14054,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16416,6 +16440,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16428,6 +16453,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18531,6 +18557,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18543,6 +18570,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h index 674284362932..cfa0ce918396 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin-i386-cc" -#define DATE "built on: Wed Jun 17 17:26:13 2026 UTC" +#define DATE "built on: Tue Aug 25 12:47:11 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm index d367beb1611f..acc9d54be8c3 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm +++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -232,7 +232,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin-i386-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2200,6 +2200,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2236,6 +2239,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4894,6 +4900,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4930,6 +4939,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11223,6 +11235,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11259,6 +11274,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13917,6 +13935,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13953,6 +13974,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16336,6 +16360,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16348,6 +16373,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18448,6 +18474,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18460,6 +18487,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h index 7fe0a213ae12..6971a07efd48 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin-i386-cc" -#define DATE "built on: Wed Jun 17 17:26:23 2026 UTC" +#define DATE "built on: Tue Aug 25 12:47:25 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm index 18e72b570827..c7b46331864a 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-arm64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2248,6 +2248,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2284,6 +2287,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4942,6 +4948,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4978,6 +4987,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16423,6 +16447,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16435,6 +16460,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18640,6 +18666,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18652,6 +18679,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h index d7ac04051dbb..e0599efb87c1 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-arm64-cc" -#define DATE "built on: Wed Jun 17 17:26:32 2026 UTC" +#define DATE "built on: Tue Aug 25 12:47:38 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm index b1b88d9f599f..b730f8b849ec 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-arm64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2248,6 +2248,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2284,6 +2287,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4942,6 +4948,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4978,6 +4987,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16423,6 +16447,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16435,6 +16460,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18640,6 +18666,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18652,6 +18679,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h index b7112ce03232..bf9b895cd76d 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-arm64-cc" -#define DATE "built on: Wed Jun 17 17:26:43 2026 UTC" +#define DATE "built on: Tue Aug 25 12:47:53 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm index ec97bafcbf5a..9711ee2febde 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm +++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -232,7 +232,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-arm64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2200,6 +2200,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2236,6 +2239,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4894,6 +4900,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4930,6 +4939,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11223,6 +11235,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11259,6 +11274,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13917,6 +13935,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13953,6 +13974,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16336,6 +16360,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16348,6 +16373,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18448,6 +18474,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18460,6 +18487,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h index 047c02b588f6..54a77bc2e6d1 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-arm64-cc" -#define DATE "built on: Wed Jun 17 17:26:53 2026 UTC" +#define DATE "built on: Tue Aug 25 12:48:08 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm index 6d2119f88862..78fbe9eec829 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-x86_64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2264,6 +2264,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2300,6 +2303,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4958,6 +4964,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4994,6 +5003,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11359,6 +11371,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11395,6 +11410,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14053,6 +14071,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14089,6 +14110,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16472,6 +16496,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16484,6 +16509,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18587,6 +18613,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18599,6 +18626,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h index 88213c33f1ee..ad100b5e3b1e 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-x86_64-cc" -#define DATE "built on: Wed Jun 17 17:25:26 2026 UTC" +#define DATE "built on: Tue Aug 25 12:46:05 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm index ad77cb194c39..22291b6d0589 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-x86_64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2264,6 +2264,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2300,6 +2303,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4958,6 +4964,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4994,6 +5003,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11359,6 +11371,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11395,6 +11410,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14053,6 +14071,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14089,6 +14110,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16472,6 +16496,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16484,6 +16509,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18587,6 +18613,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18599,6 +18626,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h index d90eb97468f8..877b8f3a9121 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-x86_64-cc" -#define DATE "built on: Wed Jun 17 17:25:41 2026 UTC" +#define DATE "built on: Tue Aug 25 12:46:26 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm index dda82537bfc0..72197afbd741 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -232,7 +232,7 @@ our %config = ( ], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -292,11 +292,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "darwin64-x86_64-cc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2200,6 +2200,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2236,6 +2239,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4894,6 +4900,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4930,6 +4939,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11223,6 +11235,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11259,6 +11274,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13917,6 +13935,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13953,6 +13974,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16336,6 +16360,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16348,6 +16373,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18448,6 +18474,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18460,6 +18487,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h index 6a5fce0c7151..3e9a7c66a960 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: darwin64-x86_64-cc" -#define DATE "built on: Wed Jun 17 17:25:54 2026 UTC" +#define DATE "built on: Tue Aug 25 12:46:44 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm index 53580a00c598..19517b687bd0 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm +++ b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-aarch64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2254,6 +2254,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2290,6 +2293,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4948,6 +4954,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4984,6 +4993,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11325,6 +11337,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11361,6 +11376,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14019,6 +14037,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14055,6 +14076,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16452,6 +16476,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16464,6 +16489,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18677,6 +18703,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18689,6 +18716,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h index 2c0d5e189850..76d4bb155478 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-aarch64" -#define DATE "built on: Wed Jun 17 17:27:02 2026 UTC" +#define DATE "built on: Tue Aug 25 12:48:21 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm index 35e13b93a44a..0c9c2f5403d8 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-aarch64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2254,6 +2254,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2290,6 +2293,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4948,6 +4954,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4984,6 +4993,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11325,6 +11337,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11361,6 +11376,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14019,6 +14037,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14055,6 +14076,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16452,6 +16476,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16464,6 +16489,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18677,6 +18703,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18689,6 +18716,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h index 8ce8f7ee252d..edbc7ece42d0 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-aarch64" -#define DATE "built on: Wed Jun 17 17:27:13 2026 UTC" +#define DATE "built on: Tue Aug 25 12:48:36 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm index 5bcdf446bc82..d133979cc3cc 100644 --- a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-aarch64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h index 9cc4269f8e23..a5b1c96dccdb 100644 --- a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-aarch64" -#define DATE "built on: Wed Jun 17 17:27:23 2026 UTC" +#define DATE "built on: Tue Aug 25 12:48:50 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm index 1039d43c9ffd..3534d799e04e 100644 --- a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm +++ b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-armv4", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2246,6 +2246,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2282,6 +2285,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4940,6 +4946,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4976,6 +4985,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11303,6 +11315,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11339,6 +11354,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13997,6 +14015,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14033,6 +14054,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16430,6 +16454,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16442,6 +16467,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18637,6 +18663,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18649,6 +18676,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h index 5b6eb7fc345d..0088f27d20aa 100644 --- a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-armv4" -#define DATE "built on: Wed Jun 17 17:27:32 2026 UTC" +#define DATE "built on: Tue Aug 25 12:49:04 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm index b894c96a36ab..4382ec4ff6f8 100644 --- a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-armv4", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2246,6 +2246,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2282,6 +2285,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4940,6 +4946,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4976,6 +4985,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11303,6 +11315,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11339,6 +11354,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13997,6 +14015,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14033,6 +14054,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16430,6 +16454,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16442,6 +16467,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18637,6 +18663,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18649,6 +18676,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h index bfca03890a51..694d5dd4bce1 100644 --- a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-armv4" -#define DATE "built on: Wed Jun 17 17:27:42 2026 UTC" +#define DATE "built on: Tue Aug 25 12:49:18 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm index 965dcc5e2322..48297dc7b2ba 100644 --- a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-armv4", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h index 87edc618bf22..70714ad7ccc9 100644 --- a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-armv4" -#define DATE "built on: Wed Jun 17 17:27:52 2026 UTC" +#define DATE "built on: Tue Aug 25 12:49:32 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-elf/asm/configdata.pm b/deps/openssl/config/archs/linux-elf/asm/configdata.pm index a0dc413841aa..bbf0dd64cf3a 100644 --- a/deps/openssl/config/archs/linux-elf/asm/configdata.pm +++ b/deps/openssl/config/archs/linux-elf/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-elf", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2263,6 +2263,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2299,6 +2302,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4957,6 +4963,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4993,6 +5002,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11317,6 +11329,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11353,6 +11368,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14011,6 +14029,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14047,6 +14068,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16444,6 +16468,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16456,6 +16481,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18567,6 +18593,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18579,6 +18606,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h index b36a4c6ed908..3060d629350a 100644 --- a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-elf" -#define DATE "built on: Wed Jun 17 17:28:02 2026 UTC" +#define DATE "built on: Tue Aug 25 12:49:45 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm index a57f3f37e757..5acf92d026dc 100644 --- a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-elf", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2263,6 +2263,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2299,6 +2302,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4957,6 +4963,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4993,6 +5002,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11317,6 +11329,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11353,6 +11368,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14011,6 +14029,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14047,6 +14068,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16444,6 +16468,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16456,6 +16481,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18567,6 +18593,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18579,6 +18606,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h index 0fbc959d01b0..e86d4f39b307 100644 --- a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-elf" -#define DATE "built on: Wed Jun 17 17:28:12 2026 UTC" +#define DATE "built on: Tue Aug 25 12:50:00 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm index 249f67471a85..de38e67b0756 100644 --- a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-elf", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2205,6 +2205,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2241,6 +2244,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4899,6 +4905,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4935,6 +4944,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11237,6 +11249,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11273,6 +11288,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13931,6 +13949,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13967,6 +13988,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16364,6 +16388,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16376,6 +16401,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18484,6 +18510,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18496,6 +18523,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h index 1bf2e2f40ee5..f47815f86eb1 100644 --- a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-elf" -#define DATE "built on: Wed Jun 17 17:28:23 2026 UTC" +#define DATE "built on: Tue Aug 25 12:50:14 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm index 2bf558c9f1aa..863432756e7c 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm +++ b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-ppc64le", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2243,6 +2243,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2279,6 +2282,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4937,6 +4943,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4973,6 +4982,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11318,6 +11330,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11354,6 +11369,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14012,6 +14030,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14048,6 +14069,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16445,6 +16469,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16457,6 +16482,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18568,6 +18594,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18580,6 +18607,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h index ca635890a4e8..ad73a66a551b 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-ppc64le" -#define DATE "built on: Wed Jun 17 17:29:08 2026 UTC" +#define DATE "built on: Tue Aug 25 12:51:20 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm index 026b0728c464..e541e8d3eb5d 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-ppc64le", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2243,6 +2243,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2279,6 +2282,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4937,6 +4943,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4973,6 +4982,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11318,6 +11330,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11354,6 +11369,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14012,6 +14030,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14048,6 +14069,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16445,6 +16469,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16457,6 +16482,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18568,6 +18594,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18580,6 +18607,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h index d9eab19ca46c..78b4fa43f2da 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-ppc64le" -#define DATE "built on: Wed Jun 17 17:29:18 2026 UTC" +#define DATE "built on: Tue Aug 25 12:51:35 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm index cf9b991eb823..5a93fb38646e 100644 --- a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-ppc64le", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h index f05cfd182212..7ac124b79570 100644 --- a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-ppc64le" -#define DATE "built on: Wed Jun 17 17:29:28 2026 UTC" +#define DATE "built on: Tue Aug 25 12:51:49 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm index 62de96113048..f1817b2e9fdf 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm +++ b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2271,6 +2271,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2307,6 +2310,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4965,6 +4971,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5001,6 +5010,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11375,6 +11387,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11411,6 +11426,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14069,6 +14087,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14105,6 +14126,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16502,6 +16526,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16514,6 +16539,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18625,6 +18651,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18637,6 +18664,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h index 1f31e3e4f1b3..c2e696451484 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-x86_64" -#define DATE "built on: Wed Jun 17 17:28:32 2026 UTC" +#define DATE "built on: Tue Aug 25 12:50:28 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm index a52b4ec774f2..4b2823833816 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2271,6 +2271,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2307,6 +2310,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4965,6 +4971,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -5001,6 +5010,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11375,6 +11387,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11411,6 +11426,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14069,6 +14087,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14105,6 +14126,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16502,6 +16526,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16514,6 +16539,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18625,6 +18651,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18637,6 +18664,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h index 182f8f215900..73438ec9c159 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-x86_64" -#define DATE "built on: Wed Jun 17 17:28:47 2026 UTC" +#define DATE "built on: Tue Aug 25 12:50:50 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm index b06017d24af8..0e809e3b15ca 100644 --- a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux-x86_64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2207,6 +2207,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2243,6 +2246,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4901,6 +4907,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4937,6 +4946,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11239,6 +11251,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11275,6 +11290,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13933,6 +13951,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13969,6 +13990,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16366,6 +16390,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16378,6 +16403,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18486,6 +18512,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18498,6 +18525,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h index 484fde68a038..808eaf319cc3 100644 --- a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux-x86_64" -#define DATE "built on: Wed Jun 17 17:28:59 2026 UTC" +#define DATE "built on: Tue Aug 25 12:51:07 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm index 1ca1ae6b921f..a8198c6bb7e7 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm +++ b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux32-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2253,6 +2253,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2289,6 +2292,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4947,6 +4953,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4983,6 +4992,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11301,6 +11313,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11337,6 +11352,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13995,6 +14013,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14031,6 +14052,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16428,6 +16452,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16440,6 +16465,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18605,6 +18631,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18617,6 +18644,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h index f3dda714dde6..2aef9d8766f6 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux32-s390x" -#define DATE "built on: Wed Jun 17 17:29:37 2026 UTC" +#define DATE "built on: Tue Aug 25 12:52:02 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm index b3f1fb9ba076..0ff37a363aa6 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux32-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2253,6 +2253,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2289,6 +2292,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4947,6 +4953,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4983,6 +4992,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11301,6 +11313,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11337,6 +11352,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13995,6 +14013,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14031,6 +14052,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16428,6 +16452,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16440,6 +16465,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18605,6 +18631,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18617,6 +18644,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h index 068dfd372cef..0bae9c825baf 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux32-s390x" -#define DATE "built on: Wed Jun 17 17:29:47 2026 UTC" +#define DATE "built on: Tue Aug 25 12:52:17 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm index e4ce267208cc..5968eb75b569 100644 --- a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux32-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h index 38d1d5cc558f..3b7b6bb8692f 100644 --- a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux32-s390x" -#define DATE "built on: Wed Jun 17 17:29:56 2026 UTC" +#define DATE "built on: Tue Aug 25 12:52:31 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm index fd88a5822293..04b12ee98c38 100644 --- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-loongarch64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h index 5e6994fc6589..bd7564e8b5d2 100644 --- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-loongarch64" -#define DATE "built on: Wed Jun 17 17:33:25 2026 UTC" +#define DATE "built on: Tue Aug 25 12:58:07 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm index 7e6e333b58fa..0afc617fcb7f 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm @@ -177,7 +177,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -237,7 +237,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -296,11 +296,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-mips64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2231,6 +2231,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2267,6 +2270,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4925,6 +4931,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4961,6 +4970,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11272,6 +11284,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11308,6 +11323,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13966,6 +13984,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14002,6 +14023,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16399,6 +16423,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16411,6 +16436,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18561,6 +18587,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18573,6 +18600,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h index 933e0c3ad0f4..f8c3ede48432 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-mips64" -#define DATE "built on: Wed Jun 17 17:30:34 2026 UTC" +#define DATE "built on: Tue Aug 25 12:53:26 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm index 44828e7e436f..fd7c115b97c5 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm @@ -177,7 +177,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -237,7 +237,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -296,11 +296,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-mips64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2231,6 +2231,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2267,6 +2270,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4925,6 +4931,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4961,6 +4970,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11272,6 +11284,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11308,6 +11323,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13966,6 +13984,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14002,6 +14023,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16399,6 +16423,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16411,6 +16436,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18561,6 +18587,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18573,6 +18600,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h index 0ce75e6089a5..1f69f13c454d 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-mips64" -#define DATE "built on: Wed Jun 17 17:30:44 2026 UTC" +#define DATE "built on: Tue Aug 25 12:53:40 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm index f5aff4b52e69..07db97ab6049 100644 --- a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-mips64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2207,6 +2207,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2243,6 +2246,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4901,6 +4907,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4937,6 +4946,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11239,6 +11251,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11275,6 +11290,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13933,6 +13951,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13969,6 +13990,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16366,6 +16390,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16378,6 +16403,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18486,6 +18512,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18498,6 +18525,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h index 7ae8f2df59e6..6249246a84b4 100644 --- a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-mips64" -#define DATE "built on: Wed Jun 17 17:30:53 2026 UTC" +#define DATE "built on: Tue Aug 25 12:53:53 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm index 4431f75a1afd..f65899375e22 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm @@ -18,7 +18,6 @@ our %config = ( "ARFLAGS" => [ "qc" ], - "AS" => "as", "ASFLAGS" => [], "CC" => "gcc", "CFLAGS" => [ @@ -34,7 +33,6 @@ our %config = ( "FIPSKEY" => "f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813", "FIPS_VENDOR" => "OpenSSL FIPS Provider", "HASHBANGPERL" => "/usr/bin/env perl", - "LD" => "ld", "LDFLAGS" => [], "LDLIBS" => [], "OBJCOPY" => "objcopy", @@ -176,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -236,10 +234,10 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", - "perl_archname" => "x86_64-linux-thread-multi", + "patch" => "8", + "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", - "perl_version" => "5.42.2", + "perl_version" => "5.34.0", "perlargv" => [ "no-tests", "no-shared", @@ -255,9 +253,9 @@ our %config = ( "linux64-riscv64" ], "perlenv" => { - "AR" => "ar", + "AR" => undef, "ARFLAGS" => undef, - "AS" => "as", + "AS" => undef, "ASFLAGS" => undef, "BUILDFILE" => undef, "CC" => "gcc", @@ -267,18 +265,18 @@ our %config = ( "CPPFLAGS" => undef, "CPPINCLUDES" => undef, "CROSS_COMPILE" => undef, - "CXX" => "g++", + "CXX" => undef, "CXXFLAGS" => undef, "HASHBANGPERL" => undef, - "LD" => "ld", + "LD" => undef, "LDFLAGS" => undef, "LDLIBS" => undef, "MT" => undef, "MTFLAGS" => undef, - "OBJCOPY" => "objcopy", + "OBJCOPY" => undef, "OPENSSL_LOCAL_CONFIG_DIR" => undef, "PERL" => undef, - "RANLIB" => "ranlib", + "RANLIB" => undef, "RC" => undef, "RCFLAGS" => undef, "RM" => undef, @@ -295,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-riscv64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2240,6 +2238,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2276,6 +2277,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4934,6 +4938,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4970,6 +4977,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11302,6 +11312,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11338,6 +11351,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13996,6 +14012,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14032,6 +14051,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16429,6 +16451,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16441,6 +16464,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18552,6 +18576,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18564,6 +18589,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h index 132867b95c47..6fd695965dc1 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-riscv64" -#define DATE "built on: Tue Jun 30 04:15:54 2026 UTC" +#define DATE "built on: Tue Aug 25 12:54:06 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm index 0063924e8a2a..9464ee908127 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm @@ -18,7 +18,6 @@ our %config = ( "ARFLAGS" => [ "qc" ], - "AS" => "as", "ASFLAGS" => [], "CC" => "../config/fake_gcc.pl", "CFLAGS" => [ @@ -34,7 +33,6 @@ our %config = ( "FIPSKEY" => "f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813", "FIPS_VENDOR" => "OpenSSL FIPS Provider", "HASHBANGPERL" => "/usr/bin/env perl", - "LD" => "ld", "LDFLAGS" => [], "LDLIBS" => [], "OBJCOPY" => "objcopy", @@ -176,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -236,10 +234,10 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", - "perl_archname" => "x86_64-linux-thread-multi", + "patch" => "8", + "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", - "perl_version" => "5.42.2", + "perl_version" => "5.34.0", "perlargv" => [ "no-tests", "no-shared", @@ -255,9 +253,9 @@ our %config = ( "linux64-riscv64" ], "perlenv" => { - "AR" => "ar", + "AR" => undef, "ARFLAGS" => undef, - "AS" => "as", + "AS" => undef, "ASFLAGS" => undef, "BUILDFILE" => undef, "CC" => "../config/fake_gcc.pl", @@ -267,18 +265,18 @@ our %config = ( "CPPFLAGS" => undef, "CPPINCLUDES" => undef, "CROSS_COMPILE" => undef, - "CXX" => "g++", + "CXX" => undef, "CXXFLAGS" => undef, "HASHBANGPERL" => undef, - "LD" => "ld", + "LD" => undef, "LDFLAGS" => undef, "LDLIBS" => undef, "MT" => undef, "MTFLAGS" => undef, - "OBJCOPY" => "objcopy", + "OBJCOPY" => undef, "OPENSSL_LOCAL_CONFIG_DIR" => undef, "PERL" => undef, - "RANLIB" => "ranlib", + "RANLIB" => undef, "RC" => undef, "RCFLAGS" => undef, "RM" => undef, @@ -295,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-riscv64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2240,6 +2238,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2276,6 +2277,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4934,6 +4938,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4970,6 +4977,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11302,6 +11312,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11338,6 +11351,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13996,6 +14012,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14032,6 +14051,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16429,6 +16451,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16441,6 +16464,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18552,6 +18576,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18564,6 +18589,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h index 017783059eb5..b88360c4414d 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-riscv64" -#define DATE "built on: Tue Jun 30 04:16:04 2026 UTC" +#define DATE "built on: Tue Aug 25 12:54:22 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm index 0afb9fe32895..30d3a517c15a 100644 --- a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-riscv64", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2206,6 +2206,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2242,6 +2245,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4900,6 +4906,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4936,6 +4945,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11238,6 +11250,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11274,6 +11289,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13932,6 +13950,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13968,6 +13989,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16365,6 +16389,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16377,6 +16402,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18485,6 +18511,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18497,6 +18524,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h index 47ed00634a03..08f9dacf7afa 100644 --- a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-riscv64" -#define DATE "built on: Wed Jun 17 17:33:16 2026 UTC" +#define DATE "built on: Tue Aug 25 12:54:36 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm index bccf82d2ca5d..fde561ab9d43 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2258,6 +2258,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2294,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4952,6 +4958,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4988,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11320,6 +11332,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11356,6 +11371,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14014,6 +14032,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14050,6 +14071,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16447,6 +16471,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16459,6 +16484,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18624,6 +18650,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18636,6 +18663,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h index 9f290c153834..85fcac954888 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-s390x" -#define DATE "built on: Wed Jun 17 17:30:06 2026 UTC" +#define DATE "built on: Tue Aug 25 12:52:44 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm index 076ce08f1495..db711f1f371f 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm @@ -174,7 +174,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -234,7 +234,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2258,6 +2258,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2294,6 +2297,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4952,6 +4958,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4988,6 +4997,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11320,6 +11332,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11356,6 +11371,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14014,6 +14032,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14050,6 +14071,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16447,6 +16471,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16459,6 +16484,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18624,6 +18650,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18636,6 +18663,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h index a0807d918574..dc47544122a9 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-s390x" -#define DATE "built on: Wed Jun 17 17:30:16 2026 UTC" +#define DATE "built on: Tue Aug 25 12:52:59 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm index 0768ef4d8eab..28d575ff8d60 100644 --- a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm +++ b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm @@ -172,7 +172,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -233,7 +233,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -293,11 +293,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned char", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "linux64-s390x", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2207,6 +2207,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2243,6 +2246,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4901,6 +4907,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4937,6 +4946,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11239,6 +11251,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11275,6 +11290,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13933,6 +13951,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13969,6 +13990,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16366,6 +16390,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16378,6 +16403,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18486,6 +18512,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18498,6 +18525,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h index b3ac1f765fc1..8ebaa83c9019 100644 --- a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: linux64-s390x" -#define DATE "built on: Wed Jun 17 17:30:25 2026 UTC" +#define DATE "built on: Tue Aug 25 12:53:13 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm index 7b3aba3a639d..2825259eeac5 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -231,7 +231,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris-x86-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2256,6 +2256,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2292,6 +2295,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4950,6 +4956,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4986,6 +4995,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h index cb7b0c149cfc..e8bb3e6e170d 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris-x86-gcc" -#define DATE "built on: Wed Jun 17 17:31:02 2026 UTC" +#define DATE "built on: Tue Aug 25 12:54:49 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm index ee82a94dea37..1de2b1838d2d 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -231,7 +231,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris-x86-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2256,6 +2256,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2292,6 +2295,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4950,6 +4956,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4986,6 +4995,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11310,6 +11322,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11346,6 +11361,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14004,6 +14022,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14040,6 +14061,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16437,6 +16461,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16449,6 +16474,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18560,6 +18586,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18572,6 +18599,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h index c536b621df14..79239580903c 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris-x86-gcc" -#define DATE "built on: Wed Jun 17 17:31:13 2026 UTC" +#define DATE "built on: Tue Aug 25 12:55:04 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm index 8f683123c4c5..cd239c07bc4e 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm +++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris-x86-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2198,6 +2198,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2234,6 +2237,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4892,6 +4898,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4928,6 +4937,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11230,6 +11242,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11266,6 +11281,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13924,6 +13942,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13960,6 +13981,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16357,6 +16381,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16369,6 +16394,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18477,6 +18503,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18489,6 +18516,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h index 3aa35283d231..17c1ed5f0bd2 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris-x86-gcc" -#define DATE "built on: Wed Jun 17 17:31:23 2026 UTC" +#define DATE "built on: Tue Aug 25 12:55:18 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm index 2613cd196ae5..88b300eeeb7f 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -231,7 +231,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris64-x86_64-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2263,6 +2263,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2299,6 +2302,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4957,6 +4963,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4993,6 +5002,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11367,6 +11379,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11403,6 +11418,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14061,6 +14079,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14097,6 +14118,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16494,6 +16518,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16506,6 +16531,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18617,6 +18643,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18629,6 +18656,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h index efe0be8ef0b3..32fc64cf8679 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris64-x86_64-gcc" -#define DATE "built on: Wed Jun 17 17:31:32 2026 UTC" +#define DATE "built on: Tue Aug 25 12:55:32 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm index a627e26f0630..3ddd4e30f92d 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm @@ -171,7 +171,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -231,7 +231,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris64-x86_64-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2263,6 +2263,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2299,6 +2302,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4957,6 +4963,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4993,6 +5002,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11367,6 +11379,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11403,6 +11418,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -14061,6 +14079,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -14097,6 +14118,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16494,6 +16518,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16506,6 +16531,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18617,6 +18643,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18629,6 +18656,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h index 3877782d03bf..cc8735d5c63e 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris64-x86_64-gcc" -#define DATE "built on: Wed Jun 17 17:31:47 2026 UTC" +#define DATE "built on: Tue Aug 25 12:55:54 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm index 81a40f0be536..09125eacfd1a 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm @@ -169,7 +169,7 @@ our %config = ( ], "dynamic_engines" => "0", "ex_libs" => [], - "full_version" => "3.5.7", + "full_version" => "3.5.8", "includes" => [], "lflags" => [], "lib_defines" => [ @@ -230,7 +230,7 @@ our %config = ( "openssl_sys_defines" => [], "openssldir" => "", "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic", - "patch" => "7", + "patch" => "8", "perl_archname" => "x86_64-linux-gnu-thread-multi", "perl_cmd" => "/usr/bin/perl", "perl_version" => "5.34.0", @@ -290,11 +290,11 @@ our %config = ( "prerelease" => "", "processor" => "", "rc4_int" => "unsigned int", - "release_date" => "9 Jun 2026", + "release_date" => "25 Aug 2026", "shlib_version" => "3", "sourcedir" => ".", "target" => "solaris64-x86_64-gcc", - "version" => "3.5.7" + "version" => "3.5.8" ); our %target = ( "AR" => "ar", @@ -2199,6 +2199,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -2235,6 +2238,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -4893,6 +4899,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -4929,6 +4938,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -11231,6 +11243,9 @@ our %unified_info = ( "doc/html/man3/MDC2_Init.html" => [ "doc/man3/MDC2_Init.pod" ], + "doc/html/man3/NAME_CONSTRAINTS_check.html" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/html/man3/NCONF_new_ex.html" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -11267,6 +11282,9 @@ our %unified_info = ( "doc/html/man3/OPENSSL_LH_stats.html" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/html/man3/OPENSSL_armcap.html" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/html/man3/OPENSSL_config.html" => [ "doc/man3/OPENSSL_config.pod" ], @@ -13925,6 +13943,9 @@ our %unified_info = ( "doc/man/man3/MDC2_Init.3" => [ "doc/man3/MDC2_Init.pod" ], + "doc/man/man3/NAME_CONSTRAINTS_check.3" => [ + "doc/man3/NAME_CONSTRAINTS_check.pod" + ], "doc/man/man3/NCONF_new_ex.3" => [ "doc/man3/NCONF_new_ex.pod" ], @@ -13961,6 +13982,9 @@ our %unified_info = ( "doc/man/man3/OPENSSL_LH_stats.3" => [ "doc/man3/OPENSSL_LH_stats.pod" ], + "doc/man/man3/OPENSSL_armcap.3" => [ + "doc/man3/OPENSSL_armcap.pod" + ], "doc/man/man3/OPENSSL_config.3" => [ "doc/man3/OPENSSL_config.pod" ], @@ -16358,6 +16382,7 @@ our %unified_info = ( "doc/html/man3/HMAC.html", "doc/html/man3/MD5.html", "doc/html/man3/MDC2_Init.html", + "doc/html/man3/NAME_CONSTRAINTS_check.html", "doc/html/man3/NCONF_new_ex.html", "doc/html/man3/OBJ_nid2obj.html", "doc/html/man3/OCSP_REQUEST_new.html", @@ -16370,6 +16395,7 @@ our %unified_info = ( "doc/html/man3/OPENSSL_FILE.html", "doc/html/man3/OPENSSL_LH_COMPFUNC.html", "doc/html/man3/OPENSSL_LH_stats.html", + "doc/html/man3/OPENSSL_armcap.html", "doc/html/man3/OPENSSL_config.html", "doc/html/man3/OPENSSL_fork_prepare.html", "doc/html/man3/OPENSSL_gmtime.html", @@ -18478,6 +18504,7 @@ our %unified_info = ( "doc/man/man3/HMAC.3", "doc/man/man3/MD5.3", "doc/man/man3/MDC2_Init.3", + "doc/man/man3/NAME_CONSTRAINTS_check.3", "doc/man/man3/NCONF_new_ex.3", "doc/man/man3/OBJ_nid2obj.3", "doc/man/man3/OCSP_REQUEST_new.3", @@ -18490,6 +18517,7 @@ our %unified_info = ( "doc/man/man3/OPENSSL_FILE.3", "doc/man/man3/OPENSSL_LH_COMPFUNC.3", "doc/man/man3/OPENSSL_LH_stats.3", + "doc/man/man3/OPENSSL_armcap.3", "doc/man/man3/OPENSSL_config.3", "doc/man/man3/OPENSSL_fork_prepare.3", "doc/man/man3/OPENSSL_gmtime.3", diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h index dcb67f8ce1fa..378b3b1efee2 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h @@ -11,7 +11,7 @@ */ #define PLATFORM "platform: solaris64-x86_64-gcc" -#define DATE "built on: Wed Jun 17 17:31:59 2026 UTC" +#define DATE "built on: Tue Aug 25 12:56:11 2026 UTC" /* * Generate compiler_flags as an array of individual characters. This is a diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h index 8e9329bcc0dd..1555e59c04c6 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h @@ -34,7 +34,7 @@ extern "C" { # define OPENSSL_VERSION_MINOR 5 /* clang-format on */ /* clang-format off */ -# define OPENSSL_VERSION_PATCH 7 +# define OPENSSL_VERSION_PATCH 8 /* clang-format on */ /* @@ -87,10 +87,10 @@ extern "C" { * OPENSSL_VERSION_BUILD_METADATA_STR appended. */ /* clang-format off */ -# define OPENSSL_VERSION_STR "3.5.7" +# define OPENSSL_VERSION_STR "3.5.8" /* clang-format on */ /* clang-format off */ -# define OPENSSL_FULL_VERSION_STR "3.5.7" +# define OPENSSL_FULL_VERSION_STR "3.5.8" /* clang-format on */ /* @@ -99,7 +99,7 @@ extern "C" { * These strings are defined separately to allow them to be parsable. */ /* clang-format off */ -# define OPENSSL_RELEASE_DATE "9 Jun 2026" +# define OPENSSL_RELEASE_DATE "25 Aug 2026" /* clang-format on */ /* @@ -107,7 +107,7 @@ extern "C" { */ /* clang-format off */ -# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026" +# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026" /* clang-format on */ /* clang-format off */ diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h index eaeeea7d10b4..4460f0493d6e 100644 --- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h +++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h @@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/openssl/CHANGES.md b/deps/openssl/openssl/CHANGES.md index c1c29eb55f04..b440f013313f 100644 --- a/deps/openssl/openssl/CHANGES.md +++ b/deps/openssl/openssl/CHANGES.md @@ -28,6 +28,237 @@ OpenSSL Releases OpenSSL 3.5 ----------- +### Changes between 3.5.7 and 3.5.8 [25 Aug 2026] + + * Fixed QUIC server being able to trigger double free when processing `INITIAL` + packet. + + Severity: Moderate + + Issue summary: QUIC server may double free QRX (QUIC record layer RX) object + when channel creation fails for initial packet. + + Impact summary: Double free leads to heap corruption, which typically results + in termination of QUIC server process, leading to a Denial of Service. + There is so far no evidence that this double free is exploitable for remote + code execution, thus it is considered highly improbable. + + Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle, + and Feng Xue (ThreatBoon). + + ([CVE-2026-18798]) + + *Alexandr Nedvědický* + + * Fixed heap buffer overflow in CMS key unwrapping. + + Severity: Moderate + + Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer + based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap + primitive can write and cleanse more bytes than that query reports, causing + an 8-byte out-of-bounds heap write. + + Impact summary: An attacker who supplies a crafted CMS message can trigger + a deterministic 8-byte out-of-bounds heap write when the victim decrypts it + with `CMS_decrypt()`, corrupting the heap and typically resulting in a Denial + of Service. + + Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits). + + ([CVE-2026-63072]) + + *Daniel Kubec* + + * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`. + + Severity: Moderate + + Issue Summary: The OpenSSL Certificate Management Protocol (CMP) + password-based protection verification only checks whether + the `protectionAlg` parameter was not NULL and not its ASN.1 type, + before treating it as a `PBMParameter`. A crafted message can contain + a parameter of a different type, which is then dereferenced as an invalid + pointer. + + Impact summary: A remote, unauthenticated attacker can crash an application + acting as a CMP server that accepts PBM-protected messages, or a CMP client + talking to a malicious or intercepted CMP server, resulting in a Denial + of Service. + + Reported by: Ying Dong and Bhabani Sankar Das. + + ([CVE-2026-63076]) + + *Daniel Kubec* + + * Fixed unbounded memory growth in QUIC server incoming channel queue. + + Severity: Low + + Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes + valid QUIC Initial packets for unknown destination connection IDs, it can + allocate and queue new incoming channels without enforcing any limit. + + Impact summary: A remote peer that can make many `INITIAL` packets reach + the server listener faster than the application accepts connections can + cause the memory allocated to store the per-channel state to grow + without any limits, potentially making the QUIC listener unavailable + and causing a Denial of Service. + + Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI. + + ([CVE-2026-14456]) + + + *Filipe Casal* + + * Fixed RPK server signature algorithm selection being able to dereference + a missing certificate. + + Severity: Low + + Issue summary: In a server or client configuration with [RFC 7250] Raw Public + Keys (RPKs) enabled, and only the private key (with no associated + certificate) configured locally, a NULL pointer dereference may occur + when the remote peer solicits raw public keys and also sends the typically + omitted `signature_algorithms_cert` TLS extension. + + Impact summary: The impact is limited to a possible Denial of Service + as a result of an application abort, no data disclosure or remote command + execution are possible. + + Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI. + + ([CVE-2026-14457]) + + *Viktor Dukhovni* + + * Fixed excessive memory use buffering DTLS records for a future epoch. + + Severity: Low + + Issue summary: Receiving a DTLS record for a future epoch while a handshake + is in progress causes OpenSSL to buffer far more memory than the record + itself requires. + + Impact summary: A peer can use a small amount of network traffic to make + an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, + which may lead to a Denial of Service. + + Reported by: Amazon Web Services. + + ([CVE-2026-54874]) + + *Matt Caswell* + + * Fixed untrusted Sender DN being used as a format string in CMP response + validation. + + Severity: Low + + Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response + validation passed an unexpected response sender distinguished name directly + as the format string to `ERR_raise_data()`. + + Impact summary: A malicious or intercepted CMP endpoint can crash a CMP + client that enforces an expected sender or uses a pinned server certificate + whose subject becomes the default expected sender. + + Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI, + Brandon Luo, and TrendAI Zero Day Initiative. + + ([CVE-2026-63073]) + + *Filipe Casal* + + * Fixed CMP indefinite cache growth of `extraCerts`. + + Severity: Low + + Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches + additional certificates (`extraCerts`) sent in a CMP message, but never + expunges them (for instance, if they are invalid). If a server reuses + an `OSSL_CMP_CTX` object frequently, this cache of `extraCerts` may grow + unboundedly, and a malicious client may flood a CMP server with requests + driving this growth. + + Impact Summary: Users utilizing a CMP server that reuses a single + `OSSL_CMP_CTX` object for the lifetime of a server process may observe + unbounded memory growth in the event a malicious client repeatedly sends + requests containing unique extra certificates, which may lead to OOM + conditions. + + Reported by: Pavol Zacik (Red Hat). + + ([CVE-2026-63074]) + + *Neil Horman* + + * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. + + Severity: Low + + Issue Summary: When OpenSSL processes QUIC traffic from a peer + that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only + responses, the QUIC stack can retain ACK-only packet metadata + for the lifetime of the connection. + + Impact Summary: A remote peer that can complete a QUIC handshake can cause + connection-scoped memory growth, which may lead to a Denial of Service + through memory exhaustion, especially with sustained traffic or many + concurrent QUIC connections. + + Reported by: Opal Wright (Trail of Bits). + + ([CVE-2026-63075]) + + *Neil Horman* + + * Fixed possibility of AEAD forgeries with empty ciphertext when using + `EVP_Cipher()`. + + Severity: Low + + Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty + ciphertext can report success without verifying the supplied authentication + tag when the operation is finalized by calling the `EVP_Cipher()` function. + + Impact summary: Applications calling `EVP_Cipher()` on an empty ciphertext + and expecting the call to check the AEAD tag may accept forged messages. + + Reported by: Billy Brumley (Rochester Institute of Technology). + + ([CVE-2026-75803]) + + + *Billy Bob Brumley* + + * Added `OPENSSL_armcap(3)` documentation page. + + + *Paul Elliott* + + * Added support for selecting assembly code paths for LLVM-based Intel's `icx` + compiler. + + + *Wolfgang Beck* + + * Updated compliance with TLS 1.3 session ticket lifetime requirements. + TLS 1.3 clients now cap `ticket_lifetime_hint` to 7 days (604800 seconds) + when processing new session ticket messages, in accordance + with [RFC 8446 Section 4.6.1]. + + + *Abel Thomas* + + * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers + in CCM cipher mode. + + + *Mounir IDRASSI* + ### Changes between 3.5.6 and 3.5.7 [9 Jun 2026] * Fixed heap use-after-free in `PKCS7_verify()`. @@ -306,6 +537,21 @@ OpenSSL 3.5 *Dmitry Belyavskiy (Red Hat)* + * Fixed excessive allocation of the handshake message buffer (aka HollowByte). + + Previously, we would allocate a buffer large enough to hold the full size of + an incoming handshake message as advertised by the peer. This could be quite + large (although it is bounded, e.g. for ClientHello this is approximately + 128 KiB). If the peer then fails to send the full handshake message, then the + endpoint is left waiting for the remainder of the message to arrive and the + memory is still allocated (i.e. a Slowloris attack). To prevent this, we + incrementally grow the buffer as we receive the data. + + This issue was reported by Okta Red Team. + + + *Matt Caswell* + * Fixed TLS 1.3 server not sending `NewSessionTicket` message after ciphersuite mismatch. @@ -22260,6 +22506,9 @@ ndif [CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673 [CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383 [CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076 +[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456 +[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457 +[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798 [CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795 [CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796 [CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387 @@ -22281,9 +22530,18 @@ ndif [CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445 [CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446 [CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447 +[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874 +[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072 +[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073 +[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074 +[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075 +[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076 +[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations [RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5 [RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211 [RFC 5297]: https://datatracker.ietf.org/doc/html/rfc5297 +[RFC 7250]: https://datatracker.ietf.org/doc/html/rfc7250 [RFC 8446]: https://datatracker.ietf.org/doc/html/rfc8446 +[RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1 [RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452 diff --git a/deps/openssl/openssl/CONTRIBUTING.md b/deps/openssl/openssl/CONTRIBUTING.md index 06dfbaeff1fe..8a0d40524ddb 100644 --- a/deps/openssl/openssl/CONTRIBUTING.md +++ b/deps/openssl/openssl/CONTRIBUTING.md @@ -70,7 +70,37 @@ guidelines: git push -f [ []] ``` - 2. All source files should start with the following text (with + 2. Similarly, if a non-trivial portion of a contribution was created + using an AI tool, you must declare which agent and model were used. + This is done by adding `Assisted-by: {agent}:{model}` below the commit + message: + + ``` + One-line summary of change with AI-generated portions + + Assisted-by: Claude:claude-sonnet-4-6 + ``` + + Multiple Assisted-by trailers can be included if multiple tools were used: + + ``` + Assisted-by: Claude:claude-sonnet-4-6 + Assisted-by: ChatGPT:gpt-4o + Assisted-by: GitHub Copilot:gpt-4.1 + ``` + + You will need to have signed a v1.1 or later CLA in order to + include AI-generated content in your contribution. CLAs signed + after June 2026 will have the requisite clauses. + + Consult the [OpenSSL AI Code and Documentation Contribution + Policy] if an AI model assisted with the creation of your + contribution. + + [OpenSSL AI Code and Documentation Contribution + Policy]: + + 3. All source files should start with the following text (with appropriate comment characters at the start of each line and the year(s) updated): @@ -83,11 +113,11 @@ guidelines: https://www.openssl.org/source/license.html ``` - 3. Patches should be as current as possible; expect to have to rebase + 4. Patches should be as current as possible; expect to have to rebase often. We do not accept merge commits, you will have to remove them (usually by rebasing) before it will be acceptable. - 4. Code provided should follow our [coding style] and [documentation policy] + 5. Code provided should follow our [coding style] and [documentation policy] and compile without warnings. There is a [Perl tool](util/check-format.pl) that helps finding code formatting mistakes and other coding style nits. @@ -100,16 +130,16 @@ guidelines: [coding style]: https://openssl-library.org/policies/technical/coding-style/ [documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/ - 5. When at all possible, code contributions should include tests. These can + 6. When at all possible, code contributions should include tests. These can either be added to an existing test, or completely new. Please see [test/README.md](test/README.md) for information on the test framework. - 6. New features or changed functionality must include + 7. New features or changed functionality must include documentation. Please look at the `.pod` files in `doc/man[1357]` for examples of our style. Run `make doc-nits` to make sure that your documentation changes are clean. - 7. For user visible changes (API changes, behaviour changes, ...), + 8. For user visible changes (API changes, behaviour changes, ...), consider adding a note in [CHANGES.md](CHANGES.md). This could be a summarising description of the change, and could explain the grander details. @@ -120,5 +150,5 @@ guidelines: with a specific release without having to sift through the higher noise ratio in git-log. - 8. Guidelines on how to integrate error output of new crypto library modules + 9. Guidelines on how to integrate error output of new crypto library modules can be found in [crypto/err/README.md](crypto/err/README.md). diff --git a/deps/openssl/openssl/NEWS.md b/deps/openssl/openssl/NEWS.md index 04d0bd72c7f5..329b1772c348 100644 --- a/deps/openssl/openssl/NEWS.md +++ b/deps/openssl/openssl/NEWS.md @@ -23,6 +23,50 @@ OpenSSL Releases OpenSSL 3.5 ----------- +### Major changes between OpenSSL 3.5.7 and OpenSSL 3.5.8 [25 Aug 2026] + +OpenSSL 3.5.8 is a security patch release. The most severe CVE fixed +in this release is Moderate. + +This release incorporates the following bug fixes and mitigations: + + * Fixed QUIC server being able to trigger double free when processing + `INITIAL` packet. + ([CVE-2026-18798]) + + * Fixed heap buffer overflow in CMS key unwrapping. + ([CVE-2026-63072]) + + * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`. + ([CVE-2026-63076]) + + * Fixed unbounded memory growth in QUIC server incoming channel queue. + ([CVE-2026-14456]) + + * Fixed RPK server signature algorithm selection being able to dereference + a missing certificate. + ([CVE-2026-14457]) + + * Fixed excessive memory use buffering DTLS records for a future epoch. + ([CVE-2026-54874]) + + * Fixed untrusted Sender DN being used as a format string in CMP response + validation. + ([CVE-2026-63073]) + + * Fixed CMP indefinite cache growth of `extraCerts`. + ([CVE-2026-63074]) + + * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. + ([CVE-2026-63075]) + + * Fixed possibility of AEAD forgeries with empty ciphertext when using + `EVP_Cipher()`. + ([CVE-2026-75803]) + + * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers + in CCM cipher mode. + ### Major changes between OpenSSL 3.5.6 and OpenSSL 3.5.7 [9 Jun 2026] OpenSSL 3.5.7 is a security patch release. The most severe CVE fixed @@ -78,6 +122,8 @@ This release incorporates the following bug fixes and mitigations: and AES-SIV modes. ([CVE-2026-45446]) + * Fixed excessive allocation of the handshake message buffer (aka HollowByte). + ### Major changes between OpenSSL 3.5.5 and OpenSSL 3.5.6 [7 Apr 2026] OpenSSL 3.5.6 is a security patch release. The most severe CVE fixed in this @@ -2267,6 +2313,9 @@ OpenSSL 0.9.x [CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673 [CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383 [CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076 +[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456 +[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457 +[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798 [CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795 [CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796 [CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387 @@ -2288,6 +2337,13 @@ OpenSSL 0.9.x [CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445 [CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446 [CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447 +[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874 +[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072 +[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073 +[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074 +[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075 +[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076 +[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations [OpenSSL Guide]: https://www.openssl.org/docs/manmaster/man7/ossl-guide-introduction.html [README-QUIC.md]: ./README-QUIC.md diff --git a/deps/openssl/openssl/README-FIPS.md b/deps/openssl/openssl/README-FIPS.md index b31f8c65304b..feb6892a2c47 100644 --- a/deps/openssl/openssl/README-FIPS.md +++ b/deps/openssl/openssl/README-FIPS.md @@ -32,11 +32,15 @@ Installing the FIPS provider ============================ In order to be FIPS compliant you must only use FIPS validated source code. -Refer to for information related to +Refer to for information related to which versions are FIPS validated. The instructions given below build OpenSSL -just using the FIPS validated source code. Any FIPS validated version may be -used with any other openssl library. Please see -To determine which FIPS validated library version may be appropriate for you. +just using the FIPS validated source code. A FIPS provider built from any +validated version may be used together with an OpenSSL library built from any +supported release from OpenSSL 3.0 onwards; provider compatibility is +maintained backward and forward across these releases, including future major +release series, for as long as the module remains supported. Please see + +to determine which FIPS validated library version may be appropriate for you. If you want to use a validated FIPS provider, but also want to use the latest OpenSSL release to build everything else, then refer to the next section. diff --git a/deps/openssl/openssl/VERSION.dat b/deps/openssl/openssl/VERSION.dat index a297eee91e17..bf654c1a7713 100644 --- a/deps/openssl/openssl/VERSION.dat +++ b/deps/openssl/openssl/VERSION.dat @@ -1,7 +1,7 @@ MAJOR=3 MINOR=5 -PATCH=7 +PATCH=8 PRE_RELEASE_TAG= BUILD_METADATA= -RELEASE_DATE="9 Jun 2026" +RELEASE_DATE="25 Aug 2026" SHLIB_VERSION=3 diff --git a/deps/openssl/openssl/apps/lib/apps.c b/deps/openssl/openssl/apps/lib/apps.c index e5a2b162b4ef..29dd6514f6d9 100644 --- a/deps/openssl/openssl/apps/lib/apps.c +++ b/deps/openssl/openssl/apps/lib/apps.c @@ -1688,11 +1688,18 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr) goto err; #ifndef OPENSSL_NO_POSIX_IO - BIO_get_fp(in, &dbfp); - if (fstat(fileno(dbfp), &dbst) == -1) { - ERR_raise_data(ERR_LIB_SYS, errno, - "calling fstat(%s)", dbfile); - goto err; + if (BIO_get_fp(in, &dbfp) > 0 && dbfp != NULL) { + if (fstat(fileno(dbfp), &dbst) == -1) { + ERR_raise_data(ERR_LIB_SYS, errno, + "calling fstat(%s)", dbfile); + goto err; + } + } else { + if (stat(dbfile, &dbst) == -1) { + ERR_raise_data(ERR_LIB_SYS, errno, + "calling stat(%s)", dbfile); + goto err; + } } #endif @@ -1722,8 +1729,14 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr) } retdb->dbfname = OPENSSL_strdup(dbfile); - if (retdb->dbfname == NULL) + if (retdb->dbfname == NULL) { + TXT_DB_free(retdb->db); + retdb->db = NULL; + OPENSSL_free(retdb); + retdb = NULL; + ERR_raise_data(ERR_LIB_SYS, errno, "Out of memory while copying filename: %s", dbfile); goto err; + } #ifndef OPENSSL_NO_POSIX_IO retdb->dbst = dbst; diff --git a/deps/openssl/openssl/apps/lib/s_cb.c b/deps/openssl/openssl/apps/lib/s_cb.c index 80b5c6555424..760ad010988b 100644 --- a/deps/openssl/openssl/apps/lib/s_cb.c +++ b/deps/openssl/openssl/apps/lib/s_cb.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -1461,10 +1461,7 @@ static STRINT_PAIR callback_types[] = { { "Signature Algorithm mask", SSL_SECOP_SIGALG_MASK }, { "Certificate chain EE key", SSL_SECOP_EE_KEY }, { "Certificate chain CA key", SSL_SECOP_CA_KEY }, - { "Peer Chain EE key", SSL_SECOP_PEER_EE_KEY }, - { "Peer Chain CA key", SSL_SECOP_PEER_CA_KEY }, { "Certificate chain CA digest", SSL_SECOP_CA_MD }, - { "Peer chain CA digest", SSL_SECOP_PEER_CA_MD }, { "SSL compression", SSL_SECOP_COMPRESSION }, { "Session ticket", SSL_SECOP_TICKET }, { NULL } @@ -1498,7 +1495,6 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx, show_nm = 0; break; case SSL_SECOP_CA_MD: - case SSL_SECOP_PEER_CA_MD: cert_md = 1; break; case SSL_SECOP_SIGALG_SUPPORTED: diff --git a/deps/openssl/openssl/apps/lib/vms_term_sock.c b/deps/openssl/openssl/apps/lib/vms_term_sock.c index faceb05d0145..15bc6665694d 100644 --- a/deps/openssl/openssl/apps/lib/vms_term_sock.c +++ b/deps/openssl/openssl/apps/lib/vms_term_sock.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2016 VMS Software, Inc. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -230,6 +230,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket) LogMessage("TerminalSocket: SYS$QIO () - %08X", status); close(TerminalSocketPair[0]); close(TerminalSocketPair[1]); + sys$dassgn(TerminalDeviceChan); return TERM_SOCK_FAILURE; } @@ -248,6 +249,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket) LogMessage("TerminalSocket: SYS$CANCEL () - %08X", status); close(TerminalSocketPair[0]); close(TerminalSocketPair[1]); + sys$dassgn(TerminalDeviceChan); return TERM_SOCK_FAILURE; } diff --git a/deps/openssl/openssl/apps/s_client.c b/deps/openssl/openssl/apps/s_client.c index 9b88d6dfbc86..b3f333a6993c 100644 --- a/deps/openssl/openssl/apps/s_client.c +++ b/deps/openssl/openssl/apps/s_client.c @@ -2846,11 +2846,9 @@ int s_client_main(int argc, char **argv) } /* * According to RFC 5804 § 2.2, response codes are case- - * insensitive, make it uppercase but preserve the response. + * insensitive. */ - strncpy(sbuf, mbuf, 2); - make_uppercase(sbuf); - if (!HAS_PREFIX(sbuf, "OK")) { + if (OPENSSL_strncasecmp(mbuf, "OK", 2) != 0) { BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf); goto shut; } @@ -3349,29 +3347,32 @@ int s_client_main(int argc, char **argv) print_stuff(bio_c_out, con, full_log); do_ssl_shutdown(con); - /* - * If we ended with an alert being sent, but still with data in the - * network buffer to be read, then calling BIO_closesocket() will - * result in a TCP-RST being sent. On some platforms (notably - * Windows) then this will result in the peer immediately abandoning - * the connection including any buffered alert data before it has - * had a chance to be read. Shutting down the sending side first, - * and then closing the socket sends TCP-FIN first followed by - * TCP-RST. This seems to allow the peer to read the alert data. - */ - shutdown(SSL_get_fd(con), 1); /* SHUT_WR */ - /* - * We just said we have nothing else to say, but it doesn't mean that - * the other side has nothing. It's even recommended to consume incoming - * data. [In testing context this ensures that alerts are passed on...] - */ - timeout.tv_sec = 0; - timeout.tv_usec = 500000; /* some extreme round-trip */ - do { - FD_ZERO(&readfds); - openssl_fdset(sock, &readfds); - } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0 - && BIO_read(sbio, sbuf, BUFSIZZ) > 0); + /* The following half-close/drain workaround is TCP-specific. */ + if (!isdtls && !isquic) { + /* + * If we ended with an alert being sent, but still with data in the + * network buffer to be read, then calling BIO_closesocket() will + * result in a TCP-RST being sent. On some platforms (notably + * Windows) then this will result in the peer immediately abandoning + * the connection including any buffered alert data before it has + * had a chance to be read. Shutting down the sending side first, + * and then closing the socket sends TCP-FIN first followed by + * TCP-RST. This seems to allow the peer to read the alert data. + */ + shutdown(SSL_get_fd(con), 1); /* SHUT_WR */ + /* + * We just said we have nothing else to say, but it doesn't mean that + * the other side has nothing. It's even recommended to consume incoming + * data. [In testing context this ensures that alerts are passed on...] + */ + timeout.tv_sec = 0; + timeout.tv_usec = 500000; /* some extreme round-trip */ + do { + FD_ZERO(&readfds); + openssl_fdset(sock, &readfds); + } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0 + && BIO_read(sbio, sbuf, BUFSIZZ) > 0); + } BIO_closesocket(SSL_get_fd(con)); end: diff --git a/deps/openssl/openssl/crypto/aes/aes_x86core.c b/deps/openssl/openssl/crypto/aes/aes_x86core.c deleted file mode 100644 index 0fa994871b27..000000000000 --- a/deps/openssl/openssl/crypto/aes/aes_x86core.c +++ /dev/null @@ -1,867 +0,0 @@ -/* - * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * This is experimental x86[_64] derivative. It assumes little-endian - * byte order and expects CPU to sustain unaligned memory references. - * It is used as playground for cache-time attack mitigations and - * serves as reference C implementation for x86[_64] as well as some - * other assembly modules. - */ - -/** - * rijndael-alg-fst.c - * - * @version 3.0 (December 2000) - * - * Optimised ANSI C code for the Rijndael cipher (now AES) - * - * @author Vincent Rijmen - * @author Antoon Bosselaers - * @author Paulo Barreto - * - * This code is hereby placed in the public domain. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS - * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR - * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, - * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE - * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, - * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -#include - -#include -#include -#include "aes_local.h" - -/* - * These two parameters control which table, 256-byte or 2KB, is - * referenced in outer and respectively inner rounds. - */ -#define AES_COMPACT_IN_OUTER_ROUNDS -#ifdef AES_COMPACT_IN_OUTER_ROUNDS -/* AES_COMPACT_IN_OUTER_ROUNDS costs ~30% in performance, while - * adding AES_COMPACT_IN_INNER_ROUNDS reduces benchmark *further* - * by factor of ~2. */ -#undef AES_COMPACT_IN_INNER_ROUNDS -#endif - -#if 1 -static void prefetch256(const void *table) -{ - volatile unsigned long *t = (void *)table, ret; - unsigned long sum; - int i; - - /* 32 is common least cache-line size */ - for (sum = 0, i = 0; i < 256 / sizeof(t[0]); i += 32 / sizeof(t[0])) - sum ^= t[i]; - - ret = sum; -} -#else -#define prefetch256(t) -#endif - -#undef GETU32 -#define GETU32(p) (*((u32 *)(p))) - -#if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__) -#define U64(C) C##UI64 -#elif defined(__arch64__) -#define U64(C) C##UL -#else -#define U64(C) C##ULL -#endif - -#undef ROTATE -#if defined(_MSC_VER) -#define ROTATE(a, n) _lrotl(a, n) -#elif defined(__ICC) -#define ROTATE(a, n) _rotl(a, n) -#elif defined(__GNUC__) && __GNUC__ >= 2 -#if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__) -#define ROTATE(a, n) ({ \ - register unsigned int ret; \ - asm( \ - "roll %1,%0" \ - : "=r"(ret) \ - : "I"(n), "0"(a) \ - : "cc"); \ - ret; \ -}) -#endif -#endif -/*- -Te [x] = S [x].[02, 01, 01, 03, 02, 01, 01, 03]; -Te0[x] = S [x].[02, 01, 01, 03]; -Te1[x] = S [x].[03, 02, 01, 01]; -Te2[x] = S [x].[01, 03, 02, 01]; -Te3[x] = S [x].[01, 01, 03, 02]; -*/ -#define Te0 (u32)((u64 *)((u8 *)Te + 0)) -#define Te1 (u32)((u64 *)((u8 *)Te + 3)) -#define Te2 (u32)((u64 *)((u8 *)Te + 2)) -#define Te3 (u32)((u64 *)((u8 *)Te + 1)) -/*- -Td [x] = Si[x].[0e, 09, 0d, 0b, 0e, 09, 0d, 0b]; -Td0[x] = Si[x].[0e, 09, 0d, 0b]; -Td1[x] = Si[x].[0b, 0e, 09, 0d]; -Td2[x] = Si[x].[0d, 0b, 0e, 09]; -Td3[x] = Si[x].[09, 0d, 0b, 0e]; -Td4[x] = Si[x].[01]; -*/ -#define Td0 (u32)((u64 *)((u8 *)Td + 0)) -#define Td1 (u32)((u64 *)((u8 *)Td + 3)) -#define Td2 (u32)((u64 *)((u8 *)Td + 2)) -#define Td3 (u32)((u64 *)((u8 *)Td + 1)) - -static const u64 Te[256] = { - U64(0xa56363c6a56363c6), U64(0x847c7cf8847c7cf8), - U64(0x997777ee997777ee), U64(0x8d7b7bf68d7b7bf6), - U64(0x0df2f2ff0df2f2ff), U64(0xbd6b6bd6bd6b6bd6), - U64(0xb16f6fdeb16f6fde), U64(0x54c5c59154c5c591), - U64(0x5030306050303060), U64(0x0301010203010102), - U64(0xa96767cea96767ce), U64(0x7d2b2b567d2b2b56), - U64(0x19fefee719fefee7), U64(0x62d7d7b562d7d7b5), - U64(0xe6abab4de6abab4d), U64(0x9a7676ec9a7676ec), - U64(0x45caca8f45caca8f), U64(0x9d82821f9d82821f), - U64(0x40c9c98940c9c989), U64(0x877d7dfa877d7dfa), - U64(0x15fafaef15fafaef), U64(0xeb5959b2eb5959b2), - U64(0xc947478ec947478e), U64(0x0bf0f0fb0bf0f0fb), - U64(0xecadad41ecadad41), U64(0x67d4d4b367d4d4b3), - U64(0xfda2a25ffda2a25f), U64(0xeaafaf45eaafaf45), - U64(0xbf9c9c23bf9c9c23), U64(0xf7a4a453f7a4a453), - U64(0x967272e4967272e4), U64(0x5bc0c09b5bc0c09b), - U64(0xc2b7b775c2b7b775), U64(0x1cfdfde11cfdfde1), - U64(0xae93933dae93933d), U64(0x6a26264c6a26264c), - U64(0x5a36366c5a36366c), U64(0x413f3f7e413f3f7e), - U64(0x02f7f7f502f7f7f5), U64(0x4fcccc834fcccc83), - U64(0x5c3434685c343468), U64(0xf4a5a551f4a5a551), - U64(0x34e5e5d134e5e5d1), U64(0x08f1f1f908f1f1f9), - U64(0x937171e2937171e2), U64(0x73d8d8ab73d8d8ab), - U64(0x5331316253313162), U64(0x3f15152a3f15152a), - U64(0x0c0404080c040408), U64(0x52c7c79552c7c795), - U64(0x6523234665232346), U64(0x5ec3c39d5ec3c39d), - U64(0x2818183028181830), U64(0xa1969637a1969637), - U64(0x0f05050a0f05050a), U64(0xb59a9a2fb59a9a2f), - U64(0x0907070e0907070e), U64(0x3612122436121224), - U64(0x9b80801b9b80801b), U64(0x3de2e2df3de2e2df), - U64(0x26ebebcd26ebebcd), U64(0x6927274e6927274e), - U64(0xcdb2b27fcdb2b27f), U64(0x9f7575ea9f7575ea), - U64(0x1b0909121b090912), U64(0x9e83831d9e83831d), - U64(0x742c2c58742c2c58), U64(0x2e1a1a342e1a1a34), - U64(0x2d1b1b362d1b1b36), U64(0xb26e6edcb26e6edc), - U64(0xee5a5ab4ee5a5ab4), U64(0xfba0a05bfba0a05b), - U64(0xf65252a4f65252a4), U64(0x4d3b3b764d3b3b76), - U64(0x61d6d6b761d6d6b7), U64(0xceb3b37dceb3b37d), - U64(0x7b2929527b292952), U64(0x3ee3e3dd3ee3e3dd), - U64(0x712f2f5e712f2f5e), U64(0x9784841397848413), - U64(0xf55353a6f55353a6), U64(0x68d1d1b968d1d1b9), - U64(0x0000000000000000), U64(0x2cededc12cededc1), - U64(0x6020204060202040), U64(0x1ffcfce31ffcfce3), - U64(0xc8b1b179c8b1b179), U64(0xed5b5bb6ed5b5bb6), - U64(0xbe6a6ad4be6a6ad4), U64(0x46cbcb8d46cbcb8d), - U64(0xd9bebe67d9bebe67), U64(0x4b3939724b393972), - U64(0xde4a4a94de4a4a94), U64(0xd44c4c98d44c4c98), - U64(0xe85858b0e85858b0), U64(0x4acfcf854acfcf85), - U64(0x6bd0d0bb6bd0d0bb), U64(0x2aefefc52aefefc5), - U64(0xe5aaaa4fe5aaaa4f), U64(0x16fbfbed16fbfbed), - U64(0xc5434386c5434386), U64(0xd74d4d9ad74d4d9a), - U64(0x5533336655333366), U64(0x9485851194858511), - U64(0xcf45458acf45458a), U64(0x10f9f9e910f9f9e9), - U64(0x0602020406020204), U64(0x817f7ffe817f7ffe), - U64(0xf05050a0f05050a0), U64(0x443c3c78443c3c78), - U64(0xba9f9f25ba9f9f25), U64(0xe3a8a84be3a8a84b), - U64(0xf35151a2f35151a2), U64(0xfea3a35dfea3a35d), - U64(0xc0404080c0404080), U64(0x8a8f8f058a8f8f05), - U64(0xad92923fad92923f), U64(0xbc9d9d21bc9d9d21), - U64(0x4838387048383870), U64(0x04f5f5f104f5f5f1), - U64(0xdfbcbc63dfbcbc63), U64(0xc1b6b677c1b6b677), - U64(0x75dadaaf75dadaaf), U64(0x6321214263212142), - U64(0x3010102030101020), U64(0x1affffe51affffe5), - U64(0x0ef3f3fd0ef3f3fd), U64(0x6dd2d2bf6dd2d2bf), - U64(0x4ccdcd814ccdcd81), U64(0x140c0c18140c0c18), - U64(0x3513132635131326), U64(0x2fececc32fececc3), - U64(0xe15f5fbee15f5fbe), U64(0xa2979735a2979735), - U64(0xcc444488cc444488), U64(0x3917172e3917172e), - U64(0x57c4c49357c4c493), U64(0xf2a7a755f2a7a755), - U64(0x827e7efc827e7efc), U64(0x473d3d7a473d3d7a), - U64(0xac6464c8ac6464c8), U64(0xe75d5dbae75d5dba), - U64(0x2b1919322b191932), U64(0x957373e6957373e6), - U64(0xa06060c0a06060c0), U64(0x9881811998818119), - U64(0xd14f4f9ed14f4f9e), U64(0x7fdcdca37fdcdca3), - U64(0x6622224466222244), U64(0x7e2a2a547e2a2a54), - U64(0xab90903bab90903b), U64(0x8388880b8388880b), - U64(0xca46468cca46468c), U64(0x29eeeec729eeeec7), - U64(0xd3b8b86bd3b8b86b), U64(0x3c1414283c141428), - U64(0x79dedea779dedea7), U64(0xe25e5ebce25e5ebc), - U64(0x1d0b0b161d0b0b16), U64(0x76dbdbad76dbdbad), - U64(0x3be0e0db3be0e0db), U64(0x5632326456323264), - U64(0x4e3a3a744e3a3a74), U64(0x1e0a0a141e0a0a14), - U64(0xdb494992db494992), U64(0x0a06060c0a06060c), - U64(0x6c2424486c242448), U64(0xe45c5cb8e45c5cb8), - U64(0x5dc2c29f5dc2c29f), U64(0x6ed3d3bd6ed3d3bd), - U64(0xefacac43efacac43), U64(0xa66262c4a66262c4), - U64(0xa8919139a8919139), U64(0xa4959531a4959531), - U64(0x37e4e4d337e4e4d3), U64(0x8b7979f28b7979f2), - U64(0x32e7e7d532e7e7d5), U64(0x43c8c88b43c8c88b), - U64(0x5937376e5937376e), U64(0xb76d6ddab76d6dda), - U64(0x8c8d8d018c8d8d01), U64(0x64d5d5b164d5d5b1), - U64(0xd24e4e9cd24e4e9c), U64(0xe0a9a949e0a9a949), - U64(0xb46c6cd8b46c6cd8), U64(0xfa5656acfa5656ac), - U64(0x07f4f4f307f4f4f3), U64(0x25eaeacf25eaeacf), - U64(0xaf6565caaf6565ca), U64(0x8e7a7af48e7a7af4), - U64(0xe9aeae47e9aeae47), U64(0x1808081018080810), - U64(0xd5baba6fd5baba6f), U64(0x887878f0887878f0), - U64(0x6f25254a6f25254a), U64(0x722e2e5c722e2e5c), - U64(0x241c1c38241c1c38), U64(0xf1a6a657f1a6a657), - U64(0xc7b4b473c7b4b473), U64(0x51c6c69751c6c697), - U64(0x23e8e8cb23e8e8cb), U64(0x7cdddda17cdddda1), - U64(0x9c7474e89c7474e8), U64(0x211f1f3e211f1f3e), - U64(0xdd4b4b96dd4b4b96), U64(0xdcbdbd61dcbdbd61), - U64(0x868b8b0d868b8b0d), U64(0x858a8a0f858a8a0f), - U64(0x907070e0907070e0), U64(0x423e3e7c423e3e7c), - U64(0xc4b5b571c4b5b571), U64(0xaa6666ccaa6666cc), - U64(0xd8484890d8484890), U64(0x0503030605030306), - U64(0x01f6f6f701f6f6f7), U64(0x120e0e1c120e0e1c), - U64(0xa36161c2a36161c2), U64(0x5f35356a5f35356a), - U64(0xf95757aef95757ae), U64(0xd0b9b969d0b9b969), - U64(0x9186861791868617), U64(0x58c1c19958c1c199), - U64(0x271d1d3a271d1d3a), U64(0xb99e9e27b99e9e27), - U64(0x38e1e1d938e1e1d9), U64(0x13f8f8eb13f8f8eb), - U64(0xb398982bb398982b), U64(0x3311112233111122), - U64(0xbb6969d2bb6969d2), U64(0x70d9d9a970d9d9a9), - U64(0x898e8e07898e8e07), U64(0xa7949433a7949433), - U64(0xb69b9b2db69b9b2d), U64(0x221e1e3c221e1e3c), - U64(0x9287871592878715), U64(0x20e9e9c920e9e9c9), - U64(0x49cece8749cece87), U64(0xff5555aaff5555aa), - U64(0x7828285078282850), U64(0x7adfdfa57adfdfa5), - U64(0x8f8c8c038f8c8c03), U64(0xf8a1a159f8a1a159), - U64(0x8089890980898909), U64(0x170d0d1a170d0d1a), - U64(0xdabfbf65dabfbf65), U64(0x31e6e6d731e6e6d7), - U64(0xc6424284c6424284), U64(0xb86868d0b86868d0), - U64(0xc3414182c3414182), U64(0xb0999929b0999929), - U64(0x772d2d5a772d2d5a), U64(0x110f0f1e110f0f1e), - U64(0xcbb0b07bcbb0b07b), U64(0xfc5454a8fc5454a8), - U64(0xd6bbbb6dd6bbbb6d), U64(0x3a16162c3a16162c) -}; - -static const u8 Te4[256] = { - 0x63U, 0x7cU, 0x77U, 0x7bU, 0xf2U, 0x6bU, 0x6fU, 0xc5U, - 0x30U, 0x01U, 0x67U, 0x2bU, 0xfeU, 0xd7U, 0xabU, 0x76U, - 0xcaU, 0x82U, 0xc9U, 0x7dU, 0xfaU, 0x59U, 0x47U, 0xf0U, - 0xadU, 0xd4U, 0xa2U, 0xafU, 0x9cU, 0xa4U, 0x72U, 0xc0U, - 0xb7U, 0xfdU, 0x93U, 0x26U, 0x36U, 0x3fU, 0xf7U, 0xccU, - 0x34U, 0xa5U, 0xe5U, 0xf1U, 0x71U, 0xd8U, 0x31U, 0x15U, - 0x04U, 0xc7U, 0x23U, 0xc3U, 0x18U, 0x96U, 0x05U, 0x9aU, - 0x07U, 0x12U, 0x80U, 0xe2U, 0xebU, 0x27U, 0xb2U, 0x75U, - 0x09U, 0x83U, 0x2cU, 0x1aU, 0x1bU, 0x6eU, 0x5aU, 0xa0U, - 0x52U, 0x3bU, 0xd6U, 0xb3U, 0x29U, 0xe3U, 0x2fU, 0x84U, - 0x53U, 0xd1U, 0x00U, 0xedU, 0x20U, 0xfcU, 0xb1U, 0x5bU, - 0x6aU, 0xcbU, 0xbeU, 0x39U, 0x4aU, 0x4cU, 0x58U, 0xcfU, - 0xd0U, 0xefU, 0xaaU, 0xfbU, 0x43U, 0x4dU, 0x33U, 0x85U, - 0x45U, 0xf9U, 0x02U, 0x7fU, 0x50U, 0x3cU, 0x9fU, 0xa8U, - 0x51U, 0xa3U, 0x40U, 0x8fU, 0x92U, 0x9dU, 0x38U, 0xf5U, - 0xbcU, 0xb6U, 0xdaU, 0x21U, 0x10U, 0xffU, 0xf3U, 0xd2U, - 0xcdU, 0x0cU, 0x13U, 0xecU, 0x5fU, 0x97U, 0x44U, 0x17U, - 0xc4U, 0xa7U, 0x7eU, 0x3dU, 0x64U, 0x5dU, 0x19U, 0x73U, - 0x60U, 0x81U, 0x4fU, 0xdcU, 0x22U, 0x2aU, 0x90U, 0x88U, - 0x46U, 0xeeU, 0xb8U, 0x14U, 0xdeU, 0x5eU, 0x0bU, 0xdbU, - 0xe0U, 0x32U, 0x3aU, 0x0aU, 0x49U, 0x06U, 0x24U, 0x5cU, - 0xc2U, 0xd3U, 0xacU, 0x62U, 0x91U, 0x95U, 0xe4U, 0x79U, - 0xe7U, 0xc8U, 0x37U, 0x6dU, 0x8dU, 0xd5U, 0x4eU, 0xa9U, - 0x6cU, 0x56U, 0xf4U, 0xeaU, 0x65U, 0x7aU, 0xaeU, 0x08U, - 0xbaU, 0x78U, 0x25U, 0x2eU, 0x1cU, 0xa6U, 0xb4U, 0xc6U, - 0xe8U, 0xddU, 0x74U, 0x1fU, 0x4bU, 0xbdU, 0x8bU, 0x8aU, - 0x70U, 0x3eU, 0xb5U, 0x66U, 0x48U, 0x03U, 0xf6U, 0x0eU, - 0x61U, 0x35U, 0x57U, 0xb9U, 0x86U, 0xc1U, 0x1dU, 0x9eU, - 0xe1U, 0xf8U, 0x98U, 0x11U, 0x69U, 0xd9U, 0x8eU, 0x94U, - 0x9bU, 0x1eU, 0x87U, 0xe9U, 0xceU, 0x55U, 0x28U, 0xdfU, - 0x8cU, 0xa1U, 0x89U, 0x0dU, 0xbfU, 0xe6U, 0x42U, 0x68U, - 0x41U, 0x99U, 0x2dU, 0x0fU, 0xb0U, 0x54U, 0xbbU, 0x16U -}; - -static const u64 Td[256] = { - U64(0x50a7f45150a7f451), U64(0x5365417e5365417e), - U64(0xc3a4171ac3a4171a), U64(0x965e273a965e273a), - U64(0xcb6bab3bcb6bab3b), U64(0xf1459d1ff1459d1f), - U64(0xab58faacab58faac), U64(0x9303e34b9303e34b), - U64(0x55fa302055fa3020), U64(0xf66d76adf66d76ad), - U64(0x9176cc889176cc88), U64(0x254c02f5254c02f5), - U64(0xfcd7e54ffcd7e54f), U64(0xd7cb2ac5d7cb2ac5), - U64(0x8044352680443526), U64(0x8fa362b58fa362b5), - U64(0x495ab1de495ab1de), U64(0x671bba25671bba25), - U64(0x980eea45980eea45), U64(0xe1c0fe5de1c0fe5d), - U64(0x02752fc302752fc3), U64(0x12f04c8112f04c81), - U64(0xa397468da397468d), U64(0xc6f9d36bc6f9d36b), - U64(0xe75f8f03e75f8f03), U64(0x959c9215959c9215), - U64(0xeb7a6dbfeb7a6dbf), U64(0xda595295da595295), - U64(0x2d83bed42d83bed4), U64(0xd3217458d3217458), - U64(0x2969e0492969e049), U64(0x44c8c98e44c8c98e), - U64(0x6a89c2756a89c275), U64(0x78798ef478798ef4), - U64(0x6b3e58996b3e5899), U64(0xdd71b927dd71b927), - U64(0xb64fe1beb64fe1be), U64(0x17ad88f017ad88f0), - U64(0x66ac20c966ac20c9), U64(0xb43ace7db43ace7d), - U64(0x184adf63184adf63), U64(0x82311ae582311ae5), - U64(0x6033519760335197), U64(0x457f5362457f5362), - U64(0xe07764b1e07764b1), U64(0x84ae6bbb84ae6bbb), - U64(0x1ca081fe1ca081fe), U64(0x942b08f9942b08f9), - U64(0x5868487058684870), U64(0x19fd458f19fd458f), - U64(0x876cde94876cde94), U64(0xb7f87b52b7f87b52), - U64(0x23d373ab23d373ab), U64(0xe2024b72e2024b72), - U64(0x578f1fe3578f1fe3), U64(0x2aab55662aab5566), - U64(0x0728ebb20728ebb2), U64(0x03c2b52f03c2b52f), - U64(0x9a7bc5869a7bc586), U64(0xa50837d3a50837d3), - U64(0xf2872830f2872830), U64(0xb2a5bf23b2a5bf23), - U64(0xba6a0302ba6a0302), U64(0x5c8216ed5c8216ed), - U64(0x2b1ccf8a2b1ccf8a), U64(0x92b479a792b479a7), - U64(0xf0f207f3f0f207f3), U64(0xa1e2694ea1e2694e), - U64(0xcdf4da65cdf4da65), U64(0xd5be0506d5be0506), - U64(0x1f6234d11f6234d1), U64(0x8afea6c48afea6c4), - U64(0x9d532e349d532e34), U64(0xa055f3a2a055f3a2), - U64(0x32e18a0532e18a05), U64(0x75ebf6a475ebf6a4), - U64(0x39ec830b39ec830b), U64(0xaaef6040aaef6040), - U64(0x069f715e069f715e), U64(0x51106ebd51106ebd), - U64(0xf98a213ef98a213e), U64(0x3d06dd963d06dd96), - U64(0xae053eddae053edd), U64(0x46bde64d46bde64d), - U64(0xb58d5491b58d5491), U64(0x055dc471055dc471), - U64(0x6fd406046fd40604), U64(0xff155060ff155060), - U64(0x24fb981924fb9819), U64(0x97e9bdd697e9bdd6), - U64(0xcc434089cc434089), U64(0x779ed967779ed967), - U64(0xbd42e8b0bd42e8b0), U64(0x888b8907888b8907), - U64(0x385b19e7385b19e7), U64(0xdbeec879dbeec879), - U64(0x470a7ca1470a7ca1), U64(0xe90f427ce90f427c), - U64(0xc91e84f8c91e84f8), U64(0x0000000000000000), - U64(0x8386800983868009), U64(0x48ed2b3248ed2b32), - U64(0xac70111eac70111e), U64(0x4e725a6c4e725a6c), - U64(0xfbff0efdfbff0efd), U64(0x5638850f5638850f), - U64(0x1ed5ae3d1ed5ae3d), U64(0x27392d3627392d36), - U64(0x64d90f0a64d90f0a), U64(0x21a65c6821a65c68), - U64(0xd1545b9bd1545b9b), U64(0x3a2e36243a2e3624), - U64(0xb1670a0cb1670a0c), U64(0x0fe757930fe75793), - U64(0xd296eeb4d296eeb4), U64(0x9e919b1b9e919b1b), - U64(0x4fc5c0804fc5c080), U64(0xa220dc61a220dc61), - U64(0x694b775a694b775a), U64(0x161a121c161a121c), - U64(0x0aba93e20aba93e2), U64(0xe52aa0c0e52aa0c0), - U64(0x43e0223c43e0223c), U64(0x1d171b121d171b12), - U64(0x0b0d090e0b0d090e), U64(0xadc78bf2adc78bf2), - U64(0xb9a8b62db9a8b62d), U64(0xc8a91e14c8a91e14), - U64(0x8519f1578519f157), U64(0x4c0775af4c0775af), - U64(0xbbdd99eebbdd99ee), U64(0xfd607fa3fd607fa3), - U64(0x9f2601f79f2601f7), U64(0xbcf5725cbcf5725c), - U64(0xc53b6644c53b6644), U64(0x347efb5b347efb5b), - U64(0x7629438b7629438b), U64(0xdcc623cbdcc623cb), - U64(0x68fcedb668fcedb6), U64(0x63f1e4b863f1e4b8), - U64(0xcadc31d7cadc31d7), U64(0x1085634210856342), - U64(0x4022971340229713), U64(0x2011c6842011c684), - U64(0x7d244a857d244a85), U64(0xf83dbbd2f83dbbd2), - U64(0x1132f9ae1132f9ae), U64(0x6da129c76da129c7), - U64(0x4b2f9e1d4b2f9e1d), U64(0xf330b2dcf330b2dc), - U64(0xec52860dec52860d), U64(0xd0e3c177d0e3c177), - U64(0x6c16b32b6c16b32b), U64(0x99b970a999b970a9), - U64(0xfa489411fa489411), U64(0x2264e9472264e947), - U64(0xc48cfca8c48cfca8), U64(0x1a3ff0a01a3ff0a0), - U64(0xd82c7d56d82c7d56), U64(0xef903322ef903322), - U64(0xc74e4987c74e4987), U64(0xc1d138d9c1d138d9), - U64(0xfea2ca8cfea2ca8c), U64(0x360bd498360bd498), - U64(0xcf81f5a6cf81f5a6), U64(0x28de7aa528de7aa5), - U64(0x268eb7da268eb7da), U64(0xa4bfad3fa4bfad3f), - U64(0xe49d3a2ce49d3a2c), U64(0x0d9278500d927850), - U64(0x9bcc5f6a9bcc5f6a), U64(0x62467e5462467e54), - U64(0xc2138df6c2138df6), U64(0xe8b8d890e8b8d890), - U64(0x5ef7392e5ef7392e), U64(0xf5afc382f5afc382), - U64(0xbe805d9fbe805d9f), U64(0x7c93d0697c93d069), - U64(0xa92dd56fa92dd56f), U64(0xb31225cfb31225cf), - U64(0x3b99acc83b99acc8), U64(0xa77d1810a77d1810), - U64(0x6e639ce86e639ce8), U64(0x7bbb3bdb7bbb3bdb), - U64(0x097826cd097826cd), U64(0xf418596ef418596e), - U64(0x01b79aec01b79aec), U64(0xa89a4f83a89a4f83), - U64(0x656e95e6656e95e6), U64(0x7ee6ffaa7ee6ffaa), - U64(0x08cfbc2108cfbc21), U64(0xe6e815efe6e815ef), - U64(0xd99be7bad99be7ba), U64(0xce366f4ace366f4a), - U64(0xd4099fead4099fea), U64(0xd67cb029d67cb029), - U64(0xafb2a431afb2a431), U64(0x31233f2a31233f2a), - U64(0x3094a5c63094a5c6), U64(0xc066a235c066a235), - U64(0x37bc4e7437bc4e74), U64(0xa6ca82fca6ca82fc), - U64(0xb0d090e0b0d090e0), U64(0x15d8a73315d8a733), - U64(0x4a9804f14a9804f1), U64(0xf7daec41f7daec41), - U64(0x0e50cd7f0e50cd7f), U64(0x2ff691172ff69117), - U64(0x8dd64d768dd64d76), U64(0x4db0ef434db0ef43), - U64(0x544daacc544daacc), U64(0xdf0496e4df0496e4), - U64(0xe3b5d19ee3b5d19e), U64(0x1b886a4c1b886a4c), - U64(0xb81f2cc1b81f2cc1), U64(0x7f5165467f516546), - U64(0x04ea5e9d04ea5e9d), U64(0x5d358c015d358c01), - U64(0x737487fa737487fa), U64(0x2e410bfb2e410bfb), - U64(0x5a1d67b35a1d67b3), U64(0x52d2db9252d2db92), - U64(0x335610e9335610e9), U64(0x1347d66d1347d66d), - U64(0x8c61d79a8c61d79a), U64(0x7a0ca1377a0ca137), - U64(0x8e14f8598e14f859), U64(0x893c13eb893c13eb), - U64(0xee27a9ceee27a9ce), U64(0x35c961b735c961b7), - U64(0xede51ce1ede51ce1), U64(0x3cb1477a3cb1477a), - U64(0x59dfd29c59dfd29c), U64(0x3f73f2553f73f255), - U64(0x79ce141879ce1418), U64(0xbf37c773bf37c773), - U64(0xeacdf753eacdf753), U64(0x5baafd5f5baafd5f), - U64(0x146f3ddf146f3ddf), U64(0x86db447886db4478), - U64(0x81f3afca81f3afca), U64(0x3ec468b93ec468b9), - U64(0x2c3424382c342438), U64(0x5f40a3c25f40a3c2), - U64(0x72c31d1672c31d16), U64(0x0c25e2bc0c25e2bc), - U64(0x8b493c288b493c28), U64(0x41950dff41950dff), - U64(0x7101a8397101a839), U64(0xdeb30c08deb30c08), - U64(0x9ce4b4d89ce4b4d8), U64(0x90c1566490c15664), - U64(0x6184cb7b6184cb7b), U64(0x70b632d570b632d5), - U64(0x745c6c48745c6c48), U64(0x4257b8d04257b8d0) -}; -static const u8 Td4[256] = { - 0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U, - 0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU, - 0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U, - 0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU, - 0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU, - 0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU, - 0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U, - 0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U, - 0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U, - 0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U, - 0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU, - 0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U, - 0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU, - 0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U, - 0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U, - 0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU, - 0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU, - 0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U, - 0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U, - 0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU, - 0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U, - 0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU, - 0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U, - 0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U, - 0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U, - 0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU, - 0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU, - 0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU, - 0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U, - 0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U, - 0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U, - 0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU -}; - -static const u32 rcon[] = { - 0x00000001U, - 0x00000002U, - 0x00000004U, - 0x00000008U, - 0x00000010U, - 0x00000020U, - 0x00000040U, - 0x00000080U, - 0x0000001bU, - 0x00000036U, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */ -}; - -/** - * Expand the cipher key into the encryption key schedule. - */ -int AES_set_encrypt_key(const unsigned char *userKey, const int bits, - AES_KEY *key) -{ - - u32 *rk; - int i = 0; - u32 temp; - - if (!userKey || !key) - return -1; - if (bits != 128 && bits != 192 && bits != 256) - return -2; - - rk = key->rd_key; - - if (bits == 128) - key->rounds = 10; - else if (bits == 192) - key->rounds = 12; - else - key->rounds = 14; - - rk[0] = GETU32(userKey); - rk[1] = GETU32(userKey + 4); - rk[2] = GETU32(userKey + 8); - rk[3] = GETU32(userKey + 12); - if (bits == 128) { - while (1) { - temp = rk[3]; - rk[4] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i]; - rk[5] = rk[1] ^ rk[4]; - rk[6] = rk[2] ^ rk[5]; - rk[7] = rk[3] ^ rk[6]; - if (++i == 10) { - return 0; - } - rk += 4; - } - } - rk[4] = GETU32(userKey + 16); - rk[5] = GETU32(userKey + 20); - if (bits == 192) { - while (1) { - temp = rk[5]; - rk[6] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i]; - rk[7] = rk[1] ^ rk[6]; - rk[8] = rk[2] ^ rk[7]; - rk[9] = rk[3] ^ rk[8]; - if (++i == 8) { - return 0; - } - rk[10] = rk[4] ^ rk[9]; - rk[11] = rk[5] ^ rk[10]; - rk += 6; - } - } - rk[6] = GETU32(userKey + 24); - rk[7] = GETU32(userKey + 28); - if (bits == 256) { - while (1) { - temp = rk[7]; - rk[8] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i]; - rk[9] = rk[1] ^ rk[8]; - rk[10] = rk[2] ^ rk[9]; - rk[11] = rk[3] ^ rk[10]; - if (++i == 7) { - return 0; - } - temp = rk[11]; - rk[12] = rk[4] ^ ((u32)Te4[(temp) & 0xff]) ^ ((u32)Te4[(temp >> 8) & 0xff] << 8) ^ ((u32)Te4[(temp >> 16) & 0xff] << 16) ^ ((u32)Te4[(temp >> 24)] << 24); - rk[13] = rk[5] ^ rk[12]; - rk[14] = rk[6] ^ rk[13]; - rk[15] = rk[7] ^ rk[14]; - - rk += 8; - } - } - return 0; -} - -/** - * Expand the cipher key into the decryption key schedule. - */ -int AES_set_decrypt_key(const unsigned char *userKey, const int bits, - AES_KEY *key) -{ - - u32 *rk; - int i, j, status; - u32 temp; - - /* first, start with an encryption schedule */ - status = AES_set_encrypt_key(userKey, bits, key); - if (status < 0) - return status; - - rk = key->rd_key; - - /* invert the order of the round keys: */ - for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) { - temp = rk[i]; - rk[i] = rk[j]; - rk[j] = temp; - temp = rk[i + 1]; - rk[i + 1] = rk[j + 1]; - rk[j + 1] = temp; - temp = rk[i + 2]; - rk[i + 2] = rk[j + 2]; - rk[j + 2] = temp; - temp = rk[i + 3]; - rk[i + 3] = rk[j + 3]; - rk[j + 3] = temp; - } - /* apply the inverse MixColumn transform to all round keys but the first and the last: */ - for (i = 1; i < (key->rounds); i++) { - rk += 4; -#if 1 - for (j = 0; j < 4; j++) { - u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m; - - tp1 = rk[j]; - m = tp1 & 0x80808080; - tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp2 & 0x80808080; - tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp4 & 0x80808080; - tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - tp9 = tp8 ^ tp1; - tpb = tp9 ^ tp2; - tpd = tp9 ^ tp4; - tpe = tp8 ^ tp4 ^ tp2; -#if defined(ROTATE) - rk[j] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24); -#else - rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24); -#endif - } -#else - rk[0] = Td0[Te2[(rk[0]) & 0xff] & 0xff] ^ Td1[Te2[(rk[0] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[0] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[0] >> 24)] & 0xff]; - rk[1] = Td0[Te2[(rk[1]) & 0xff] & 0xff] ^ Td1[Te2[(rk[1] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[1] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[1] >> 24)] & 0xff]; - rk[2] = Td0[Te2[(rk[2]) & 0xff] & 0xff] ^ Td1[Te2[(rk[2] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[2] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[2] >> 24)] & 0xff]; - rk[3] = Td0[Te2[(rk[3]) & 0xff] & 0xff] ^ Td1[Te2[(rk[3] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[3] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[3] >> 24)] & 0xff]; -#endif - } - return 0; -} - -/* - * Encrypt a single block - * in and out can overlap - */ -void AES_encrypt(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -{ - - const u32 *rk; - u32 s0, s1, s2, s3, t[4]; - int r; - - assert(in && out && key); - rk = key->rd_key; - - /* - * map byte array block to cipher state - * and add initial round key: - */ - s0 = GETU32(in) ^ rk[0]; - s1 = GETU32(in + 4) ^ rk[1]; - s2 = GETU32(in + 8) ^ rk[2]; - s3 = GETU32(in + 12) ^ rk[3]; - -#if defined(AES_COMPACT_IN_OUTER_ROUNDS) - prefetch256(Te4); - - t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24; - t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24; - t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24; - t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24; - - /* now do the linear transform using words */ - { - int i; - u32 r0, r1, r2; - - for (i = 0; i < 4; i++) { - r0 = t[i]; - r1 = r0 & 0x80808080; - r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b); -#if defined(ROTATE) - t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8); -#else - t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24); -#endif - t[i] ^= rk[4 + i]; - } - } -#else - t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[4]; - t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[5]; - t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[6]; - t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[7]; -#endif - s0 = t[0]; - s1 = t[1]; - s2 = t[2]; - s3 = t[3]; - - /* - * Nr - 2 full rounds: - */ - for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) { -#if defined(AES_COMPACT_IN_INNER_ROUNDS) - t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24; - t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24; - t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24; - t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24; - - /* now do the linear transform using words */ - { - int i; - u32 r0, r1, r2; - - for (i = 0; i < 4; i++) { - r0 = t[i]; - r1 = r0 & 0x80808080; - r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b); -#if defined(ROTATE) - t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8); -#else - t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24); -#endif - t[i] ^= rk[i]; - } - } -#else - t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[0]; - t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[1]; - t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[2]; - t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[3]; -#endif - s0 = t[0]; - s1 = t[1]; - s2 = t[2]; - s3 = t[3]; - } - /* - * apply last round and - * map cipher state to byte array block: - */ -#if defined(AES_COMPACT_IN_OUTER_ROUNDS) - prefetch256(Te4); - - *(u32 *)(out + 0) = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24 ^ rk[0]; - *(u32 *)(out + 4) = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24 ^ rk[1]; - *(u32 *)(out + 8) = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24 ^ rk[2]; - *(u32 *)(out + 12) = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24 ^ rk[3]; -#else - *(u32 *)(out + 0) = (Te2[(s0) & 0xff] & 0x000000ffU) ^ (Te3[(s1 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s3 >> 24)] & 0xff000000U) ^ rk[0]; - *(u32 *)(out + 4) = (Te2[(s1) & 0xff] & 0x000000ffU) ^ (Te3[(s2 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s0 >> 24)] & 0xff000000U) ^ rk[1]; - *(u32 *)(out + 8) = (Te2[(s2) & 0xff] & 0x000000ffU) ^ (Te3[(s3 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s1 >> 24)] & 0xff000000U) ^ rk[2]; - *(u32 *)(out + 12) = (Te2[(s3) & 0xff] & 0x000000ffU) ^ (Te3[(s0 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s2 >> 24)] & 0xff000000U) ^ rk[3]; -#endif -} - -/* - * Decrypt a single block - * in and out can overlap - */ -void AES_decrypt(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -{ - - const u32 *rk; - u32 s0, s1, s2, s3, t[4]; - int r; - - assert(in && out && key); - rk = key->rd_key; - - /* - * map byte array block to cipher state - * and add initial round key: - */ - s0 = GETU32(in) ^ rk[0]; - s1 = GETU32(in + 4) ^ rk[1]; - s2 = GETU32(in + 8) ^ rk[2]; - s3 = GETU32(in + 12) ^ rk[3]; - -#if defined(AES_COMPACT_IN_OUTER_ROUNDS) - prefetch256(Td4); - - t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24; - t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24; - t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24; - t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24; - - /* now do the linear transform using words */ - { - int i; - u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m; - - for (i = 0; i < 4; i++) { - tp1 = t[i]; - m = tp1 & 0x80808080; - tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp2 & 0x80808080; - tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp4 & 0x80808080; - tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - tp9 = tp8 ^ tp1; - tpb = tp9 ^ tp2; - tpd = tp9 ^ tp4; - tpe = tp8 ^ tp4 ^ tp2; -#if defined(ROTATE) - t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24); -#else - t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24); -#endif - t[i] ^= rk[4 + i]; - } - } -#else - t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[4]; - t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[5]; - t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[6]; - t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[7]; -#endif - s0 = t[0]; - s1 = t[1]; - s2 = t[2]; - s3 = t[3]; - - /* - * Nr - 2 full rounds: - */ - for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) { -#if defined(AES_COMPACT_IN_INNER_ROUNDS) - t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24; - t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24; - t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24; - t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24; - - /* now do the linear transform using words */ - { - int i; - u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m; - - for (i = 0; i < 4; i++) { - tp1 = t[i]; - m = tp1 & 0x80808080; - tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp2 & 0x80808080; - tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - m = tp4 & 0x80808080; - tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b); - tp9 = tp8 ^ tp1; - tpb = tp9 ^ tp2; - tpd = tp9 ^ tp4; - tpe = tp8 ^ tp4 ^ tp2; -#if defined(ROTATE) - t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24); -#else - t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24); -#endif - t[i] ^= rk[i]; - } - } -#else - t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[0]; - t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[1]; - t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[2]; - t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[3]; -#endif - s0 = t[0]; - s1 = t[1]; - s2 = t[2]; - s3 = t[3]; - } - /* - * apply last round and - * map cipher state to byte array block: - */ - prefetch256(Td4); - - *(u32 *)(out + 0) = ((u32)Td4[(s0) & 0xff]) ^ ((u32)Td4[(s3 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s2 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s1 >> 24)] << 24) ^ rk[0]; - *(u32 *)(out + 4) = ((u32)Td4[(s1) & 0xff]) ^ ((u32)Td4[(s0 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s3 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s2 >> 24)] << 24) ^ rk[1]; - *(u32 *)(out + 8) = ((u32)Td4[(s2) & 0xff]) ^ ((u32)Td4[(s1 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s0 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s3 >> 24)] << 24) ^ rk[2]; - *(u32 *)(out + 12) = ((u32)Td4[(s3) & 0xff]) ^ ((u32)Td4[(s2 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s1 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s0 >> 24)] << 24) ^ rk[3]; -} diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl index dde15b1ef7ee..87ed95cdf33c 100644 --- a/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl +++ b/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -80,6 +80,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl index 4e8fa1d753d7..bc08da946064 100644 --- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl +++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2011-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -111,6 +111,9 @@ $1>=10); $avx=1 if (!$avx && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|.*based on LLVM) ([0-9]+\.[0-9]+)/ && $2>=3.0); +$avx=1 if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ && + $1>=11); #icx started with clang 11 + $shaext=1; ### set to zero if compiling for 1.0.1 $stitched_decrypt=0; diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl index 39d29ddbb022..6715ba2e11a7 100644 --- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl +++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -75,6 +75,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + $shaext=$avx; ### set to zero if compiling for 1.0.1 $avx=1 if (!$shaext && $avx); diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl index d89564112e31..16f2bbe78964 100644 --- a/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl +++ b/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl @@ -59,6 +59,13 @@ } } +if (!$avx512vaes && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx512vaes = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/armcap.c b/deps/openssl/openssl/crypto/armcap.c index 03e47dc5bbfb..3005d295cfd0 100644 --- a/deps/openssl/openssl/crypto/armcap.c +++ b/deps/openssl/openssl/crypto/armcap.c @@ -1,5 +1,5 @@ /* - * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -408,14 +408,38 @@ void OPENSSL_cpuid_setup(void) if (OPENSSL_armcap_P & ARMV8_CPUID) OPENSSL_arm_midr = _armv8_cpuid_probe(); - if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1)) && (OPENSSL_armcap_P & ARMV7_NEON)) { + if ((OPENSSL_armcap_P & ARMV7_NEON) + && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1))) OPENSSL_armv8_rsa_neonized = 1; - } - if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3)) + + if ((OPENSSL_armcap_P & ARMV8_SHA3) + && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) + || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE)) OPENSSL_armcap_P |= ARMV8_UNROLL8_EOR3; - if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3)) + + if ((OPENSSL_armcap_P & ARMV8_SHA3) + && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) + || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE)) OPENSSL_armcap_P |= ARMV8_UNROLL12_EOR3; - if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)) && (OPENSSL_armcap_P & ARMV8_SHA3)) + + if ((OPENSSL_armcap_P & ARMV8_SHA3) + && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) + || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX))) OPENSSL_armcap_P |= ARMV8_HAVE_SHA3_AND_WORTH_USING; #endif } diff --git a/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c b/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c index a23dea8ebda2..19595683ef98 100644 --- a/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c +++ b/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c @@ -139,7 +139,20 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb) } i = BIO_read(in, &(b->data[len]), want); if (i <= 0) { - ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA); + /* + * A read error (i < 0), an EOF in the middle of an object + * (diff != 0, some bytes already buffered), or an EOF while + * still inside an indefinite-length constructed value awaiting + * its end-of-contents octets (eos != 0) all mean the input is + * truncated. Only a clean EOF at a top-level object boundary + * (i == 0, diff == 0, eos == 0) is the normal end of input: + * fail without queuing an error so that callers looping over + * concatenated DER values (e.g. the libcrypto d2i_*_bio() + * consumers in CPython's ssl module) terminate cleanly instead + * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA. + */ + if (i < 0 || diff != 0 || eos != 0) + ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA); goto err; } if (i > 0) { diff --git a/deps/openssl/openssl/crypto/asn1/a_mbstr.c b/deps/openssl/openssl/crypto/asn1/a_mbstr.c index ce5618dfd48b..9a61f7f1e051 100644 --- a/deps/openssl/openssl/crypto/asn1/a_mbstr.c +++ b/deps/openssl/openssl/crypto/asn1/a_mbstr.c @@ -51,12 +51,24 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len, unsigned char *p; int nchar; int (*cpyfunc)(unsigned long, void *) = NULL; - if (len == -1) - len = strlen((const char *)in); + if (len == -1) { + size_t len_s = strlen((const char *)in); + + if (len_s >= INT_MAX) { + ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG); + return -1; + } + len = (int)len_s; + } if (!mask) mask = DIRSTRING_TYPE; - if (len < 0) + if (len < 0) { + ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_INVALID_ARGUMENT); + return -1; + } else if (len >= INT_MAX) { + ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG); return -1; + } /* First do a string check and work out the number of characters */ switch (inform) { @@ -294,7 +306,7 @@ static int out_utf8(unsigned long value, void *arg) return len; } outlen = arg; - if (*outlen > INT_MAX - len) { + if (*outlen >= INT_MAX - len) { ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG); return -1; } diff --git a/deps/openssl/openssl/crypto/asn1/asn1_gen.c b/deps/openssl/openssl/crypto/asn1/asn1_gen.c index 1c8d3d585940..69fbd6f89e58 100644 --- a/deps/openssl/openssl/crypto/asn1/asn1_gen.c +++ b/deps/openssl/openssl/crypto/asn1/asn1_gen.c @@ -426,8 +426,11 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf, depth + 1, perr); if (!typ) goto bad; - if (!sk_ASN1_TYPE_push(sk, typ)) + + if (!sk_ASN1_TYPE_push(sk, typ)) { + ASN1_TYPE_free(typ); goto bad; + } } } diff --git a/deps/openssl/openssl/crypto/bio/bss_file.c b/deps/openssl/openssl/crypto/bio/bss_file.c index 6b8daeb95f90..023bb458ce5f 100644 --- a/deps/openssl/openssl/crypto/bio/bss_file.c +++ b/deps/openssl/openssl/crypto/bio/bss_file.c @@ -312,7 +312,13 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr) /* the ptr parameter is actually a FILE ** in this case. */ if (ptr != NULL) { fpp = (FILE **)ptr; - *fpp = (FILE *)b->ptr; + if (BIO_FLAGS_UPLINK_INTERNAL == 0 + || b->flags & BIO_FLAGS_UPLINK_INTERNAL) { + *fpp = (FILE *)b->ptr; + } else { /* avoid returning internal FILE * to the app */ + *fpp = NULL; + ret = 0; + } } break; case BIO_CTRL_GET_CLOSE: diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl index 27f2e9b4b938..6c0cb566f9d7 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl @@ -1,4 +1,4 @@ -# Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2020, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -64,6 +64,13 @@ } } +if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx512ifma = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl index b84a3e4f1954..52d9781834d6 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl @@ -39,6 +39,13 @@ $avxifma = ($ver>=16.0); } +if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avxifma = ($1>=16); + } +} + if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) && `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) { my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001 diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl index b2ed3e8ca7cf..fe5b1ebefab6 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl @@ -1,4 +1,4 @@ -# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2021, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -63,6 +63,13 @@ } } +if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx512ifma = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl index 1948d726b38b..aa11c546af6d 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl @@ -38,6 +38,13 @@ $avxifma = ($ver>=16.0); } +if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avxifma = ($1>=16); + } +} + if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) && `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) { $avxifma = ($1>2.16) + ($1==2.16 && ((!defined($2) && !defined($3)) || (defined($2)))); diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl index b76ab5904c88..b07180f6feca 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl @@ -1,4 +1,4 @@ -# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2021, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -63,6 +63,13 @@ } } +if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx512ifma = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl index 9f299430cefc..28a447800d0d 100644 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl @@ -38,6 +38,13 @@ $avxifma = ($ver>=16.0); } +if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avxifma = ($1>=16); + } +} + if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) && `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) { $avxifma = ($1>2.16) + ($1==2.16 && ((!defined($2) && !defined($3)) || (defined($2)))); diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl index 59b9c89b5be2..29243a7c0b76 100755 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2012, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -73,6 +73,14 @@ $addx = ($ver>=3.03); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $addx = ($1>=11); #icx started with clang 11 + $avx = ($1>=11); + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT = *OUT; diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl index 64acf8f0d84d..3ceacea1d338 100755 --- a/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl +++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2012, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -90,6 +90,13 @@ $addx = ($ver>=3.03); } +if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $addx = ($1>=11); #icx started with clang 11 + } +} + ($out, $inp, $mod) = ("%rdi", "%rsi", "%rbp"); # common internal API { my ($out,$inp,$mod,$n0,$times) = ("%rdi","%rsi","%rdx","%rcx","%r8d"); diff --git a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl index 140072b899dc..9c7b3091f434 100755 --- a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl +++ b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2005-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -82,6 +82,13 @@ $addx = ($ver>=3.03); } +if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $addx = ($1>=11); #icx started with clang 11 + } +} + # int bn_mul_mont( $rp="%rdi"; # BN_ULONG *rp, $ap="%rsi"; # const BN_ULONG *ap, diff --git a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl index e06d13d74aea..52f95a485317 100755 --- a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl +++ b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2011-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -69,6 +69,13 @@ $addx = ($ver>=3.03); } +if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $addx = ($1>=11); #icx started with clang 11 + } +} + # int bn_mul_mont_gather5( $rp="%rdi"; # BN_ULONG *rp, $ap="%rsi"; # const BN_ULONG *ap, diff --git a/deps/openssl/openssl/crypto/bn/bn_add.c b/deps/openssl/openssl/crypto/bn/bn_add.c index 38de39d1b8ac..9c028269840c 100644 --- a/deps/openssl/openssl/crypto/bn/bn_add.c +++ b/deps/openssl/openssl/crypto/bn/bn_add.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -97,6 +97,8 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) return 0; r->top = max; + if (max == 0) + goto end; ap = a->d; bp = b->d; @@ -116,6 +118,7 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) *rp = carry; r->top += carry; +end: r->neg = 0; bn_check_top(r); return 1; @@ -143,6 +146,9 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) if (bn_wexpand(r, max) == NULL) return 0; + if (max == 0) + goto end; + ap = a->d; bp = b->d; rp = r->d; @@ -162,6 +168,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) while (max && *--rp == 0) max--; +end: r->top = max; r->neg = 0; bn_pollute(r); diff --git a/deps/openssl/openssl/crypto/bn/bn_exp.c b/deps/openssl/openssl/crypto/bn/bn_exp.c index 44931f803802..ddcd89e2d4bc 100644 --- a/deps/openssl/openssl/crypto/bn/bn_exp.c +++ b/deps/openssl/openssl/crypto/bn/bn_exp.c @@ -552,7 +552,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, BN_ULONG acc = 0; for (j = 0; j < width; j++) { - acc |= table[j] & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1)); + acc |= table[j] & value_barrier_bn((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1)); } b->d[i] = acc; @@ -573,8 +573,9 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, BN_ULONG acc = 0; for (j = 0; j < xstride; j++) { - acc |= ((table[j + 0 * xstride] & y0) | (table[j + 1 * xstride] & y1) | (table[j + 2 * xstride] & y2) | (table[j + 3 * xstride] & y3)) - & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1)); + acc |= ((table[j + 0 * xstride] & value_barrier_bn(y0)) | (table[j + 1 * xstride] & value_barrier_bn(y1)) + | (table[j + 2 * xstride] & value_barrier_bn(y2)) | (table[j + 3 * xstride] & value_barrier_bn(y3))) + & value_barrier_bn((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1)); } b->d[i] = acc; diff --git a/deps/openssl/openssl/crypto/bn/bn_lib.c b/deps/openssl/openssl/crypto/bn/bn_lib.c index 93d54fd0a6ed..7961906f9ae7 100644 --- a/deps/openssl/openssl/crypto/bn/bn_lib.c +++ b/deps/openssl/openssl/crypto/bn/bn_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -707,19 +707,37 @@ int BN_ucmp(const BIGNUM *a, const BIGNUM *b) int i; BN_ULONG t1, t2, *ap, *bp; + /* + * As it is a public API function, we should handle NULL parameters in + * some way. The function can’t return an error, so let’s define that NULL + * is less than any BIGNUM. + */ + if (!ossl_assert(a != NULL && b != NULL)) + return (b == NULL) - (a == NULL); + ap = a->d; bp = b->d; if (BN_get_flags(a, BN_FLG_CONSTTIME) - && a->top == b->top) { + || BN_get_flags(b, BN_FLG_CONSTTIME)) { int res = 0; + int min_top = a->top < b->top ? a->top : b->top; - for (i = 0; i < b->top; i++) { + for (i = 0; i < min_top; i++) { res = constant_time_select_int(constant_time_lt_bn(ap[i], bp[i]), -1, res); res = constant_time_select_int(constant_time_lt_bn(bp[i], ap[i]), 1, res); } + + for (i = min_top; i < a->top; ++i) + res = constant_time_select_int((int)constant_time_is_zero_bn(ap[i]), + res, 1); + + for (i = min_top; i < b->top; ++i) + res = constant_time_select_int((int)constant_time_is_zero_bn(bp[i]), + res, -1); + return res; } @@ -948,11 +966,11 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords) condition = ((~condition & ((condition - 1))) >> (BN_BITS2 - 1)) - 1; - t = (a->top ^ b->top) & condition; + t = (a->top ^ b->top) & value_barrier_bn(condition); a->top ^= t; b->top ^= t; - t = (a->neg ^ b->neg) & condition; + t = (a->neg ^ b->neg) & value_barrier_bn(condition); a->neg ^= t; b->neg ^= t; @@ -980,13 +998,13 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords) #define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP) - t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition; + t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & value_barrier_bn(condition); a->flags ^= t; b->flags ^= t; /* conditionally swap the data */ for (i = 0; i < nwords; i++) { - t = (a->d[i] ^ b->d[i]) & condition; + t = (a->d[i] ^ b->d[i]) & value_barrier_bn(condition); a->d[i] ^= t; b->d[i] ^= t; } diff --git a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl index a1ea4ea461b0..b95d4df37979 100755 --- a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl +++ b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -64,6 +64,10 @@ `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/ && $2>=3.0); # first version supporting AVX +$ymm=1 if ($xmm && !$ymm && + `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ && + $1>=11); #icx started with clang 11 + $a="eax"; ($b,$b_)=("ebx","ebp"); ($c,$c_)=("ecx","esi"); diff --git a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl index d46bc03b3eec..69e5319ad43e 100755 --- a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl +++ b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -91,6 +91,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/cmp/cmp_protect.c b/deps/openssl/openssl/crypto/cmp/cmp_protect.c index 1c8d2135fdab..110693b84038 100644 --- a/deps/openssl/openssl/crypto/cmp/cmp_protect.c +++ b/deps/openssl/openssl/crypto/cmp/cmp_protect.c @@ -1,5 +1,5 @@ /* - * Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright Nokia 2007-2019 * Copyright Siemens AG 2015-2019 * @@ -66,7 +66,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx, ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET); return NULL; } - if (ppval == NULL) { + if (pptype != V_ASN1_SEQUENCE || ppval == NULL) { ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION); return NULL; } diff --git a/deps/openssl/openssl/crypto/cmp/cmp_vfy.c b/deps/openssl/openssl/crypto/cmp/cmp_vfy.c index eaa700d139d1..e79adb09d387 100644 --- a/deps/openssl/openssl/crypto/cmp/cmp_vfy.c +++ b/deps/openssl/openssl/crypto/cmp/cmp_vfy.c @@ -64,8 +64,10 @@ static int verify_signature(const OSSL_CMP_CTX *cmp_ctx, sig_err: res = ossl_x509_print_ex_brief(bio, cert, X509_FLAG_NO_EXTENSIONS); ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_VALIDATING_SIGNATURE); - if (res) - ERR_add_error_mem_bio("\n", bio); + if (res) { + ERR_add_error_txt(NULL, "\n"); + ERR_add_error_mem_bio(NULL, bio); + } res = 0; end: @@ -387,7 +389,7 @@ static int check_msg_with_certs(OSSL_CMP_CTX *ctx, const STACK_OF(X509) *certs, int i; if (sk_X509_num(certs) <= 0) { - ossl_cmp_log1(WARN, ctx, "no %s", desc); + ossl_cmp_log1(INFO, ctx, "no %s", desc); return 0; } @@ -407,7 +409,7 @@ static int check_msg_with_certs(OSSL_CMP_CTX *ctx, const STACK_OF(X509) *certs, } } if (in_extraCerts && n_acceptable_certs == 0) - ossl_cmp_warn(ctx, "no acceptable cert in extraCerts"); + ossl_cmp_log1(WARN, ctx, "no acceptable %s", desc); return 0; } @@ -502,14 +504,14 @@ static int check_msg_find_cert(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg) res = check_msg_all_certs(ctx, msg, 0 /* using ctx->trusted */) || check_msg_all_certs(ctx, msg, 1 /* 3gpp */); - ctx->log_cb = backup_log_cb; - if (res) { - /* discard any diagnostic information on trying to use certs */ - (void)ERR_pop_to_mark(); + + ctx->log_cb = backup_log_cb; /* re-enable logging */ + /* discard any previous diagnostic information on trying to use certs */ + (void)ERR_pop_to_mark(); + + if (res) goto end; - } /* failed finding a sender cert that verifies the message signature */ - (void)ERR_clear_last_mark(); sname = X509_NAME_oneline(sender->d.directoryName, NULL, 0); skid_str = skid == NULL ? NULL : i2s_ASN1_OCTET_STRING(NULL, skid); @@ -732,7 +734,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg, "expected sender", expected_sender)) { str = X509_NAME_oneline(actual_sender, NULL, 0); ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER, - str != NULL ? str : ""); + "%s", str != NULL ? str : ""); OPENSSL_free(str); return 0; } @@ -776,8 +778,13 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg, res = 1; /* support more aggressive fuzzing by letting invalid msg pass */ #endif - /* remove extraCerts again if not caching */ - if (ctx->noCacheExtraCerts) + /* + * remove extraCerts again if not caching + * or if we failed validation above, lest a remote user + * starts sending us lots of certificates in invalid messages + * leading to a DOS from unbounded certificate stack growth + */ + if (ctx->noCacheExtraCerts || res != 1) while (num_added-- > 0) X509_free(sk_X509_shift(ctx->untrusted)); diff --git a/deps/openssl/openssl/crypto/cms/cms_asn1.c b/deps/openssl/openssl/crypto/cms/cms_asn1.c index fb87f6c6ad27..b3c103699031 100644 --- a/deps/openssl/openssl/crypto/cms/cms_asn1.c +++ b/deps/openssl/openssl/crypto/cms/cms_asn1.c @@ -245,9 +245,9 @@ ASN1_NDEF_SEQUENCE(CMS_AuthEnvelopedData) = { ASN1_IMP_OPT(CMS_AuthEnvelopedData, originatorInfo, CMS_OriginatorInfo, 0), ASN1_SET_OF(CMS_AuthEnvelopedData, recipientInfos, CMS_RecipientInfo), ASN1_SIMPLE(CMS_AuthEnvelopedData, authEncryptedContentInfo, CMS_EncryptedContentInfo), - ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, authAttrs, X509_ALGOR, 2), + ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, authAttrs, X509_ATTRIBUTE, 1), ASN1_SIMPLE(CMS_AuthEnvelopedData, mac, ASN1_OCTET_STRING), - ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, unauthAttrs, X509_ALGOR, 3) + ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, unauthAttrs, X509_ATTRIBUTE, 2) } ASN1_NDEF_SEQUENCE_END(CMS_AuthEnvelopedData) ASN1_NDEF_SEQUENCE(CMS_AuthenticatedData) = { @@ -257,9 +257,9 @@ ASN1_NDEF_SEQUENCE(CMS_AuthenticatedData) = { ASN1_SIMPLE(CMS_AuthenticatedData, macAlgorithm, X509_ALGOR), ASN1_IMP(CMS_AuthenticatedData, digestAlgorithm, X509_ALGOR, 1), ASN1_SIMPLE(CMS_AuthenticatedData, encapContentInfo, CMS_EncapsulatedContentInfo), - ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, authAttrs, X509_ALGOR, 2), + ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, authAttrs, X509_ATTRIBUTE, 2), ASN1_SIMPLE(CMS_AuthenticatedData, mac, ASN1_OCTET_STRING), - ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, unauthAttrs, X509_ALGOR, 3) + ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, unauthAttrs, X509_ATTRIBUTE, 3) } static_ASN1_NDEF_SEQUENCE_END(CMS_AuthenticatedData) ASN1_NDEF_SEQUENCE(CMS_CompressedData) diff --git a/deps/openssl/openssl/crypto/cms/cms_env.c b/deps/openssl/openssl/crypto/cms/cms_env.c index a8ecabb64ed7..ee86ae71d3ed 100644 --- a/deps/openssl/openssl/crypto/cms/cms_env.c +++ b/deps/openssl/openssl/crypto/cms/cms_env.c @@ -928,6 +928,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms, CMS_EncryptedContentInfo *ec; CMS_KEKRecipientInfo *kekri; unsigned char *ukey = NULL; + size_t ukey_alloc_len = 0; int ukeylen; int r = 0, wrap_nid; EVP_CIPHER *cipher = NULL; @@ -965,7 +966,8 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms, goto err; } - ukey = OPENSSL_malloc(kekri->encryptedKey->length - 8); + ukey_alloc_len = (size_t)kekri->encryptedKey->length - 8; + ukey = OPENSSL_malloc(ukey_alloc_len); if (ukey == NULL) goto err; @@ -994,7 +996,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms, err: EVP_CIPHER_free(cipher); if (!r) - OPENSSL_free(ukey); + OPENSSL_clear_free(ukey, ukey_alloc_len); EVP_CIPHER_CTX_free(ctx); return r; @@ -1204,6 +1206,35 @@ BIO *ossl_cms_EnvelopedData_init_bio(CMS_ContentInfo *cms) return cms_EnvelopedData_Decryption_init_bio(cms); } +/* The DER encoding of authAttrs, with the universal SET OF tag, is the AAD */ +static int cms_AuthEnvelopedData_set_aad(BIO *b, + STACK_OF(X509_ATTRIBUTE) *authAttrs) +{ + EVP_CIPHER_CTX *ctx; + unsigned char *aad = NULL; + int aadlen, outl, ok = 0; + const ASN1_ITEM *item; + + if (!BIO_get_cipher_ctx(b, &ctx)) + return 0; + item = EVP_CIPHER_CTX_is_encrypting(ctx) + ? ASN1_ITEM_rptr(CMS_Attributes_AadEncrypt) + : ASN1_ITEM_rptr(CMS_Attributes_AadDecrypt); + aadlen = ASN1_item_i2d((ASN1_VALUE *)authAttrs, &aad, item); + if (aadlen <= 0 || aad == NULL) { + ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB); + goto err; + } + if (EVP_CipherUpdate(ctx, NULL, &outl, aad, aadlen) <= 0) { + ERR_raise(ERR_LIB_CMS, CMS_R_CTRL_FAILURE); + goto err; + } + ok = 1; +err: + OPENSSL_free(aad); + return ok; +} + BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms) { CMS_EncryptedContentInfo *ec; @@ -1220,9 +1251,16 @@ BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms) ec->taglen = aenv->mac->length; } ret = ossl_cms_EncryptedContent_init_bio(ec, ossl_cms_get0_cmsctx(cms), 1); + if (ret == NULL) + return NULL; + + /* authAttrs, if present, are the AEAD associated data */ + if (aenv->authAttrs != NULL + && !cms_AuthEnvelopedData_set_aad(ret, aenv->authAttrs)) + goto err; - /* If error or no cipher end of processing */ - if (ret == NULL || ec->cipher == NULL) + /* If no cipher end of processing */ + if (ec->cipher == NULL) return ret; /* Now encrypt content key according to each RecipientInfo type */ diff --git a/deps/openssl/openssl/crypto/cms/cms_kari.c b/deps/openssl/openssl/crypto/cms/cms_kari.c index eb5b5d786285..459991525f09 100644 --- a/deps/openssl/openssl/crypto/cms/cms_kari.c +++ b/deps/openssl/openssl/crypto/cms/cms_kari.c @@ -1,5 +1,5 @@ /* - * Copyright 2013-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -216,7 +216,9 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen, size_t keklen; int rv = 0; unsigned char *out = NULL; + size_t out_alloc_len = 0; int outlen; + size_t outsize; keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx); if (keklen > EVP_MAX_KEY_LENGTH) @@ -230,10 +232,17 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen, /* obtain output length of ciphered key */ if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen)) goto err; - out = OPENSSL_malloc(outlen); + /* + * On its integrity-failure paths that primitive writes and cleanses up to + * inlen bytes of the output buffer. Size the buffer for that worst case so + * a failed unwrap cannot write past the allocation. + */ + outsize = (size_t)outlen < inlen ? inlen : (size_t)outlen; + out = OPENSSL_malloc(outsize); if (out == NULL) goto err; - if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, inlen)) + out_alloc_len = (size_t)outlen; + if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, (int)inlen)) goto err; *pout = out; *poutlen = (size_t)outlen; @@ -242,7 +251,7 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen, err: OPENSSL_cleanse(kek, keklen); if (!rv) - OPENSSL_free(out); + OPENSSL_clear_free(out, out_alloc_len); EVP_CIPHER_CTX_reset(kari->ctx); /* FIXME: WHY IS kari->pctx freed here? /RL */ EVP_PKEY_CTX_free(kari->pctx); diff --git a/deps/openssl/openssl/crypto/cms/cms_local.h b/deps/openssl/openssl/crypto/cms/cms_local.h index 94496b3823ef..55f41af054be 100644 --- a/deps/openssl/openssl/crypto/cms/cms_local.h +++ b/deps/openssl/openssl/crypto/cms/cms_local.h @@ -371,6 +371,9 @@ DECLARE_ASN1_ITEM(CMS_EncryptedContentInfo) DECLARE_ASN1_ITEM(CMS_IssuerAndSerialNumber) DECLARE_ASN1_ITEM(CMS_Attributes_Sign) DECLARE_ASN1_ITEM(CMS_Attributes_Verify) +/* The authAttrs AAD encoding matches the signed-attributes one */ +#define CMS_Attributes_AadEncrypt_it CMS_Attributes_Sign_it +#define CMS_Attributes_AadDecrypt_it CMS_Attributes_Verify_it DECLARE_ASN1_ITEM(CMS_RecipientInfo) DECLARE_ASN1_ITEM(CMS_PasswordRecipientInfo) DECLARE_ASN1_ALLOC_FUNCTIONS(CMS_IssuerAndSerialNumber) diff --git a/deps/openssl/openssl/crypto/cms/cms_pwri.c b/deps/openssl/openssl/crypto/cms/cms_pwri.c index 54f0eda2a2d8..de59c74fdd6e 100644 --- a/deps/openssl/openssl/crypto/cms/cms_pwri.c +++ b/deps/openssl/openssl/crypto/cms/cms_pwri.c @@ -315,6 +315,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, EVP_CIPHER *kekcipher; unsigned char *key = NULL; size_t keylen; + size_t key_alloc_len = 0; const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms); ec = ossl_cms_get0_env_enc_content(cms); @@ -391,6 +392,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, if (key == NULL) goto err; + key_alloc_len = keylen; if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx, cms_ctx)) goto err; @@ -400,6 +402,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, key = OPENSSL_malloc(pwri->encryptedKey->length); if (key == NULL) goto err; + key_alloc_len = (size_t)pwri->encryptedKey->length; if (!kek_unwrap_key(key, &keylen, pwri->encryptedKey->data, pwri->encryptedKey->length, kekctx)) { @@ -419,7 +422,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, EVP_CIPHER_CTX_free(kekctx); if (!r) - OPENSSL_free(key); + OPENSSL_clear_free(key, key_alloc_len); X509_ALGOR_free(kekalg); return r; diff --git a/deps/openssl/openssl/crypto/cms/cms_smime.c b/deps/openssl/openssl/crypto/cms/cms_smime.c index 4b5009b9d5bf..dea1df084764 100644 --- a/deps/openssl/openssl/crypto/cms/cms_smime.c +++ b/deps/openssl/openssl/crypto/cms/cms_smime.c @@ -36,6 +36,7 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags) unsigned char buf[4096]; int r = 0, i; BIO *tmpout; + BIO *aeadbuf = NULL; tmpout = cms_get_text_bio(out, flags); @@ -44,6 +45,33 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags) goto err; } + /* + * For AEAD content (AuthEnvelopedData) the integrity tag is only verified + * once all the ciphertext has been processed, by the + * BIO_get_cipher_status() call below. RFC 5083 requires that the plaintext + * is not released to the caller until that verification succeeds, so + * buffer it in memory and only forward it to the output BIO once the tag + * has been checked. When CMS_TEXT is set tmpout is already a memory BIO + * that is flushed only on success, so the extra buffering is not needed. + */ + if (tmpout == out && BIO_method_type(in) == BIO_TYPE_CIPHER) { + EVP_CIPHER_CTX *ctx = NULL; + + if (BIO_get_cipher_ctx(in, &ctx) > 0 && ctx != NULL + && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) + & EVP_CIPH_FLAG_AEAD_CIPHER) + != 0) { + aeadbuf = BIO_new(BIO_s_mem()); + if (aeadbuf == NULL) { + ERR_raise(ERR_LIB_CMS, ERR_R_BIO_LIB); + goto err; + } + /* Return 0 (EOF) rather than a retryable -1 once drained. */ + BIO_set_mem_eof_return(aeadbuf, 0); + tmpout = aeadbuf; + } + } + /* Read all content through chain to process digest, decrypt etc */ for (;;) { i = BIO_read(in, buf, sizeof(buf)); @@ -66,6 +94,17 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags) ERR_raise(ERR_LIB_CMS, CMS_R_SMIME_TEXT_ERROR); goto err; } + } else if (aeadbuf != NULL) { + /* Forward the AEAD BIO to out BIO as the tag has been verified. */ + for (;;) { + i = BIO_read(aeadbuf, buf, sizeof(buf)); + if (i < 0) + goto err; + if (i == 0) + break; + if (BIO_write(out, buf, i) != i) + goto err; + } } r = 1; diff --git a/deps/openssl/openssl/crypto/ct/ct_b64.c b/deps/openssl/openssl/crypto/ct/ct_b64.c index e7eb9740ee08..01bd8fc508d6 100644 --- a/deps/openssl/openssl/crypto/ct/ct_b64.c +++ b/deps/openssl/openssl/crypto/ct/ct_b64.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -84,7 +84,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64, declen = ct_base64_decode(logid_base64, &dec); if (declen < 0) { - ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR); + ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR); goto err; } if (!SCT_set0_log_id(sct, dec, declen)) @@ -93,7 +93,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64, declen = ct_base64_decode(extensions_base64, &dec); if (declen < 0) { - ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR); + ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR); goto err; } SCT_set0_extensions(sct, dec, declen); @@ -101,7 +101,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64, declen = ct_base64_decode(signature_base64, &dec); if (declen < 0) { - ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR); + ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR); goto err; } diff --git a/deps/openssl/openssl/crypto/ctype.c b/deps/openssl/openssl/crypto/ctype.c index 686fe64165fc..4f19d6002c5e 100644 --- a/deps/openssl/openssl/crypto/ctype.c +++ b/deps/openssl/openssl/crypto/ctype.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -226,7 +226,7 @@ static const unsigned short ctype_char_map[128] = { #ifdef CHARSET_EBCDIC int ossl_toascii(int c) { - if (c < -128 || c > 256 || c == EOF) + if (c < -128 || c >= 256 || c == EOF) return c; /* * Adjust negatively signed characters. @@ -241,7 +241,7 @@ int ossl_toascii(int c) int ossl_fromascii(int c) { - if (c < -128 || c > 256 || c == EOF) + if (c < -128 || c >= 256 || c == EOF) return c; if (c < 0) c += 256; diff --git a/deps/openssl/openssl/crypto/dh/dh_backend.c b/deps/openssl/openssl/crypto/dh/dh_backend.c index f68429862cd5..77b0b3257fb7 100644 --- a/deps/openssl/openssl/crypto/dh/dh_backend.c +++ b/deps/openssl/openssl/crypto/dh/dh_backend.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -232,7 +232,7 @@ DH *ossl_dh_key_from_pkcs8(const PKCS8_PRIV_KEY_INFO *p8inf, goto done; decerr: - ERR_raise(ERR_LIB_DH, EVP_R_DECODE_ERROR); + ERR_raise(ERR_LIB_DH, DH_R_DECODE_ERROR); dherr: DH_free(dh); dh = NULL; diff --git a/deps/openssl/openssl/crypto/dh/dh_check.c b/deps/openssl/openssl/crypto/dh/dh_check.c index 3002609b68f5..8787945f8a1c 100644 --- a/deps/openssl/openssl/crypto/dh/dh_check.c +++ b/deps/openssl/openssl/crypto/dh/dh_check.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -74,6 +74,14 @@ int DH_check_params(const DH *dh, int *ret) BN_CTX *ctx = NULL; *ret = 0; + /* + * A DH with no modulus or generator cannot be checked. Report + * the failure via |*ret| rather than dereferencing NULL below. + */ + if (dh->params.p == NULL || dh->params.g == NULL) { + *ret = DH_NOT_SUITABLE_GENERATOR | DH_CHECK_P_NOT_PRIME; + return 1; + } ctx = BN_CTX_new_ex(dh->libctx); if (ctx == NULL) goto err; @@ -150,6 +158,11 @@ int DH_check(const DH *dh, int *ret) int nid = DH_get_nid((DH *)dh); *ret = 0; + /* A DH with no modulus or generator cannot be checked. */ + if (dh->params.p == NULL || dh->params.g == NULL) { + *ret = DH_NOT_SUITABLE_GENERATOR | DH_CHECK_P_NOT_PRIME; + return 1; + } if (nid != NID_undef) return 1; @@ -250,6 +263,15 @@ int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key) */ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) { + *ret = 0; + /* + * Without a modulus we cannot check anything; signal failure via + * |*ret| rather than crashing in BN_num_bits below. + */ + if (dh->params.p == NULL) { + *ret = DH_CHECK_PUBKEY_INVALID; + return 1; + } /* Don't do any checks at all with an excessively large modulus */ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); diff --git a/deps/openssl/openssl/crypto/dsa/dsa_key.c b/deps/openssl/openssl/crypto/dsa/dsa_key.c index aa69c3eea8fb..738915cc4f3d 100644 --- a/deps/openssl/openssl/crypto/dsa/dsa_key.c +++ b/deps/openssl/openssl/crypto/dsa/dsa_key.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -198,7 +198,6 @@ static int dsa_keygen(DSA *dsa) ok = dsa_keygen_pairwise_test(dsa, cb, cbarg) && dsa_keygen_knownanswer_test(dsa, ctx, cb, cbarg); if (!ok) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); BN_free(dsa->pub_key); BN_clear_free(dsa->priv_key); dsa->pub_key = NULL; diff --git a/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl b/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl index 4da9a149a99a..12a104b5ec0f 100755 --- a/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl +++ b/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2014-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2014-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2014, Intel Corporation. All Rights Reserved. # Copyright (c) 2015 CloudFlare, Inc. # @@ -80,6 +80,14 @@ $addx = ($ver>=3.03); } +if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + $addx = ($1>=11); + } +} + $code.=<<___; .text .extern OPENSSL_ia32cap_P diff --git a/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl b/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl index d2285269a308..204c51854813 100755 --- a/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl +++ b/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl @@ -1,5 +1,5 @@ #!/usr/bin/env perl -# Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -97,6 +97,13 @@ $addx = ($ver>=3.03); } +if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $addx = ($1>=11); #icx started with clang 11 + } +} + $code.=<<___; .text diff --git a/deps/openssl/openssl/crypto/ec/ec_key.c b/deps/openssl/openssl/crypto/ec/ec_key.c index 8723ead41e0e..71f1c63e2ab6 100644 --- a/deps/openssl/openssl/crypto/ec/ec_key.c +++ b/deps/openssl/openssl/crypto/ec/ec_key.c @@ -1,5 +1,5 @@ /* - * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -236,56 +236,6 @@ int ossl_ec_key_gen(EC_KEY *eckey) return ret; } -/* - * Refer: FIPS 140-3 IG 10.3.A Additional Comment 1 - * Perform a KAT by duplicating the public key generation. - * - * NOTE: This issue requires a background understanding, provided in a separate - * document; the current IG 10.3.A AC1 is insufficient regarding the PCT for - * the key agreement scenario. - * - * Currently IG 10.3.A requires PCT in the mode of use prior to use of the - * key pair, citing the PCT defined in the associated standard. For key - * agreement, the only PCT defined in SP 800-56A is that of Section 5.6.2.4: - * the comparison of the original public key to a newly calculated public key. - */ -static int ecdsa_keygen_knownanswer_test(EC_KEY *eckey, BN_CTX *ctx, - OSSL_CALLBACK *cb, void *cbarg) -{ - int len, ret = 0; - OSSL_SELF_TEST *st = NULL; - unsigned char bytes[512] = { 0 }; - EC_POINT *pub_key2 = NULL; - - st = OSSL_SELF_TEST_new(cb, cbarg); - if (st == NULL) - return 0; - - OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT_KAT, - OSSL_SELF_TEST_DESC_PCT_ECDSA); - - if ((pub_key2 = EC_POINT_new(eckey->group)) == NULL) - goto err; - - /* pub_key = priv_key * G (where G is a point on the curve) */ - if (!EC_POINT_mul(eckey->group, pub_key2, eckey->priv_key, NULL, NULL, ctx)) - goto err; - - if (BN_num_bytes(pub_key2->X) > (int)sizeof(bytes)) - goto err; - len = BN_bn2bin(pub_key2->X, bytes); - if (OSSL_SELF_TEST_oncorrupt_byte(st, bytes) - && BN_bin2bn(bytes, len, pub_key2->X) == NULL) - goto err; - ret = !EC_POINT_cmp(eckey->group, eckey->pub_key, pub_key2, ctx); - -err: - OSSL_SELF_TEST_onend(st, ret); - OSSL_SELF_TEST_free(st); - EC_POINT_free(pub_key2); - return ret; -} - /* * ECC Key generation. * See SP800-56AR3 5.6.1.2.2 "Key Pair Generation by Testing Candidates" @@ -382,13 +332,11 @@ static int ec_generate_key(EC_KEY *eckey, int pairwise_test) void *cbarg = NULL; OSSL_SELF_TEST_get_callback(eckey->libctx, &cb, &cbarg); - ok = ecdsa_keygen_pairwise_test(eckey, cb, cbarg) - && ecdsa_keygen_knownanswer_test(eckey, ctx, cb, cbarg); + ok = ecdsa_keygen_pairwise_test(eckey, cb, cbarg); } err: /* Step (9): If there is an error return an invalid keypair. */ if (!ok) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); BN_clear(eckey->priv_key); if (eckey->pub_key != NULL) EC_POINT_set_to_infinity(group, eckey->pub_key); diff --git a/deps/openssl/openssl/crypto/err/openssl.txt b/deps/openssl/openssl/crypto/err/openssl.txt index 5b2ea1c4a4e6..be65c1767ec6 100644 --- a/deps/openssl/openssl/crypto/err/openssl.txt +++ b/deps/openssl/openssl/crypto/err/openssl.txt @@ -1861,6 +1861,7 @@ X509_R_CANT_CHECK_DH_KEY:114:can't check dh key X509_R_CERTIFICATE_VERIFICATION_FAILED:139:certificate verification failed X509_R_CERT_ALREADY_IN_HASH_TABLE:101:cert already in hash table X509_R_CRL_ALREADY_DELTA:127:crl already delta +X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH:147:crl signature algorithm mismatch X509_R_CRL_VERIFY_FAILURE:131:crl verify failure X509_R_DUPLICATE_ATTRIBUTE:140:duplicate attribute X509_R_ERROR_GETTING_MD_BY_NID:141:error getting md by nid diff --git a/deps/openssl/openssl/crypto/evp/exchange.c b/deps/openssl/openssl/crypto/evp/exchange.c index 088d2fdc6e73..30299d67defd 100644 --- a/deps/openssl/openssl/crypto/evp/exchange.c +++ b/deps/openssl/openssl/crypto/evp/exchange.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -287,7 +287,9 @@ int EVP_PKEY_derive_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]) * iteration we're on. */ EVP_KEYEXCH_free(exchange); + exchange = NULL; EVP_KEYMGMT_free(tmp_keymgmt); + tmp_keymgmt = NULL; switch (iter) { case 1: diff --git a/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c b/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c index 969cca76f999..94b1602dd28e 100644 --- a/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c +++ b/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -77,6 +77,13 @@ static int ffc_validate_LN(size_t L, size_t N, int type, int verify) ERR_raise(ERR_LIB_DH, DH_R_BAD_FFC_PARAMETERS); #endif } else if (type == FFC_PARAM_TYPE_DSA) { + if (N > 512) { +#ifndef OPENSSL_NO_DSA + ERR_raise_data(ERR_LIB_DSA, DSA_R_BAD_FFC_PARAMETERS, + "N is %zu, but the maximum supported N is 512", N); +#endif + return 0; + } if (L >= 3072 && N >= 256) return 128; if (L >= 2048 && N >= 224) diff --git a/deps/openssl/openssl/crypto/hmac/hmac.c b/deps/openssl/openssl/crypto/hmac/hmac.c index c5d42db82020..77b97b6bef6a 100644 --- a/deps/openssl/openssl/crypto/hmac/hmac.c +++ b/deps/openssl/openssl/crypto/hmac/hmac.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -50,9 +50,11 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, return 0; #ifdef OPENSSL_HMAC_S390X - rv = s390x_HMAC_init(ctx, key, len, impl); - if (rv >= 1) - return rv; + { + int ret = s390x_HMAC_init(ctx, key, len, impl); + if (ret != -1) /* -1 means SW fallback */ + return ret; + } #endif if (key != NULL) { diff --git a/deps/openssl/openssl/crypto/http/http_lib.c b/deps/openssl/openssl/crypto/http/http_lib.c index 05bf4be78856..d7227f5df248 100644 --- a/deps/openssl/openssl/crypto/http/http_lib.c +++ b/deps/openssl/openssl/crypto/http/http_lib.c @@ -21,6 +21,7 @@ #define NI_MAXHOST 255 #endif #include "crypto/ctype.h" /* for ossl_isspace() */ +#define OSSL_URL_SCHEME_SUFFIX "://" static void init_pstring(char **pstr) { @@ -79,16 +80,20 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost, return 0; } - /* check for optional prefix "://" */ - scheme = scheme_end = url; - p = strstr(url, "://"); - if (p == NULL) { - p = url; - } else { - scheme_end = p; - if (scheme_end == scheme) - goto parse_err; - p += strlen("://"); + /* check for optional prefix "://" as per RFC 3986: */ + scheme = scheme_end = p = url; + if (ossl_isalpha(*p)) { + while (*p != '\0' + && (ossl_isalpha(*p) + || ossl_isdigit(*p) + || strchr("+-.", *p) != NULL)) + p++; + if (HAS_PREFIX(p, OSSL_URL_SCHEME_SUFFIX)) { + scheme_end = p; + p += sizeof(OSSL_URL_SCHEME_SUFFIX) - 1; + } else { + p = url; + } } /* parse optional "userinfo@" */ @@ -105,7 +110,7 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost, /* parse hostname/address as far as needed here */ if (host[0] == '[') { /* IPv6 literal, which may include ':' */ - host_end = strchr(host + 1, ']'); + host_end = memchr(host + 1, ']', authority_end - host - 1); if (host_end == NULL) goto parse_err; p = ++host_end; diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c index 00e2b1772cf9..9ebe5ae02d9b 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -932,6 +932,9 @@ int ossl_ml_dsa_sig_encode(const ML_DSA_SIG *sig, const ML_DSA_PARAMS *params, ret = 1; err: WPACKET_finish(&pkt); + /* Erase any partial signature output on failure */ + if (ret == 0) + OPENSSL_cleanse(out, params->sig_len); return ret; } diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c index e999b6c08d09..66e2ff2b61a0 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c @@ -346,10 +346,15 @@ static int public_from_private(const ML_DSA_KEY *key, EVP_MD_CTX *md_ctx, /* Compress t */ vector_power2_round(&t, t1, t0); - /* Zeroize secret */ - vector_zero(&s1_ntt); ret = 1; err: + /* + * The low bits of |t| are private and |s1_ntt| is secret, wipe both. + * The trailing |a_ntt| matrix is not wiped: per FIPS 204 section 3.6.3 + * the matrix A is easily computed from the public key and does not + * require any special protections. + */ + OPENSSL_cleanse(polys, (k + l) * sizeof(*polys)); OPENSSL_free(polys); return ret; } @@ -370,6 +375,7 @@ int ossl_ml_dsa_key_public_from_private(ML_DSA_KEY *key) && shake_xof(md_ctx, key->shake256_md, key->pub_encoding, key->params->pk_len, key->tr, sizeof(key->tr)); + vector_zero(&t0); vector_free(&t0); EVP_MD_CTX_free(md_ctx); return ret; @@ -401,7 +407,7 @@ int ossl_ml_dsa_key_pairwise_check(const ML_DSA_KEY *key) ret = vector_equal(&t1, &key->t1) && vector_equal(&t0, &key->t0); err: EVP_MD_CTX_free(md_ctx); - OPENSSL_free(polys); + OPENSSL_clear_free(polys, 2 * k * sizeof(*polys)); return ret; } @@ -489,7 +495,7 @@ int ossl_ml_dsa_generate_key(ML_DSA_KEY *out) "explicit %s private key does not match seed", out->params->alg); } - OPENSSL_free(sk); + OPENSSL_clear_free(sk, out->params->sk_len); } return ret; } diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c index c7ff59845217..94fd16936c8b 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -7,6 +7,7 @@ * https://www.openssl.org/source/license.html */ +#include #include "ml_dsa_local.h" #include "ml_dsa_vector.h" #include "ml_dsa_matrix.h" @@ -25,15 +26,16 @@ void ossl_ml_dsa_matrix_mult_vector(const MATRIX *a, const VECTOR *s, { size_t i, j; POLY *poly = a->m_poly; + POLY product; vector_zero(t); for (i = 0; i < a->k; i++) { for (j = 0; j < a->l; j++) { - POLY product; - ossl_ml_dsa_poly_ntt_mult(poly++, &s->poly[j], &product); poly_add(&product, &t->poly[i], &t->poly[i]); } } + + OPENSSL_cleanse(&product, sizeof(product)); } diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c index 6fae4c4a0de5..f8ce638dc229 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -8,6 +8,7 @@ */ #include +#include #include "ml_dsa_local.h" #include "ml_dsa_vector.h" #include "ml_dsa_matrix.h" @@ -159,13 +160,14 @@ static int rej_bounded_poly(EVP_MD_CTX *h_ctx, const EVP_MD *md, COEFF_FROM_NIBBLE_FUNC *coef_from_nibble, const uint8_t *seed, size_t seed_len, POLY *out) { + int ret = 0; int j = 0; uint32_t z0, z1; uint8_t blocks[SHAKE256_BLOCKSIZE], *b, *end = blocks + sizeof(blocks); /* Instead of just squeezing 1 byte at a time, we grab a whole block */ if (!shake_xof(h_ctx, md, seed, seed_len, blocks, sizeof(blocks))) - return 0; + goto err; while (1) { for (b = blocks; b < end; b++) { @@ -173,15 +175,22 @@ static int rej_bounded_poly(EVP_MD_CTX *h_ctx, const EVP_MD *md, z1 = *b >> 4; /* high nibble of byte */ if (coef_from_nibble(z0, &out->coeff[j]) - && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) - return 1; + && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) { + ret = 1; + goto err; + } if (coef_from_nibble(z1, &out->coeff[j]) - && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) - return 1; + && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) { + ret = 1; + goto err; + } } if (!EVP_DigestSqueeze(h_ctx, blocks, sizeof(blocks))) - return 0; + goto err; } +err: + OPENSSL_cleanse(blocks, sizeof(blocks)); + return ret; } /** @@ -205,6 +214,13 @@ int ossl_ml_dsa_matrix_expand_A(EVP_MD_CTX *g_ctx, const EVP_MD *md, uint8_t derived_seed[ML_DSA_RHO_BYTES + 2]; POLY *poly = out->m_poly; + /* + * The seeds derived below and the sampling buffers in rej_ntt_poly() are + * not cleansed: per FIPS 204 section 3.6.3 the matrix A is easily + * computed from the public key and does not require any special + * protections. + */ + /* The seed used for each matrix element is rho + column_index + row_index */ memcpy(derived_seed, rho, ML_DSA_RHO_BYTES); @@ -274,6 +290,7 @@ int ossl_ml_dsa_vector_expand_S(EVP_MD_CTX *h_ctx, const EVP_MD *md, int eta, } ret = 1; err: + OPENSSL_cleanse(derived_seed, sizeof(derived_seed)); return ret; } @@ -284,9 +301,11 @@ int ossl_ml_dsa_poly_expand_mask(POLY *out, const uint8_t *seed, size_t seed_len { uint8_t buf[32 * 20]; size_t buf_len = 32 * (gamma1 == ML_DSA_GAMMA1_TWO_POWER_19 ? 20 : 18); - - return shake_xof(h_ctx, md, seed, seed_len, buf, buf_len) + int ret = shake_xof(h_ctx, md, seed, seed_len, buf, buf_len) && ossl_ml_dsa_poly_decode_expand_mask(out, buf, buf_len, gamma1); + + OPENSSL_cleanse(buf, sizeof(buf)); + return ret; } /* @@ -311,13 +330,14 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l uint64_t signs; int offset = 8; size_t end; + int ret = 0; /* * Rather than squeeze 8 bytes followed by lots of 1 byte squeezes * the SHAKE blocksize is squeezed each time and buffered into 'block'. */ if (!shake_xof(h_ctx, md, seed, seed_len, block, sizeof(block))) - return 0; + goto err; /* * grab the first 64 bits - since tau < 64 @@ -336,7 +356,7 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l if (offset == sizeof(block)) { /* squeeze another block if the bytes from block have been used */ if (!EVP_DigestSqueeze(h_ctx, block, sizeof(block))) - return 0; + goto err; offset = 0; } @@ -354,5 +374,8 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l out_c->coeff[index] = mod_sub(1, 2 * (signs & 1)); signs >>= 1; /* grab the next random bit */ } - return 1; + ret = 1; +err: + OPENSSL_cleanse(block, sizeof(block)); + return ret; } diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c index 71eccf875963..166a604bcd57 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -197,6 +197,7 @@ static int ml_dsa_sign_internal(const ML_DSA_KEY *priv, int msg_is_mu, EVP_MD_CTX_free(md_ctx); OPENSSL_clear_free(alloc, alloc_len); OPENSSL_cleanse(rho_prime, sizeof(rho_prime)); + OPENSSL_cleanse(c_tilde, sizeof(c_tilde)); return ret; } @@ -387,7 +388,13 @@ int ossl_ml_dsa_sign(const ML_DSA_KEY *priv, int msg_is_mu, alloced_m = m; } ret = ml_dsa_sign_internal(priv, msg_is_mu, m, m_len, rand, rand_len, sig); - OPENSSL_free(alloced_m); + /* The encoded message may contain confidential message content */ + if (m != msg) { + if (m != m_tmp) + OPENSSL_clear_free(alloced_m, m_len); + else + OPENSSL_cleanse(m_tmp, sizeof(m_tmp)); + } } if (sig_len != NULL) *sig_len = priv->params->sig_len; @@ -424,6 +431,12 @@ int ossl_ml_dsa_verify(const ML_DSA_KEY *pub, int msg_is_mu, } ret = ml_dsa_verify_internal(pub, msg_is_mu, m, m_len, sig, sig_len); - OPENSSL_free(alloced_m); + /* The encoded message may contain confidential message content */ + if (m != msg) { + if (m != m_tmp) + OPENSSL_clear_free(alloced_m, m_len); + else + OPENSSL_cleanse(m_tmp, sizeof(m_tmp)); + } return ret; } diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h index d24bf031a292..1f3e6a03299c 100644 --- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h +++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -8,6 +8,7 @@ */ #include +#include #include "ml_dsa_poly.h" struct vector_st { @@ -153,6 +154,7 @@ vector_expand_mask(VECTOR *out, const uint8_t *rho_prime, size_t rho_prime_len, poly_expand_mask(out->poly + i, derived_seed, sizeof(derived_seed), gamma1, h_ctx, md); } + OPENSSL_cleanse(derived_seed, sizeof(derived_seed)); } /* Scale back previously rounded value */ diff --git a/deps/openssl/openssl/crypto/ml_kem/ml_kem.c b/deps/openssl/openssl/crypto/ml_kem/ml_kem.c index dd8a39197ac8..6c3141ca2d32 100644 --- a/deps/openssl/openssl/crypto/ml_kem/ml_kem.c +++ b/deps/openssl/openssl/crypto/ml_kem/ml_kem.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -1310,6 +1310,12 @@ static __owur int matrix_expand(EVP_MD_CTX *mdctx, ML_KEM_KEY *key) int rank = key->vinfo->rank; int i, j; + /* + * The seeds derived below and the sampling buffers in sample_scalar() + * are not cleansed: per FIPS 203 section 3.3 the matrix A is easily + * computed from the public encapsulation key and does not require any + * special protections. + */ memcpy(input, key->rho, ML_KEM_RANDOM_BYTES); for (i = 0; i < rank; i++) { for (j = 0; j < rank; j++) { @@ -1340,8 +1346,10 @@ static __owur int cbd_2(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1], uint16_t value, mask; uint8_t b; - if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) + if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) { + OPENSSL_cleanse((void *)randbuf, sizeof(randbuf)); return 0; + } do { b = *r++; @@ -1363,6 +1371,8 @@ static __owur int cbd_2(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1], mask = constish_time_non_zero(value >> 15); *curr++ = value + (kPrime & mask); } while (curr < end); + + OPENSSL_cleanse((void *)randbuf, sizeof(randbuf)); return 1; } @@ -1380,8 +1390,10 @@ static __owur int cbd_3(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1], uint8_t b1, b2, b3; uint16_t value, mask; - if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) + if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) { + OPENSSL_cleanse((void *)randbuf, sizeof(randbuf)); return 0; + } do { b1 = *r++; @@ -1415,6 +1427,8 @@ static __owur int cbd_3(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1], mask = constish_time_non_zero(value >> 15); *curr++ = value + (kPrime & mask); } while (curr < end); + + OPENSSL_cleanse((void *)randbuf, sizeof(randbuf)); return 1; } @@ -1427,14 +1441,19 @@ static __owur int gencbd_vector(scalar *out, CBD_FUNC cbd, uint8_t *counter, EVP_MD_CTX *mdctx, const ML_KEM_KEY *key) { uint8_t input[ML_KEM_RANDOM_BYTES + 1]; + int ret = 0; memcpy(input, seed, ML_KEM_RANDOM_BYTES); do { input[ML_KEM_RANDOM_BYTES] = (*counter)++; if (!cbd(out++, input, mdctx, key)) - return 0; + goto end; } while (--rank > 0); - return 1; + ret = 1; + +end: + OPENSSL_cleanse((void *)input, sizeof(input)); + return ret; } /* @@ -1445,15 +1464,20 @@ static __owur int gencbd_vector_ntt(scalar *out, CBD_FUNC cbd, uint8_t *counter, EVP_MD_CTX *mdctx, const ML_KEM_KEY *key) { uint8_t input[ML_KEM_RANDOM_BYTES + 1]; + int ret = 0; memcpy(input, seed, ML_KEM_RANDOM_BYTES); do { input[ML_KEM_RANDOM_BYTES] = (*counter)++; if (!cbd(out, input, mdctx, key)) - return 0; + goto end; scalar_ntt(out++); } while (--rank > 0); - return 1; + ret = 1; + +end: + OPENSSL_cleanse((void *)input, sizeof(input)); + return ret; } /* The |ETA1| value for ML-KEM-512 is 3, the rest and all ETA2 values are 2. */ @@ -1492,10 +1516,11 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES], uint8_t counter = 0; int du = vinfo->du; int dv = vinfo->dv; + int ret = 0; /* FIPS 203 "y" vector */ if (!gencbd_vector_ntt(y, cbd_1, &counter, r, rank, mdctx, key)) - return 0; + goto end; /* FIPS 203 "v" scalar */ inner_product(&v, key->t, y, rank); scalar_inverse_ntt(&v); @@ -1504,7 +1529,7 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES], /* All done with |y|, now free to reuse tmp[0] for FIPS 203 |e1| */ if (!gencbd_vector(e1, cbd_2, &counter, r, rank, mdctx, key)) - return 0; + goto end; vector_add(u, e1, rank); vector_compress(u, du, rank); vector_encode(out, u, du, rank); @@ -1513,14 +1538,19 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES], memcpy(input, r, ML_KEM_RANDOM_BYTES); input[ML_KEM_RANDOM_BYTES] = counter; if (!cbd_2(e2, input, mdctx, key)) - return 0; + goto end; scalar_add(&v, e2); /* Combine message with |v| */ scalar_decode_decompress_add(&v, message); scalar_compress(&v, dv); scalar_encode(out + vinfo->u_vector_bytes, &v, dv); - return 1; + ret = 1; + +end: + OPENSSL_cleanse((void *)input, sizeof(input)); + OPENSSL_cleanse((void *)&v, sizeof(v)); + return ret; } /* @@ -1544,6 +1574,9 @@ decrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES], scalar_sub(&v, &mask); scalar_compress(&v, 1); scalar_encode_1(out, &v); + + OPENSSL_cleanse((void *)&v, sizeof(v)); + OPENSSL_cleanse((void *)&mask, sizeof(mask)); } /*- @@ -1737,8 +1770,8 @@ static __owur int genkey(const uint8_t seed[ML_KEM_SEED_BYTES], ret = 1; end: - OPENSSL_cleanse((void *)augmented_seed, ML_KEM_RANDOM_BYTES); - OPENSSL_cleanse((void *)sigma, ML_KEM_RANDOM_BYTES); + OPENSSL_cleanse((void *)augmented_seed, sizeof(augmented_seed)); + OPENSSL_cleanse((void *)hashed, sizeof(hashed)); if (ret == 0) { ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR, "internal error while generating %s private key", @@ -1776,6 +1809,7 @@ static int encap(uint8_t *ctext, uint8_t secret[ML_KEM_SHARED_SECRET_BYTES], ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR, "internal error while performing %s encapsulation", key->vinfo->algorithm_name); + OPENSSL_cleanse((void *)Kr, sizeof(Kr)); return ret; } @@ -1822,6 +1856,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES], ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR, "internal error while performing %s decapsulation", vinfo->algorithm_name); + OPENSSL_cleanse(failure_key, sizeof(failure_key)); return 0; } decrypt_cpa(decrypted, ctext, tmp, key); @@ -1830,6 +1865,8 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES], || !encrypt_cpa(tmp_ctext, decrypted, r, tmp, mdctx, key)) { memcpy(secret, failure_key, ML_KEM_SHARED_SECRET_BYTES); OPENSSL_cleanse(decrypted, ML_KEM_SHARED_SECRET_BYTES); + OPENSSL_cleanse(Kr, sizeof(Kr)); + OPENSSL_cleanse(failure_key, sizeof(failure_key)); return 1; } mask = constant_time_eq_int_8(0, @@ -1838,6 +1875,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES], secret[i] = constant_time_select_8(mask, Kr[i], failure_key[i]); OPENSSL_cleanse(decrypted, ML_KEM_SHARED_SECRET_BYTES); OPENSSL_cleanse(Kr, sizeof(Kr)); + OPENSSL_cleanse(failure_key, sizeof(failure_key)); return 1; } @@ -1845,7 +1883,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES], * After allocating storage for public or private key data, update the key * component pointers to reference that storage. */ -static __owur int add_storage(scalar *p, int private, ML_KEM_KEY *key) +static __owur int add_storage(scalar *p, int private, int dup, ML_KEM_KEY *key) { int rank = key->vinfo->rank; @@ -1854,9 +1892,12 @@ static __owur int add_storage(scalar *p, int private, ML_KEM_KEY *key) /* * We're adding key material, the seed buffer will now hold |rho| and - * |pkhash|. + * |pkhash|. Zero the key hash when creating fresh keys; when + * duplicating, |key| was memdup'd from the source so |seedbuf| + * already carries the correct |rho|/|pkhash| bytes — preserve them. */ - memset(key->seedbuf, 0, sizeof(key->seedbuf)); + if (dup == 0) + memset(key->seedbuf, 0, sizeof(key->seedbuf)); key->rho = key->seedbuf; key->pkhash = key->seedbuf + ML_KEM_RANDOM_BYTES; key->d = key->z = NULL; @@ -1980,18 +2021,18 @@ ML_KEM_KEY *ossl_ml_kem_key_dup(const ML_KEM_KEY *key, int selection) selection = 0; else if (!ossl_ml_kem_have_prvkey(key)) selection &= ~OSSL_KEYMGMT_SELECT_PRIVATE_KEY; + else if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) + selection &= ~OSSL_KEYMGMT_SELECT_PUBLIC_KEY; switch (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) { case 0: ok = 1; break; case OSSL_KEYMGMT_SELECT_PUBLIC_KEY: - ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->puballoc), 0, ret); - ret->rho = ret->seedbuf; - ret->pkhash = ret->rho + ML_KEM_RANDOM_BYTES; + ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->puballoc), 0, 1, ret); break; case OSSL_KEYMGMT_SELECT_PRIVATE_KEY: - ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->prvalloc), 1, ret); + ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->prvalloc), 1, 1, ret); /* Duplicated keys retain |d|, if available */ if (key->d != NULL) ret->d = ret->z + ML_KEM_RANDOM_BYTES; @@ -2111,7 +2152,7 @@ int ossl_ml_kem_parse_public_key(const uint8_t *in, size_t len, ML_KEM_KEY *key) || (mdctx = EVP_MD_CTX_new()) == NULL) return 0; - if (add_storage(OPENSSL_malloc(vinfo->puballoc), 0, key)) + if (add_storage(OPENSSL_malloc(vinfo->puballoc), 0, 0, key)) ret = parse_pubkey(in, mdctx, key); if (!ret) @@ -2139,7 +2180,7 @@ int ossl_ml_kem_parse_private_key(const uint8_t *in, size_t len, || (mdctx = EVP_MD_CTX_new()) == NULL) return 0; - if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, key)) + if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, 0, key)) ret = parse_prvkey(in, mdctx, key); if (!ret) @@ -2187,7 +2228,7 @@ int ossl_ml_kem_genkey(uint8_t *pubenc, size_t publen, ML_KEM_KEY *key) */ CONSTTIME_SECRET(seed, ML_KEM_SEED_BYTES); - if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, key)) + if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, 0, key)) ret = genkey(seed, mdctx, pubenc, key); OPENSSL_cleanse(seed, sizeof(seed)); @@ -2196,6 +2237,9 @@ int ossl_ml_kem_genkey(uint8_t *pubenc, size_t publen, ML_KEM_KEY *key) EVP_MD_CTX_free(mdctx); if (!ret) { + /* Erase any partial public key output */ + if (pubenc != NULL) + OPENSSL_cleanse(pubenc, vinfo->pubkey_bytes); ossl_ml_kem_key_reset(key); return 0; } @@ -2254,6 +2298,10 @@ int ossl_ml_kem_encap_seed(uint8_t *ctext, size_t clen, } #undef case_encap_seed + /* Erase any partial ciphertext output on failure */ + if (!ret) + OPENSSL_cleanse(ctext, clen); + /* Declassify secret inputs and derived outputs before returning control */ CONSTTIME_DECLASSIFY(entropy, elen); CONSTTIME_DECLASSIFY(ctext, clen); @@ -2268,6 +2316,7 @@ int ossl_ml_kem_encap_rand(uint8_t *ctext, size_t clen, const ML_KEM_KEY *key) { uint8_t r[ML_KEM_RANDOM_BYTES]; + int ret; if (key == NULL) return 0; @@ -2277,8 +2326,11 @@ int ossl_ml_kem_encap_rand(uint8_t *ctext, size_t clen, < 1) return 0; - return ossl_ml_kem_encap_seed(ctext, clen, shared_secret, slen, + ret = ossl_ml_kem_encap_seed(ctext, clen, shared_secret, slen, r, sizeof(r), key); + + OPENSSL_cleanse((void *)r, sizeof(r)); + return ret; } int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen, @@ -2293,11 +2345,13 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen, #endif /* Need a private key here */ - if (!ossl_ml_kem_have_prvkey(key)) + if (!ossl_ml_kem_have_prvkey(key) + || shared_secret == NULL + || slen < ML_KEM_SHARED_SECRET_BYTES) return 0; vinfo = key->vinfo; - if (shared_secret == NULL || slen != ML_KEM_SHARED_SECRET_BYTES + if (slen != ML_KEM_SHARED_SECRET_BYTES || ctext == NULL || clen != vinfo->ctext_bytes || (mdctx = EVP_MD_CTX_new()) == NULL) { (void)RAND_bytes_ex(key->libctx, shared_secret, @@ -2326,6 +2380,7 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen, \ ret = decap(shared_secret, ctext, cbuf, tmp, mdctx, key); \ OPENSSL_cleanse((void *)tmp, sizeof(tmp)); \ + OPENSSL_cleanse((void *)cbuf, sizeof(cbuf)); \ break; \ } switch (vinfo->evp_type) { diff --git a/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl b/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl index 054672bb6b9b..3da7c69cb985 100644 --- a/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl +++ b/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl @@ -1,4 +1,4 @@ -# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2021, Intel Corporation. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use @@ -72,6 +72,13 @@ } } +if (!$avx512vaes && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx512vaes = ($1>=11); #icx started with clang 11 + } +} + open OUT, "| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT = *OUT; diff --git a/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl b/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl index c63570bae42f..202883dac35e 100644 --- a/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl +++ b/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -73,6 +73,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl b/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl index 6ef8e555d0a2..181793c5523c 100644 --- a/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl +++ b/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2010-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2010-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -121,6 +121,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/pem/pvkfmt.c b/deps/openssl/openssl/crypto/pem/pvkfmt.c index 9bfbb01e430a..8b81f66e0e3b 100644 --- a/deps/openssl/openssl/crypto/pem/pvkfmt.c +++ b/deps/openssl/openssl/crypto/pem/pvkfmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2005-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -893,13 +893,13 @@ static void *do_PVK_body_key(const unsigned char **in, (unsigned char *)psbuf, inlen, libctx, propq)) goto err; p += saltlen; - /* Copy BLOBHEADER across, decrypt rest */ - memcpy(enctmp, p, 8); - p += 8; if (keylen < 8) { ERR_raise(ERR_LIB_PEM, PEM_R_PVK_TOO_SHORT); goto err; } + /* Copy BLOBHEADER across, decrypt rest */ + memcpy(enctmp, p, 8); + p += 8; inlen = keylen - 8; q = enctmp + 8; if ((rc4 = EVP_CIPHER_fetch(libctx, "RC4", propq)) == NULL) diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_add.c b/deps/openssl/openssl/crypto/pkcs12/p12_add.c index 4750974d6044..977aa8b65835 100644 --- a/deps/openssl/openssl/crypto/pkcs12/p12_add.c +++ b/deps/openssl/openssl/crypto/pkcs12/p12_add.c @@ -1,5 +1,5 @@ /* - * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -222,6 +222,6 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12) } return p7s; err: - sk_PKCS7_free(p7s); + sk_PKCS7_pop_free(p7s, PKCS7_free); return NULL; } diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_decr.c b/deps/openssl/openssl/crypto/pkcs12/p12_decr.c index 0d415e755a18..31766989fc4a 100644 --- a/deps/openssl/openssl/crypto/pkcs12/p12_decr.c +++ b/deps/openssl/openssl/crypto/pkcs12/p12_decr.c @@ -55,7 +55,8 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) != 0) { - if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) { + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) + <= 0) { ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR); goto err; } @@ -70,7 +71,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, inlen -= mac_len; if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)mac_len, (unsigned char *)in + inlen) - < 0) { + <= 0) { ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR); goto err; } diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_utl.c b/deps/openssl/openssl/crypto/pkcs12/p12_utl.c index a6f3248c554c..f252fd1a0061 100644 --- a/deps/openssl/openssl/crypto/pkcs12/p12_utl.c +++ b/deps/openssl/openssl/crypto/pkcs12/p12_utl.c @@ -186,6 +186,8 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen) /* string must contain an even number of bytes */ if (unilen & 1) return NULL; + if (unilen < 0) + return NULL; for (asclen = 0, i = 0; i < unilen;) { j = bmp_to_utf8(NULL, uni + i, unilen - i); diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c index 1ec7895fc197..aaf3c19aaeae 100644 --- a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c +++ b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c @@ -1200,7 +1200,7 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx) rsk = p7->d.signed_and_enveloped->recipientinfo; if (rsk == NULL) return NULL; - if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx) + if (idx < 0 || sk_PKCS7_RECIP_INFO_num(rsk) <= idx) return NULL; ri = sk_PKCS7_RECIP_INFO_value(rsk, idx); return ri->issuer_and_serial; diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c index 6cd0c3f025c5..2fd753e873d0 100644 --- a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c +++ b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c @@ -537,7 +537,7 @@ int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md) } ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); - return 1; + return 0; } STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7) @@ -727,6 +727,10 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7) break; case NID_pkcs7_signedAndEnveloped: + if (p7->d.signed_and_enveloped == NULL || p7->d.signed_and_enveloped->enc_data == NULL) { + ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT); + break; + } os = p7->d.signed_and_enveloped->enc_data->enc_data; if (os == NULL) { os = ASN1_OCTET_STRING_new(); @@ -735,6 +739,10 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7) break; case NID_pkcs7_enveloped: + if (p7->d.enveloped == NULL || p7->d.enveloped->enc_data == NULL) { + ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT); + break; + } os = p7->d.enveloped->enc_data->enc_data; if (os == NULL) { os = ASN1_OCTET_STRING_new(); @@ -747,7 +755,13 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7) ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT); break; } - os = p7->d.sign->contents->d.data; + + if (!PKCS7_type_is_data(p7->d.sign->contents)) { + ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE); + break; + } + + os = PKCS7_get_octet_string(p7->d.sign->contents); break; default: diff --git a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl index c91d01fb3ba4..6d367d858da7 100755 --- a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl +++ b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -73,6 +73,13 @@ if (!$avx && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/) { $avx = ($2>=3.0) + ($2>3.0); } + + if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } + } } ######################################################################## diff --git a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl index 305099ca0308..081fe4117ad9 100755 --- a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl +++ b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -95,6 +95,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/rand/rand_lib.c b/deps/openssl/openssl/crypto/rand/rand_lib.c index f03bb2967c43..df70d1c2b1da 100644 --- a/deps/openssl/openssl/crypto/rand/rand_lib.c +++ b/deps/openssl/openssl/crypto/rand/rand_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -674,7 +674,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent, EVP_RAND_CTX *ctx; OSSL_PARAM params[9], *p = params; const OSSL_PARAM *settables; - const char *prov_name; char *name, *cipher; int use_df = 1; @@ -686,7 +685,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent, ERR_raise(ERR_LIB_RAND, RAND_R_UNABLE_TO_FETCH_DRBG); return NULL; } - prov_name = ossl_provider_name(EVP_RAND_get0_provider(rand)); ctx = EVP_RAND_CTX_new(rand, parent); EVP_RAND_free(rand); if (ctx == NULL) { @@ -704,9 +702,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent, && OSSL_PARAM_locate_const(settables, OSSL_DRBG_PARAM_DIGEST)) *p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_DIGEST, dgbl->rng_digest, 0); - if (prov_name != NULL) - *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PROV_PARAM_CORE_PROV_NAME, - (char *)prov_name, 0); if (dgbl->rng_propq != NULL) *p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_PROPERTIES, dgbl->rng_propq, 0); @@ -864,7 +859,10 @@ static EVP_RAND_CTX *rand_get0_public(OSSL_LIB_CTX *ctx, RAND_GLOBAL *dgbl) return NULL; rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL, SECONDARY_RESEED_TIME_INTERVAL); - CRYPTO_THREAD_set_local(&dgbl->public, rand); + if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) { + EVP_RAND_CTX_free(rand); + rand = NULL; + } } return rand; } @@ -903,7 +901,10 @@ static EVP_RAND_CTX *rand_get0_private(OSSL_LIB_CTX *ctx, RAND_GLOBAL *dgbl) return NULL; rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL, SECONDARY_RESEED_TIME_INTERVAL); - CRYPTO_THREAD_set_local(&dgbl->private, rand); + if (!CRYPTO_THREAD_set_local(&dgbl->private, rand)) { + EVP_RAND_CTX_free(rand); + rand = NULL; + } } return rand; } diff --git a/deps/openssl/openssl/crypto/rsa/rsa_gen.c b/deps/openssl/openssl/crypto/rsa/rsa_gen.c index 554f9d349b85..777a485422dd 100644 --- a/deps/openssl/openssl/crypto/rsa/rsa_gen.c +++ b/deps/openssl/openssl/crypto/rsa/rsa_gen.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -636,7 +636,6 @@ static int rsa_keygen(OSSL_LIB_CTX *libctx, RSA *rsa, int bits, int primes, OSSL_SELF_TEST_get_callback(libctx, &stcb, &stcbarg); ok = rsa_keygen_pairwise_test(rsa, stcb, stcbarg); if (!ok) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); /* Clear intermediate results */ BN_clear_free(rsa->d); BN_clear_free(rsa->p); diff --git a/deps/openssl/openssl/crypto/rsa/rsa_ossl.c b/deps/openssl/openssl/crypto/rsa/rsa_ossl.c index 2fcf02a9ab05..73a4b7c20a47 100644 --- a/deps/openssl/openssl/crypto/rsa/rsa_ossl.c +++ b/deps/openssl/openssl/crypto/rsa/rsa_ossl.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -160,6 +160,14 @@ static int rsa_ossl_public_encrypt(int flen, const unsigned char *from, * See SP800-56Br2, section 7.1.1.1 * RSAEP: 1 < f < (n – 1). * (where f is the plaintext). + * + * This bound is somewhat overkill here. RSASVE.GENERATE (7.2.1.2) + * regenerates z until 1 < z < n-1, so on that path the plaintext is in + * range unconditionally. On the OAEP path the leading 0x00 octet of the + * encoding forces m < n-1 unconditionally, while m = 0 or 1 is only + * cryptographically negligible, not impossible. The check is kept to + * mirror the RSADP bound in rsa_ossl_private_decrypt() and to keep RSAEP + * faithful to 7.1.1 of the SP; nothing in the SP relies on it here. */ if (padding == RSA_NO_PADDING) { BIGNUM *nminus1 = BN_CTX_get(ctx); @@ -572,6 +580,12 @@ static int rsa_ossl_private_decrypt(int flen, const unsigned char *from, * See SP800-56Br2, section 7.1.2.1 * RSADP: 1 < f < (n – 1) * (where f is the ciphertext). + * + * Kept under FIPS_MODULE because SP 800-56B KTS-OAEP (section 9.2) also + * decrypts through RSADP and needs this bound in a FIPS build, and there + * is no KTS-OAEP-specific path to attach it to. The non-FIPS RSASVE path + * applies the same 1 < c < n-1 in rsasve_recover() + * (providers/implementations/kem/rsa_kem.c); keep the two in step. */ if (padding == RSA_NO_PADDING) { BIGNUM *nminus1 = BN_CTX_get(ctx); diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl index 00350324a117..81c3658b0adf 100644 --- a/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 1998-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 1998-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -146,6 +146,9 @@ $ymm=1 if ($xmm && !$ymm && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/ && $2>=3.0); # first version supporting AVX +$ymm=1 if ($xmm && !$ymm && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ && + $1>=11); #icx started with clang 11 + $shaext=$xmm; ### set to zero if compiling for 1.0.1 &external_label("OPENSSL_ia32cap_P") if ($xmm); diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl index d9d1630d16db..59042c90b2fe 100644 --- a/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -76,6 +76,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl index 30c545cf419a..829fe16a8272 100755 --- a/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -124,6 +124,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + $shaext=1; ### set to zero if compiling for 1.0.1 $avx=1 if (!$shaext && $avx); diff --git a/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl b/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl index 8e19cd875e3f..3983e55ff9e8 100644 --- a/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -99,6 +99,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if ($xmm && !$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + $shaext=$xmm; ### set to zero if compiling for 1.0.1 $unroll_after = 64*4; # If pre-evicted from L1P cache first spin of diff --git a/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl index 9398b7954a7f..e53517d787f6 100644 --- a/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -77,6 +77,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" or die "can't call $xlate: $!"; *STDOUT=*OUT; diff --git a/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl index b37058ae03fa..cbdd7df67561 100755 --- a/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl +++ b/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2005-2024 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -140,6 +140,13 @@ $avx = ($2>=3.0) + ($2>3.0); } +if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` + =~ /#define __clang_major__.([0-9]+)/) { + if ($1) { + $avx = ($1>=11); #icx started with clang 11 + } +} + $shaext=1; ### set to zero if compiling for 1.0.1 $avx=1 if (!$shaext && $avx); diff --git a/deps/openssl/openssl/crypto/sha/sha_riscv.c b/deps/openssl/openssl/crypto/sha/sha_riscv.c index 61ceaa22a4bd..dad1b1187671 100644 --- a/deps/openssl/openssl/crypto/sha/sha_riscv.c +++ b/deps/openssl/openssl/crypto/sha/sha_riscv.c @@ -1,5 +1,5 @@ /* - * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -17,9 +17,9 @@ void sha256_block_data_order_zvkb_zvknha_or_zvknhb(void *ctx, const void *in, size_t num); void sha256_block_data_order_c(void *ctx, const void *in, size_t num); -void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num); +void sha256_block_data_order(void *ctx, const void *in, size_t num); -void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num) +void sha256_block_data_order(void *ctx, const void *in, size_t num) { if (RISCV_HAS_ZVKB() && (RISCV_HAS_ZVKNHA() || RISCV_HAS_ZVKNHB()) && riscv_vlen() >= 128) { sha256_block_data_order_zvkb_zvknha_or_zvknhb(ctx, in, num); @@ -30,9 +30,9 @@ void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num) void sha512_block_data_order_zvkb_zvknhb(void *ctx, const void *in, size_t num); void sha512_block_data_order_c(void *ctx, const void *in, size_t num); -void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num); +void sha512_block_data_order(void *ctx, const void *in, size_t num); -void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num) +void sha512_block_data_order(void *ctx, const void *in, size_t num) { if (RISCV_HAS_ZVKB_AND_ZVKNHB() && riscv_vlen() >= 128) { sha512_block_data_order_zvkb_zvknhb(ctx, in, num); diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c index 41fc494048b4..4cf75089920a 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c @@ -8,6 +8,7 @@ */ #include #include +#include #include #include #include "slh_dsa_local.h" @@ -122,8 +123,13 @@ static int slh_sign_internal(SLH_DSA_HASH_CTX *hctx, err: if (!WPACKET_finish(wpkt)) ret = 0; + OPENSSL_cleanse(m_digest, sizeof(m_digest)); + OPENSSL_cleanse(pk_fors, sizeof(pk_fors)); if (ret) *sig_len = sig_len_expected; + else + /* Erase any partial signature output */ + OPENSSL_cleanse(sig, sig_len_expected); return ret; } @@ -148,6 +154,7 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx, const uint8_t *msg, size_t msg_len, const uint8_t *sig, size_t sig_len) { + int ret = 0; const SLH_DSA_KEY *pub = hctx->key; SLH_HASH_FUNC_DECLARE(pub, hashf); SLH_ADRS_FUNC_DECLARE(pub, adrsf); @@ -185,7 +192,7 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx, if (!hashf->H_MSG(hctx, r, pk_seed, pk_root, msg, msg_len, m_digest, sizeof(m_digest))) - return 0; + goto err; /* * Get md (the first md_len bytes of m_digest to use in @@ -195,16 +202,20 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx, if (!PACKET_buf_init(m_digest_rpkt, m_digest, sizeof(m_digest)) || !PACKET_get_bytes(m_digest_rpkt, &md, md_len) || !get_tree_ids(m_digest_rpkt, params, &tree_id, &leaf_id)) - return 0; + goto err; adrsf->set_tree_address(adrs, tree_id); adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_FORS_TREE); adrsf->set_keypair_address(adrs, leaf_id); - return ossl_slh_fors_pk_from_sig(hctx, sig_rpkt, md, pk_seed, adrs, - pk_fors, sizeof(pk_fors)) + ret = ossl_slh_fors_pk_from_sig(hctx, sig_rpkt, md, pk_seed, adrs, + pk_fors, sizeof(pk_fors)) && ossl_slh_ht_verify(hctx, pk_fors, sig_rpkt, pk_seed, tree_id, leaf_id, pk_root) && PACKET_remaining(sig_rpkt) == 0; +err: + OPENSSL_cleanse(m_digest, sizeof(m_digest)); + OPENSSL_cleanse(pk_fors, sizeof(pk_fors)); + return ret; } /** @@ -292,8 +303,13 @@ int ossl_slh_dsa_sign(SLH_DSA_HASH_CTX *slh_ctx, return 0; } ret = slh_sign_internal(slh_ctx, m, m_len, sig, siglen, sigsize, add_rand); - if (m != msg && m != m_tmp) - OPENSSL_free(m); + /* The encoded message may contain confidential message content */ + if (m != msg) { + if (m != m_tmp) + OPENSSL_clear_free(m, m_len); + else + OPENSSL_cleanse(m_tmp, sizeof(m_tmp)); + } return ret; } @@ -317,8 +333,13 @@ int ossl_slh_dsa_verify(SLH_DSA_HASH_CTX *slh_ctx, return 0; ret = slh_verify_internal(slh_ctx, m, m_len, sig, sig_len); - if (m != msg && m != m_tmp) - OPENSSL_free(m); + /* The encoded message may contain confidential message content */ + if (m != msg) { + if (m != m_tmp) + OPENSSL_clear_free(m, m_len); + else + OPENSSL_cleanse(m_tmp, sizeof(m_tmp)); + } return ret; } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c index 9dca01acf5ff..513f7f7dafc1 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -109,5 +109,6 @@ void ossl_slh_dsa_hash_ctx_free(SLH_DSA_HASH_CTX *ctx) if (ctx->md_big_ctx != ctx->md_ctx) EVP_MD_CTX_free(ctx->md_big_ctx); EVP_MAC_CTX_free(ctx->hmac_ctx); - OPENSSL_free(ctx); + /* Erases the |scratch| hash intermediates */ + OPENSSL_clear_free(ctx, sizeof(*ctx)); } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c index 6d778a39f46d..9e980bf1bfb0 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c @@ -313,6 +313,12 @@ int ossl_slh_dsa_key_fromdata(SLH_DSA_KEY *key, const OSSL_PARAM params[], key->pub = p; return 1; err: + /* + * A private key of unexpected length may have been copied into |priv| + * before |has_priv| was set, in which case the reset below would not + * erase it, so cleanse unconditionally. + */ + OPENSSL_cleanse(key->priv, sizeof(key->priv)); ossl_slh_dsa_key_reset(key); return 0; } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h index 57dfc1eb1301..d2eccdd08a9a 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -45,12 +45,24 @@ * NOTE: Any changes to this structure will need updating in * ossl_slh_dsa_hash_ctx_dup(). */ +/* A SHA-512 digest plus two |n| byte node values */ +#define SLH_DSA_HASH_SCRATCH_LEN (64 + 2 * SLH_MAX_N) + struct slh_dsa_hash_ctx_st { const SLH_DSA_KEY *key; /* This key is not owned by this object */ EVP_MD_CTX *md_ctx; /* Either SHAKE OR SHA-256 */ EVP_MD_CTX *md_big_ctx; /* Either SHA-512 or points to |md_ctx| for SHA-256*/ EVP_MAC_CTX *hmac_ctx; /* required by SHA algorithms for PRFmsg() */ int hmac_digest_used; /* Used for lazy init of hmac_ctx digest */ + /* + * Working storage for the SHA2 hash function intermediates, used in + * place of local stack copies, so that potentially sensitive + * intermediate data lives in one place and is erased when this object + * is freed (FIPS 205 section 3.1). The SHAKE hash functions write + * their output directly to the caller's buffer and need no scratch. + * Not used concurrently. + */ + uint8_t scratch[SLH_DSA_HASH_SCRATCH_LEN]; }; __owur int ossl_slh_wots_pk_gen(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed, diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c b/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c index 78587589db42..7c8854cc9b38 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -17,8 +17,8 @@ /* a = 6, 8, 9, 12 or 14 - There are (2^a) merkle trees */ #define SLH_MAX_A 9 -#define SLH_MAX_K_TIMES_A (SLH_MAX_A * SLH_MAX_K) -#define SLH_MAX_ROOTS (SLH_MAX_K_TIMES_A * SLH_MAX_N) +/* The FORS public key is computed from the roots of k Merkle trees */ +#define SLH_MAX_ROOTS (SLH_MAX_K * SLH_MAX_N) static void slh_base_2b(const uint8_t *in, uint32_t b, uint32_t *out, size_t out_len); @@ -87,25 +87,25 @@ static int slh_fors_node(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed, if (height == 0) { /* Gets here for leaf nodes */ - if (!slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs, node_id, sk, sizeof(sk))) - return 0; - adrsf->set_tree_height(adrs, 0); - adrsf->set_tree_index(adrs, node_id); - ret = key->hash_func->F(ctx, pk_seed, adrs, sk, n, node, node_len); + if (slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs, node_id, sk, sizeof(sk))) { + adrsf->set_tree_height(adrs, 0); + adrsf->set_tree_index(adrs, node_id); + ret = key->hash_func->F(ctx, pk_seed, adrs, sk, n, node, node_len); + } OPENSSL_cleanse(sk, n); - return ret; } else { - if (!slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id, height - 1, - lnode, sizeof(rnode)) - || !slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id + 1, - height - 1, rnode, sizeof(rnode))) - return 0; - adrsf->set_tree_height(adrs, height); - adrsf->set_tree_index(adrs, node_id); - if (!key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, node, node_len)) - return 0; + if (slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id, height - 1, + lnode, sizeof(lnode)) + && slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id + 1, + height - 1, rnode, sizeof(rnode))) { + adrsf->set_tree_height(adrs, height); + adrsf->set_tree_index(adrs, node_id); + ret = key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, node, node_len); + } + OPENSSL_cleanse(lnode, sizeof(lnode)); + OPENSSL_cleanse(rnode, sizeof(rnode)); } - return 1; + return ret; } /** @@ -132,6 +132,7 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md, const uint8_t *sk_seed, const uint8_t *pk_seed, uint8_t *adrs, WPACKET *sig_wpkt) { + int ret = 0; const SLH_DSA_KEY *key = ctx->key; uint32_t tree_id, layer, s, tree_offset; uint32_t ids[SLH_MAX_K]; @@ -165,7 +166,7 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md, if (!slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs, node_id + tree_id_times_two_power_a, out, sizeof(out)) || !WPACKET_memcpy(sig_wpkt, out, n)) - return 0; + goto err; /* * Traverse from the bottom of the tree (layer = 0) @@ -178,15 +179,18 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md, s = node_id ^ 1; /* XOR gets the index of the other child in a binary tree */ if (!slh_fors_node(ctx, sk_seed, pk_seed, adrs, s + tree_offset, layer, out, sizeof(out))) - return 0; + goto err; node_id >>= 1; /* Get the parent node id */ tree_offset >>= 1; /* Each layer up has half as many nodes */ if (!WPACKET_memcpy(sig_wpkt, out, n)) - return 0; + goto err; } tree_id_times_two_power_a += two_power_a; } - return 1; + ret = 1; +err: + OPENSSL_cleanse(out, sizeof(out)); + return ret; } /** @@ -288,6 +292,8 @@ int ossl_slh_fors_pk_from_sig(SLH_DSA_HASH_CTX *ctx, PACKET *fors_sig_rpkt, err: if (!WPACKET_finish(wroot_pkt)) ret = 0; + /* At most one |n| byte root per tree was written */ + OPENSSL_cleanse(roots, k * n); return ret; } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c b/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c index bd112f1cb0db..b0023c955c3e 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -92,12 +92,15 @@ slh_prf_msg_shake(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_prf, const uint8_t *opt_rand, const uint8_t *msg, size_t msg_len, WPACKET *pkt) { + int ret; unsigned char out[SLH_MAX_N]; const SLH_DSA_PARAMS *params = ctx->key->params; size_t n = params->n; - return xof_digest_3(ctx->md_ctx, sk_prf, n, opt_rand, n, msg, msg_len, out, n) + ret = xof_digest_3(ctx->md_ctx, sk_prf, n, opt_rand, n, msg, msg_len, out, n) && WPACKET_memcpy(pkt, out, n); + OPENSSL_cleanse(out, sizeof(out)); + return ret; } static int @@ -151,6 +154,7 @@ slh_hmsg_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *r, const uint8_t *pk_seed, const uint8_t *pk_root, const uint8_t *msg, size_t msg_len, uint8_t *out, size_t out_len) { + int ret; const SLH_DSA_PARAMS *params = hctx->key->params; size_t m = params->m; size_t n = params->n; @@ -163,9 +167,11 @@ slh_hmsg_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *r, const uint8_t *pk_seed, memcpy(seed, r, n); memcpy(seed + n, pk_seed, n); - return digest_4(hctx->md_big_ctx, r, n, pk_seed, n, pk_root, n, msg, msg_len, - seed + 2 * n) + ret = digest_4(hctx->md_big_ctx, r, n, pk_seed, n, pk_root, n, msg, msg_len, + seed + 2 * n) && (PKCS1_MGF1(out, m, seed, seed_len, hctx->key->md_big) == 0); + OPENSSL_cleanse(seed, sizeof(seed)); + return ret; } static int @@ -205,16 +211,23 @@ slh_prf_msg_sha2(SLH_DSA_HASH_CTX *hctx, && EVP_MAC_update(mctx, msg, msg_len) == 1 && EVP_MAC_final(mctx, mac, NULL, sizeof(mac)) == 1 && WPACKET_memcpy(pkt, mac, n); /* Truncate output to n bytes */ + OPENSSL_cleanse(mac, sizeof(mac)); return ret; } +/* + * The |digest| scratch storage in the hash context is used in place of a + * local stack buffer, and is erased when the hash context is freed + * (FIPS 205 section 3.1). On the PRF path it holds a derived chain secret. + */ static ossl_inline int -do_hash(EVP_MD_CTX *ctx, size_t n, const uint8_t *pk_seed, const uint8_t *adrs, +do_hash(SLH_DSA_HASH_CTX *hctx, EVP_MD_CTX *ctx, size_t n, + const uint8_t *pk_seed, const uint8_t *adrs, const uint8_t *m, size_t m_len, size_t b, uint8_t *out, size_t out_len) { int ret; uint8_t zeros[128] = { 0 }; - uint8_t digest[MAX_DIGEST_SIZE]; + uint8_t *digest = hctx->scratch; ret = digest_4(ctx, pk_seed, n, zeros, b - n, adrs, SLH_ADRSC_SIZE, m, m_len, digest); @@ -230,7 +243,7 @@ slh_prf_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, { size_t n = hctx->key->params->n; - return do_hash(hctx->md_ctx, n, pk_seed, adrs, sk_seed, n, + return do_hash(hctx, hctx->md_ctx, n, pk_seed, adrs, sk_seed, n, OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len); } @@ -238,21 +251,22 @@ static int slh_f_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs, const uint8_t *m1, size_t m1_len, uint8_t *out, size_t out_len) { - return do_hash(hctx->md_ctx, hctx->key->params->n, pk_seed, adrs, m1, m1_len, - OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len); + return do_hash(hctx, hctx->md_ctx, hctx->key->params->n, pk_seed, adrs, + m1, m1_len, OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len); } static int slh_h_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs, const uint8_t *m1, const uint8_t *m2, uint8_t *out, size_t out_len) { - uint8_t m[SLH_MAX_N * 2]; + /* The concatenated children go in the scratch after the digest */ + uint8_t *m = hctx->scratch + MAX_DIGEST_SIZE; const SLH_DSA_PARAMS *prms = hctx->key->params; size_t n = prms->n; memcpy(m, m1, n); memcpy(m + n, m2, n); - return do_hash(hctx->md_big_ctx, n, pk_seed, adrs, m, 2 * n, + return do_hash(hctx, hctx->md_big_ctx, n, pk_seed, adrs, m, 2 * n, prms->sha2_h_and_t_bound, out, out_len); } @@ -262,7 +276,7 @@ slh_t_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs, { const SLH_DSA_PARAMS *prms = hctx->key->params; - return do_hash(hctx->md_big_ctx, prms->n, pk_seed, adrs, ml, ml_len, + return do_hash(hctx, hctx->md_big_ctx, prms->n, pk_seed, adrs, ml, ml_len, prms->sha2_h_and_t_bound, out, out_len); } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c b/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c index bc352bf5bc3a..e1e2901ce5f3 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -8,6 +8,7 @@ */ #include +#include #include "slh_dsa_local.h" #include "slh_dsa_key.h" @@ -33,6 +34,7 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *pk_seed, uint64_t tree_id, uint32_t leaf_id, WPACKET *sig_wpkt) { + int ret = 0; const SLH_DSA_KEY *key = ctx->key; SLH_ADRS_FUNC_DECLARE(key, adrsf); SLH_ADRS_DECLARE(adrs); @@ -70,7 +72,7 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx, psig = WPACKET_get_curr(sig_wpkt); if (!ossl_slh_xmss_sign(ctx, root, sk_seed, leaf_id, pk_seed, adrs, sig_wpkt)) - return 0; + goto err; /* * On the last loop it skips getting the public key since it is not needed * to calculate another signature. If this was called it should equal @@ -79,15 +81,18 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx, if (layer < d - 1) { if (!PACKET_buf_init(xmss_sig_rpkt, psig, WPACKET_get_curr(sig_wpkt) - psig)) - return 0; + goto err; if (!ossl_slh_xmss_pk_from_sig(ctx, leaf_id, xmss_sig_rpkt, root, pk_seed, adrs, root, sizeof(root))) - return 0; + goto err; leaf_id = tree_id & mask; tree_id >>= hm; } } - return 1; + ret = 1; +err: + OPENSSL_cleanse(root, sizeof(root)); + return ret; } /** @@ -108,6 +113,7 @@ int ossl_slh_ht_verify(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg, PACKET *sig_pk const uint8_t *pk_seed, uint64_t tree_id, uint32_t leaf_id, const uint8_t *pk_root) { + int ret = 0; const SLH_DSA_KEY *key = ctx->key; SLH_ADRS_FUNC_DECLARE(key, adrsf); SLH_ADRS_DECLARE(adrs); @@ -127,9 +133,12 @@ int ossl_slh_ht_verify(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg, PACKET *sig_pk adrsf->set_tree_address(adrs, tree_id); if (!ossl_slh_xmss_pk_from_sig(ctx, leaf_id, sig_pkt, node, pk_seed, adrs, node, sizeof(node))) - return 0; + goto err; leaf_id = tree_id & mask; tree_id >>= tree_height; } - return (memcmp(node, pk_root, n) == 0); + ret = (memcmp(node, pk_root, n) == 0); +err: + OPENSSL_cleanse(node, sizeof(node)); + return ret; } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c b/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c index ea278fcd8412..79f3bca8747d 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -244,6 +244,8 @@ int ossl_slh_wots_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg, } ret = 1; err: + OPENSSL_cleanse(sk, sizeof(sk)); + OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles)); return ret; } @@ -311,5 +313,7 @@ int ossl_slh_wots_pk_from_sig(SLH_DSA_HASH_CTX *ctx, err: if (!WPACKET_finish(tmp_pkt)) ret = 0; + OPENSSL_cleanse(tmp, sizeof(tmp)); + OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles)); return ret; } diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c b/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c index dae036c6a218..a53a6c1e9911 100644 --- a/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c +++ b/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -8,6 +8,7 @@ */ #include +#include #include "slh_dsa_local.h" #include "slh_dsa_key.h" @@ -39,29 +40,31 @@ int ossl_slh_xmss_node(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed, { const SLH_DSA_KEY *key = ctx->key; SLH_ADRS_FUNC_DECLARE(key, adrsf); + int ret = 0; if (h == 0) { /* For leaf nodes generate the public key */ adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_WOTS_HASH); adrsf->set_keypair_address(adrs, node_id); - if (!ossl_slh_wots_pk_gen(ctx, sk_seed, pk_seed, adrs, + if (ossl_slh_wots_pk_gen(ctx, sk_seed, pk_seed, adrs, pk_out, pk_out_len)) - return 0; + ret = 1; } else { uint8_t lnode[SLH_MAX_N], rnode[SLH_MAX_N]; - if (!ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id, h - 1, pk_seed, adrs, + if (ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id, h - 1, pk_seed, adrs, lnode, sizeof(lnode)) - || !ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id + 1, h - 1, - pk_seed, adrs, rnode, sizeof(rnode))) - return 0; - adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE); - adrsf->set_tree_height(adrs, h); - adrsf->set_tree_index(adrs, node_id); - if (!key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, pk_out, pk_out_len)) - return 0; + && ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id + 1, h - 1, + pk_seed, adrs, rnode, sizeof(rnode))) { + adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE); + adrsf->set_tree_height(adrs, h); + adrsf->set_tree_index(adrs, node_id); + ret = key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, pk_out, pk_out_len); + } + OPENSSL_cleanse(lnode, sizeof(lnode)); + OPENSSL_cleanse(rnode, sizeof(rnode)); } - return 1; + return ret; } /** diff --git a/deps/openssl/openssl/crypto/threads_win.c b/deps/openssl/openssl/crypto/threads_win.c index 2c0e27ce06eb..158aa2ea91c9 100644 --- a/deps/openssl/openssl/crypto/threads_win.c +++ b/deps/openssl/openssl/crypto/threads_win.c @@ -535,6 +535,20 @@ int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void)) result = InterlockedCompareExchange(lock, ONCE_ININIT, ONCE_UNINITED); if (result == ONCE_UNINITED) { init(); + /* + * On weakly ordered systems, it may happen that the write to *lock + * below completes prior to some writes in whatever the init() + * callback routine above may do. In this case, other threads + * entering here may see unsynchronized data in whatever the init + * routine initializes, leading to erroneous behavior. + * + * We should use InitOnceExecuteOnce here to implement this, but + * doing so requires that we modify the definition of the + * CRYPTO_ONCE type, which is an ABI breakage. So instead + * just insert a memory barrier here to ensure that any pending + * writes are flushed to memory prior to setting ONCE_DONE below + */ + MemoryBarrier(); *lock = ONCE_DONE; return 1; } diff --git a/deps/openssl/openssl/crypto/x509/by_dir.c b/deps/openssl/openssl/crypto/x509/by_dir.c index e8b7ca152b2c..df92e1d1d589 100644 --- a/deps/openssl/openssl/crypto/x509/by_dir.c +++ b/deps/openssl/openssl/crypto/x509/by_dir.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -228,7 +228,7 @@ static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type, X509 st_x509; X509_CRL crl; } data; - int ok = 0; + int res, ok = 0; int i, j, k; unsigned long h; BUF_MEM *b = NULL; @@ -320,25 +320,35 @@ static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type, } #ifndef OPENSSL_NO_POSIX_IO #ifdef _WIN32 +#define lstat _stat #define stat _stat #endif { struct stat st; - if (stat(b->data, &st) < 0) - break; - } + if (lstat(b->data, &st) < 0) + break; /* file does not exist, not even a symlink */ +#ifndef _WIN32 + if (stat(b->data, &st) < 0) { + k++; + continue; /* symlink is broken: following it went wrong */ + } #endif - /* found one. */ - if (type == X509_LU_X509) { - if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx, - propq)) - == 0) - break; - } else if (type == X509_LU_CRL) { - if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0) - break; } +#endif + res = 0; + ERR_set_mark(); + if (type == X509_LU_X509) + res = X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx, propq); + else if (type == X509_LU_CRL) + res = X509_load_crl_file(xl, b->data, ent->dir_type); /* else case will caught higher up */ + ERR_pop_to_mark(); + /* unless OPENSSL_NO_POSIX_IO, gracefully skip found file if cert/CRL fails to load. */ +#ifndef OPENSSL_NO_POSIX_IO + res = 1; +#endif + if (res == 0) + break; k++; } diff --git a/deps/openssl/openssl/crypto/x509/pcy_cache.c b/deps/openssl/openssl/crypto/x509/pcy_cache.c index d1ee35377bda..b3b6a3da1a9a 100644 --- a/deps/openssl/openssl/crypto/x509/pcy_cache.c +++ b/deps/openssl/openssl/crypto/x509/pcy_cache.c @@ -1,5 +1,5 @@ /* - * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -134,6 +134,7 @@ static int policy_cache_new(X509 *x) /* If not absent some problem with extension */ if (i != -1) goto bad_cache; + POLICY_CONSTRAINTS_free(ext_pcons); return 1; } @@ -141,8 +142,10 @@ static int policy_cache_new(X509 *x) /* NB: ext_cpols freed by policy_cache_set_policies */ - if (i <= 0) + if (i <= 0) { + POLICY_CONSTRAINTS_free(ext_pcons); return i; + } ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL); diff --git a/deps/openssl/openssl/crypto/x509/v3_akid.c b/deps/openssl/openssl/crypto/x509/v3_akid.c index 08c751b77cfd..9721518ecc0d 100644 --- a/deps/openssl/openssl/crypto/x509/v3_akid.c +++ b/deps/openssl/openssl/crypto/x509/v3_akid.c @@ -1,5 +1,5 @@ /* - * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -173,7 +173,9 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, i = X509_get_ext_by_NID(issuer_cert, NID_subject_key_identifier, -1); if (i >= 0 && (ext = X509_get_ext(issuer_cert, i)) != NULL && !(same_issuer && !ss)) { - ikeyid = X509V3_EXT_d2i(ext); + if ((ikeyid = X509V3_EXT_d2i(ext)) == NULL) + goto err; + if (ASN1_STRING_length(ikeyid) == 0) /* indicating "none" */ { ASN1_OCTET_STRING_free(ikeyid); ikeyid = NULL; diff --git a/deps/openssl/openssl/crypto/x509/v3_ncons.c b/deps/openssl/openssl/crypto/x509/v3_ncons.c index 2d4b23685b0e..a0b97bb7081e 100644 --- a/deps/openssl/openssl/crypto/x509/v3_ncons.c +++ b/deps/openssl/openssl/crypto/x509/v3_ncons.c @@ -1,5 +1,5 @@ /* - * Copyright 2003-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2003-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -613,6 +613,12 @@ static int nc_dn(const X509_NAME *nm, const X509_NAME *base) return X509_V_ERR_OUT_OF_MEM; if (base->canon_enclen > nm->canon_enclen) return X509_V_ERR_PERMITTED_VIOLATION; + /* + * An empty base Name has no canonical encoding (canon_enc == NULL) and is + * a prefix of every Name, so it matches unconditionally. + */ + if (base->canon_enclen == 0) + return X509_V_OK; if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen)) return X509_V_ERR_PERMITTED_VIOLATION; return X509_V_OK; @@ -789,6 +795,7 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base) if (scheme == NULL || *scheme == '\0') { ERR_raise_data(ERR_LIB_X509V3, X509_V_ERR_UNSUPPORTED_NAME_SYNTAX, "x509: missing scheme in URI: %s\n", uri_copy); + OPENSSL_free(scheme); OPENSSL_free(uri_copy); ret = X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; goto end; diff --git a/deps/openssl/openssl/crypto/x509/x509_err.c b/deps/openssl/openssl/crypto/x509/x509_err.c index 3d6e8768f8bf..7ed046fef493 100644 --- a/deps/openssl/openssl/crypto/x509/x509_err.c +++ b/deps/openssl/openssl/crypto/x509/x509_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -26,6 +26,8 @@ static const ERR_STRING_DATA X509_str_reasons[] = { { ERR_PACK(ERR_LIB_X509, 0, X509_R_CERT_ALREADY_IN_HASH_TABLE), "cert already in hash table" }, { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_ALREADY_DELTA), "crl already delta" }, + { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH), + "crl signature algorithm mismatch" }, { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_VERIFY_FAILURE), "crl verify failure" }, { ERR_PACK(ERR_LIB_X509, 0, X509_R_DUPLICATE_ATTRIBUTE), diff --git a/deps/openssl/openssl/crypto/x509/x509_lu.c b/deps/openssl/openssl/crypto/x509/x509_lu.c index af8035bce844..00fe2bbe0415 100644 --- a/deps/openssl/openssl/crypto/x509/x509_lu.c +++ b/deps/openssl/openssl/crypto/x509/x509_lu.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -590,7 +590,12 @@ static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj) ret->type = obj->type; ret->data = obj->data; - X509_OBJECT_up_ref_count(ret); + + if (!X509_OBJECT_up_ref_count(ret)) { + OPENSSL_free(ret); + return NULL; + } + return ret; } diff --git a/deps/openssl/openssl/crypto/x509/x509_vfy.c b/deps/openssl/openssl/crypto/x509/x509_vfy.c index 0994c32ca533..b3df8c9b71e7 100644 --- a/deps/openssl/openssl/crypto/x509/x509_vfy.c +++ b/deps/openssl/openssl/crypto/x509/x509_vfy.c @@ -1364,6 +1364,12 @@ static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, /* Invalid IDP cannot be processed */ if ((crl->idp_flags & IDP_INVALID) != 0) return 0; + /* + * Reject delta CRLs unconditionally here. They are considered by + * get_delta_sk() after a base CRL is selected. + */ + if (crl->base_crl_number != NULL) + return 0; /* Reason codes or indirect CRLs need extended CRL support */ if ((ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT) == 0) { if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS)) @@ -1373,9 +1379,6 @@ static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, if ((crl->idp_reasons & ~tmp_reasons) == 0) return 0; } - /* Don't process deltas at this stage */ - else if (crl->base_crl_number != NULL) - return 0; /* If issuer name doesn't match certificate need indirect CRL */ if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl)) != 0) { if ((crl->idp_flags & IDP_INDIRECT) == 0) diff --git a/deps/openssl/openssl/crypto/x509/x_crl.c b/deps/openssl/openssl/crypto/x509/x_crl.c index 4a93abb8ca3f..1b498ee6b57d 100644 --- a/deps/openssl/openssl/crypto/x509/x_crl.c +++ b/deps/openssl/openssl/crypto/x509/x_crl.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -404,6 +404,10 @@ int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x) static int def_crl_verify(X509_CRL *crl, EVP_PKEY *r) { + if (X509_ALGOR_cmp(&crl->sig_alg, &crl->crl.sig_alg) != 0) { + ERR_raise(ERR_LIB_X509, X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH); + return 0; + } return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_CRL_INFO), &crl->sig_alg, &crl->signature, &crl->crl, NULL, r, crl->libctx, crl->propq); diff --git a/deps/openssl/openssl/crypto/x509/x_pubkey.c b/deps/openssl/openssl/crypto/x509/x_pubkey.c index 03f532ab9cb3..8e0ee3a2197f 100644 --- a/deps/openssl/openssl/crypto/x509/x_pubkey.c +++ b/deps/openssl/openssl/crypto/x509/x_pubkey.c @@ -224,7 +224,7 @@ static int x509_pubkey_ex_d2i_ex(ASN1_VALUE **pval, * bytes. */ ERR_clear_last_mark(); - ERR_raise(ERR_LIB_ASN1, EVP_R_DECODE_ERROR); + ERR_raise(ERR_LIB_ASN1, ASN1_R_DECODE_ERROR); goto end; } } diff --git a/deps/openssl/openssl/doc/build.info b/deps/openssl/openssl/doc/build.info index eb4492ba9c75..ce2125a4d3f3 100644 --- a/deps/openssl/openssl/doc/build.info +++ b/deps/openssl/openssl/doc/build.info @@ -1523,6 +1523,10 @@ DEPEND[html/man3/MDC2_Init.html]=man3/MDC2_Init.pod GENERATE[html/man3/MDC2_Init.html]=man3/MDC2_Init.pod DEPEND[man/man3/MDC2_Init.3]=man3/MDC2_Init.pod GENERATE[man/man3/MDC2_Init.3]=man3/MDC2_Init.pod +DEPEND[html/man3/NAME_CONSTRAINTS_check.html]=man3/NAME_CONSTRAINTS_check.pod +GENERATE[html/man3/NAME_CONSTRAINTS_check.html]=man3/NAME_CONSTRAINTS_check.pod +DEPEND[man/man3/NAME_CONSTRAINTS_check.3]=man3/NAME_CONSTRAINTS_check.pod +GENERATE[man/man3/NAME_CONSTRAINTS_check.3]=man3/NAME_CONSTRAINTS_check.pod DEPEND[html/man3/NCONF_new_ex.html]=man3/NCONF_new_ex.pod GENERATE[html/man3/NCONF_new_ex.html]=man3/NCONF_new_ex.pod DEPEND[man/man3/NCONF_new_ex.3]=man3/NCONF_new_ex.pod @@ -1571,6 +1575,10 @@ DEPEND[html/man3/OPENSSL_LH_stats.html]=man3/OPENSSL_LH_stats.pod GENERATE[html/man3/OPENSSL_LH_stats.html]=man3/OPENSSL_LH_stats.pod DEPEND[man/man3/OPENSSL_LH_stats.3]=man3/OPENSSL_LH_stats.pod GENERATE[man/man3/OPENSSL_LH_stats.3]=man3/OPENSSL_LH_stats.pod +DEPEND[html/man3/OPENSSL_armcap.html]=man3/OPENSSL_armcap.pod +GENERATE[html/man3/OPENSSL_armcap.html]=man3/OPENSSL_armcap.pod +DEPEND[man/man3/OPENSSL_armcap.3]=man3/OPENSSL_armcap.pod +GENERATE[man/man3/OPENSSL_armcap.3]=man3/OPENSSL_armcap.pod DEPEND[html/man3/OPENSSL_config.html]=man3/OPENSSL_config.pod GENERATE[html/man3/OPENSSL_config.html]=man3/OPENSSL_config.pod DEPEND[man/man3/OPENSSL_config.3]=man3/OPENSSL_config.pod @@ -3446,6 +3454,7 @@ html/man3/GENERAL_NAME.html \ html/man3/HMAC.html \ html/man3/MD5.html \ html/man3/MDC2_Init.html \ +html/man3/NAME_CONSTRAINTS_check.html \ html/man3/NCONF_new_ex.html \ html/man3/OBJ_nid2obj.html \ html/man3/OCSP_REQUEST_new.html \ @@ -3458,6 +3467,7 @@ html/man3/OPENSSL_Applink.html \ html/man3/OPENSSL_FILE.html \ html/man3/OPENSSL_LH_COMPFUNC.html \ html/man3/OPENSSL_LH_stats.html \ +html/man3/OPENSSL_armcap.html \ html/man3/OPENSSL_config.html \ html/man3/OPENSSL_fork_prepare.html \ html/man3/OPENSSL_gmtime.html \ @@ -4123,6 +4133,7 @@ man/man3/GENERAL_NAME.3 \ man/man3/HMAC.3 \ man/man3/MD5.3 \ man/man3/MDC2_Init.3 \ +man/man3/NAME_CONSTRAINTS_check.3 \ man/man3/NCONF_new_ex.3 \ man/man3/OBJ_nid2obj.3 \ man/man3/OCSP_REQUEST_new.3 \ @@ -4135,6 +4146,7 @@ man/man3/OPENSSL_Applink.3 \ man/man3/OPENSSL_FILE.3 \ man/man3/OPENSSL_LH_COMPFUNC.3 \ man/man3/OPENSSL_LH_stats.3 \ +man/man3/OPENSSL_armcap.3 \ man/man3/OPENSSL_config.3 \ man/man3/OPENSSL_fork_prepare.3 \ man/man3/OPENSSL_gmtime.3 \ diff --git a/deps/openssl/openssl/fuzz/provider.c b/deps/openssl/openssl/fuzz/provider.c index 8234a7e8dca6..69905223fbb4 100644 --- a/deps/openssl/openssl/fuzz/provider.c +++ b/deps/openssl/openssl/fuzz/provider.c @@ -1,5 +1,5 @@ /* - * Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -32,8 +32,11 @@ { \ STACK_OF(evp) *obj_stack = stack; \ \ - if (sk_##evp##_push(obj_stack, obj) > 0) \ - evp##_up_ref(obj); \ + if (!evp##_up_ref(obj)) \ + return; \ + \ + if (sk_##evp##_push(obj_stack, obj) <= 0) \ + evp##_free(obj); \ } \ static void init_##name(OSSL_LIB_CTX *libctx) \ { \ diff --git a/deps/openssl/openssl/include/internal/hashtable.h b/deps/openssl/openssl/include/internal/hashtable.h index bc44e43678a3..8bfa53923616 100644 --- a/deps/openssl/openssl/include/internal/hashtable.h +++ b/deps/openssl/openssl/include/internal/hashtable.h @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -272,7 +272,7 @@ static void ossl_unused ossl_ht_strcase(char *tgt, const char *src, int len) if (src == NULL) return; - for (i = 0; src[i] != '\0' && i < len; i++) + for (i = 0; i < len && src[i] != '\0'; i++) tgt[i] = case_adjust & src[i]; } diff --git a/deps/openssl/openssl/include/internal/list.h b/deps/openssl/openssl/include/internal/list.h index 8bb0b741bed1..270e3f1dbb93 100644 --- a/deps/openssl/openssl/include/internal/list.h +++ b/deps/openssl/openssl/include/internal/list.h @@ -1,5 +1,5 @@ /* - * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -194,6 +194,35 @@ list->omega = elem; \ list->num_elems++; \ } \ + static ossl_unused ossl_inline void \ + ossl_list_##name##_join(OSSL_LIST(name) * lh, OSSL_LIST(name) * lt) \ + { \ + OSSL_LIST_DBG(type * _p); /* local variable '_p' when debug */ \ + if (lt == NULL || lh == NULL || lt->num_elems == 0 || lh == lt) \ + return; \ + /* \ + * let's be optimistic about size_t overflow here: it can not happen. \ + */ \ + lh->num_elems += lt->num_elems; \ + if (lh->omega == NULL) { \ + assert(lh->alpha == NULL); \ + lh->omega = lt->omega; \ + lh->alpha = lt->alpha; \ + } else { \ + if (lt->alpha != NULL) \ + ((type *)lt->alpha)->ossl_list_##name.prev = lh->omega; \ + ((type *)lh->omega)->ossl_list_##name.next = lt->alpha; \ + } \ + OSSL_LIST_DBG(for (_p = (type *)lt->alpha; \ + assert(_p == NULL || _p->ossl_list_##name.list == lt), _p != NULL; \ + _p = _p->ossl_list_##name.next) \ + _p->ossl_list_##name.list \ + = lh); \ + lh->omega = lt->omega; \ + lt->alpha = NULL; \ + lt->omega = NULL; \ + lt->num_elems = 0; \ + } \ struct ossl_list_st_##name #define DEFINE_LIST_OF(name, type) \ diff --git a/deps/openssl/openssl/include/internal/quic_ackm.h b/deps/openssl/openssl/include/internal/quic_ackm.h index c0617da4855f..5b325e166bd5 100644 --- a/deps/openssl/openssl/include/internal/quic_ackm.h +++ b/deps/openssl/openssl/include/internal/quic_ackm.h @@ -1,5 +1,5 @@ /* - * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -129,6 +129,11 @@ struct ossl_ackm_tx_pkt_st { }; int ossl_ackm_on_tx_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt); + +/* + * Records transmission of a packet containing only ACK frames. + */ +int ossl_ackm_on_tx_ack_only_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt); int ossl_ackm_on_rx_datagram(OSSL_ACKM *ackm, size_t num_bytes); #define OSSL_ACKM_ECN_NONE 0 diff --git a/deps/openssl/openssl/include/internal/quic_port.h b/deps/openssl/openssl/include/internal/quic_port.h index 5a2c9352378b..88fb126e9949 100644 --- a/deps/openssl/openssl/include/internal/quic_port.h +++ b/deps/openssl/openssl/include/internal/quic_port.h @@ -1,5 +1,5 @@ /* - * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -187,6 +187,10 @@ uint64_t ossl_quic_port_get_net_bio_epoch(const QUIC_PORT *port); void ossl_quic_port_raise_net_error(QUIC_PORT *port, QUIC_CHANNEL *triggering_ch); +uint64_t ossl_quic_port_get_max_pending_channels(const QUIC_PORT *port); + +void ossl_quic_port_set_max_pending_channels(QUIC_PORT *port, uint64_t max_pending_channels); + #endif #endif diff --git a/deps/openssl/openssl/include/internal/quic_record_rx.h b/deps/openssl/openssl/include/internal/quic_record_rx.h index 287837b2a561..a4e9e7cacd25 100644 --- a/deps/openssl/openssl/include/internal/quic_record_rx.h +++ b/deps/openssl/openssl/include/internal/quic_record_rx.h @@ -1,5 +1,5 @@ /* - * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -51,8 +51,9 @@ typedef struct ossl_qrx_args_st { OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args); /* - * Frees the QRX. All packets obtained using ossl_qrx_read_pkt must already - * have been released by calling ossl_qrx_release_pkt. + * Frees the QRX/reference to QRX. Frees the QRX object, if all references are + * gone. All packets obtained using ossl_qrx_read_pkt must already have been + * released by calling ossl_qrx_release_pkt. * * You do not need to call ossl_qrx_remove_dst_conn_id first; this function will * unregister the QRX from the demuxer for all registered destination connection @@ -60,6 +61,12 @@ OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args); */ void ossl_qrx_free(OSSL_QRX *qrx); +/* + * Obtains a new reference to QRX object. Returns NULL if reference can not + * be obtained. + */ +OSSL_QRX *ossl_qrx_newref(OSSL_QRX *qrx); + /* Setters for the msg_callback and msg_callback_arg */ void ossl_qrx_set_msg_callback(OSSL_QRX *qrx, ossl_msg_cb msg_callback, SSL *msg_callback_ssl); diff --git a/deps/openssl/openssl/include/internal/quic_ssl.h b/deps/openssl/openssl/include/internal/quic_ssl.h index f714d1047716..a9c17e1087a3 100644 --- a/deps/openssl/openssl/include/internal/quic_ssl.h +++ b/deps/openssl/openssl/include/internal/quic_ssl.h @@ -1,5 +1,5 @@ /* - * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -179,6 +179,7 @@ int ossl_quic_conn_poll_events(SSL *ssl, uint64_t events, int do_tick, int ossl_quic_get_notifier_fd(SSL *ssl); void ossl_quic_enter_blocking_section(SSL *ssl, QUIC_REACTOR_WAIT_CTX *wctx); void ossl_quic_leave_blocking_section(SSL *ssl, QUIC_REACTOR_WAIT_CTX *wctx); +QUIC_PORT *ossl_quic_listener_get_port(SSL *s); #endif diff --git a/deps/openssl/openssl/include/openssl/ssl.h.in b/deps/openssl/openssl/include/openssl/ssl.h.in index e684f7c42975..90be33cb4f17 100644 --- a/deps/openssl/openssl/include/openssl/ssl.h.in +++ b/deps/openssl/openssl/include/openssl/ssl.h.in @@ -2441,6 +2441,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl, #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9 +#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1 @@ -2688,8 +2689,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_OTHER_SIGALG (5 << 16) #define SSL_SECOP_OTHER_CERT (6 << 16) -/* Indicated operation refers to peer key or certificate */ +/* + * Unused values - these do nothing and are never set. + * They are retained because of API. They should + * be removed next major + */ #define SSL_SECOP_PEER 0x1000 +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) /* Values for "op" parameter in security callback */ @@ -2728,12 +2739,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) /* CA digest algorithm in certificate */ #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) void SSL_set_security_level(SSL *s, int level); __owur int SSL_get_security_level(const SSL *s); diff --git a/deps/openssl/openssl/include/openssl/x509err.h b/deps/openssl/openssl/include/openssl/x509err.h index 7123a725e825..4bbff54a380e 100644 --- a/deps/openssl/openssl/include/openssl/x509err.h +++ b/deps/openssl/openssl/include/openssl/x509err.h @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -27,6 +27,7 @@ #define X509_R_CERTIFICATE_VERIFICATION_FAILED 139 #define X509_R_CERT_ALREADY_IN_HASH_TABLE 101 #define X509_R_CRL_ALREADY_DELTA 127 +#define X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH 147 #define X509_R_CRL_VERIFY_FAILURE 131 #define X509_R_DUPLICATE_ATTRIBUTE 140 #define X509_R_ERROR_GETTING_MD_BY_NID 141 diff --git a/deps/openssl/openssl/providers/baseprov.c b/deps/openssl/openssl/providers/baseprov.c index 16d2f91bb1ac..ad08765f006c 100644 --- a/deps/openssl/openssl/providers/baseprov.c +++ b/deps/openssl/openssl/providers/baseprov.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -29,10 +29,6 @@ static OSSL_FUNC_provider_gettable_params_fn base_gettable_params; static OSSL_FUNC_provider_get_params_fn base_get_params; static OSSL_FUNC_provider_query_operation_fn base_query; -/* Functions provided by the core */ -static OSSL_FUNC_core_gettable_params_fn *c_gettable_params = NULL; -static OSSL_FUNC_core_get_params_fn *c_get_params = NULL; - /* Parameters we provide to the core */ static const OSSL_PARAM base_param_types[] = { OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0), @@ -139,15 +135,13 @@ int ossl_base_provider_init(const OSSL_CORE_HANDLE *handle, void **provctx) { OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL; + OSSL_FUNC_core_get_params_fn *c_get_params = NULL; BIO_METHOD *corebiometh; if (!ossl_prov_bio_from_dispatch(in)) return 0; for (; in->function_id != 0; in++) { switch (in->function_id) { - case OSSL_FUNC_CORE_GETTABLE_PARAMS: - c_gettable_params = OSSL_FUNC_core_gettable_params(in); - break; case OSSL_FUNC_CORE_GET_PARAMS: c_get_params = OSSL_FUNC_core_get_params(in); break; diff --git a/deps/openssl/openssl/providers/defltprov.c b/deps/openssl/openssl/providers/defltprov.c index a74a048d6f76..de2a46515e11 100644 --- a/deps/openssl/openssl/providers/defltprov.c +++ b/deps/openssl/openssl/providers/defltprov.c @@ -34,10 +34,6 @@ static OSSL_FUNC_provider_query_operation_fn deflt_query; #define ALGC(NAMES, FUNC, CHECK) { { NAMES, "provider=default", FUNC }, CHECK } #define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL) -/* Functions provided by the core */ -static OSSL_FUNC_core_gettable_params_fn *c_gettable_params = NULL; -static OSSL_FUNC_core_get_params_fn *c_get_params = NULL; - /* Parameters we provide to the core */ static const OSSL_PARAM deflt_param_types[] = { OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0), @@ -733,6 +729,7 @@ int ossl_default_provider_init(const OSSL_CORE_HANDLE *handle, void **provctx) { OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL; + OSSL_FUNC_core_get_params_fn *c_get_params = NULL; BIO_METHOD *corebiometh; if (!ossl_prov_bio_from_dispatch(in) @@ -740,9 +737,6 @@ int ossl_default_provider_init(const OSSL_CORE_HANDLE *handle, return 0; for (; in->function_id != 0; in++) { switch (in->function_id) { - case OSSL_FUNC_CORE_GETTABLE_PARAMS: - c_gettable_params = OSSL_FUNC_core_gettable_params(in); - break; case OSSL_FUNC_CORE_GET_PARAMS: c_get_params = OSSL_FUNC_core_get_params(in); break; diff --git a/deps/openssl/openssl/providers/fips-sources.checksums b/deps/openssl/openssl/providers/fips-sources.checksums index a2f5817e26de..85af251d79e2 100644 --- a/deps/openssl/openssl/providers/fips-sources.checksums +++ b/deps/openssl/openssl/providers/fips-sources.checksums @@ -20,12 +20,12 @@ f1d8b7a3da1ec053d38be4fc776fef1e4fba328bfa2bfd928c2a2cd3b14f08ff crypto/aes/asm ee4e8cacef972942d2a89c1a83c984df9cad87c61a54383403c5c4864c403ba1 crypto/aes/asm/aes-sparcv9.pl 391497550eaca253f64b2aba7ba2e53c6bae7dff01583bc6bfc12e930bb7e217 crypto/aes/asm/aes-x86_64.pl 3b5ee174fa52d732d882ab4b2ffe59235d3bff66651714f32e743fcadaf1d970 crypto/aes/asm/aesfx-sparcv9.pl -14359dc32b7f4e5c08227fb9ac8f9232c1287399463b233fec4a2ab0c19f68d1 crypto/aes/asm/aesni-mb-x86_64.pl -f525e1bca51d39adcd411cbf8f874fe1441b23a6f614644da78dfd8544d13b23 crypto/aes/asm/aesni-sha1-x86_64.pl -895f94d7befb90e82f9d300ed8f870e790101f30ba72b249a2c503f07aec7dd2 crypto/aes/asm/aesni-sha256-x86_64.pl +e220d630965eb2672dca757aefcb9654928288772fd495da3a495b405b5f21ff crypto/aes/asm/aesni-mb-x86_64.pl +83a08babb80e15606bb52c6b4fcd1a6416d3b165b9cbfa42678ebe2e27c3b8d4 crypto/aes/asm/aesni-sha1-x86_64.pl +6808938757a489c3827e6da78f9ce227d88efcc29c3467fa0329b50b761523eb crypto/aes/asm/aesni-sha256-x86_64.pl 4ff74d4e629a88ef5a9e3d3f5b340fc0a4793d16d7cc7f1b70da62512a856248 crypto/aes/asm/aesni-x86.pl 25881237d026cebd96877a2ea2729db1ce512875cb2a10ca0cd1d6ddf4b51a3b crypto/aes/asm/aesni-x86_64.pl -6047359ad3967168812fbc8a95cb851b72c09f7846be2f03ec2ab93531a9c2bd crypto/aes/asm/aesni-xts-avx512.pl +00dd3a64df71ebd61fd35d2a6179d07cc86fc156cce1541ef176ecafb815f4bb crypto/aes/asm/aesni-xts-avx512.pl 0489a10fbb1a8ca3652848d5c1e14e519501e189bad3e5827a573c26df359691 crypto/aes/asm/aesp8-ppc.pl e397a5781893e97dd90a5a52049633be12a43f379ec5751bca2a6350c39444c8 crypto/aes/asm/aest4-sparcv9.pl 578142d03bc47353952fca2027eb63ec97ce9a1379c0f3c7ac0fdf110eb3378b crypto/aes/asm/aesv8-armx.pl @@ -39,7 +39,7 @@ c3541865cd02d81101cdbab4877ed82772e6980d2c677b9008b38fa1b26d36d4 crypto/aes/asm c6935d2ab7925022cb3d76446536ff01b1a1b8eb7eac619d034a29aad17ed45f crypto/aes/asm/vpaes-x86_64.pl 2bc67270155e2d6c7da87d9070e005ee79cea18311004907edfd6a078003532a crypto/alphacpuid.pl 269e52f8867c13ca75d2f88ec1f89b692cb8c6c3ee89abe2fd3c1821925191d8 crypto/arm64cpuid.pl -7a7c1d063be476f35442b0b056cfad0cf62190b603304abd283906ab40590167 crypto/armcap.c +b0242943b097f7640f1b3c33313934a98caf45d47d4403e9e53d826f6d2dc0c4 crypto/armcap.c d9f923daabe7537d1063b182f9f220655abd182ef4c55a0194a7ee8d6030b5bd crypto/armv4cpuid.pl e886d814c34492504cc9a2451c67fd8c0b4e83e8618f931632400cfe522b6e4d crypto/asn1_dsa.c 819c9fd2b0cae9aab81c3cbd1815c2e22949d75f132f649b5883812d0bbaa39a crypto/bn/asm/alpha-mont.pl @@ -58,14 +58,14 @@ b27ec5181e387e812925bb26823b830f49d7a6e4971b6d11ea583f5632a1504b crypto/bn/asm/ 59cd27e1e10c4984b7fb684b27f491e7634473b1bcff197a07e0ca653124aa9a crypto/bn/asm/ppc.pl 0b3350f56d423a4df918a08e90c7c66227c4449a9f9c44096eacc254ebc65f9f crypto/bn/asm/ppc64-mont-fixed.pl a25be64867ab837d93855af232e2bfa71b85b2c6f00e35e620fdc5618187fb6f crypto/bn/asm/ppc64-mont.pl -b3aad31ab658eceaa9c5e734e19f39c33991f4839ab55b0cec8018020b1a305e crypto/bn/asm/rsaz-2k-avx512.pl -03f6cc678f377c5cd953e8da135c5d76dc1cd011565118c99e25bff91e7271df crypto/bn/asm/rsaz-2k-avxifma.pl -e914311420ae4486ab6000cc6ab424f04d8a042bda40ab8f288348dc9f0eb595 crypto/bn/asm/rsaz-3k-avx512.pl -95b11e0b04c38bde06d152dfde5ab970dab27cccdfeac998e1bc293e01520474 crypto/bn/asm/rsaz-3k-avxifma.pl -e13bd2df8c591052ddf16a839072f43353841f9f35e0ac95f836511838dbc771 crypto/bn/asm/rsaz-4k-avx512.pl -cf92b66c4032703b7ce03ff6aa36887d14e31a8861e7aa21c46a466ea4802851 crypto/bn/asm/rsaz-4k-avxifma.pl -6e47bf041e51d8086c4933c2a5da3ce6d1b136592984754461d59aa81e4995a6 crypto/bn/asm/rsaz-avx2.pl -b42f6cf0fbf9eae58343df9629e7a9e5b8814195ea0c9882d7b143a0841cc018 crypto/bn/asm/rsaz-x86_64.pl +d48aded8547aa44a4af0d76d4675320628c66ba54e6fda865804953eefa8e853 crypto/bn/asm/rsaz-2k-avx512.pl +ae2e714dc003867c31136f939f8d47eb35eac3de36dbeea8f028a48d03b964ec crypto/bn/asm/rsaz-2k-avxifma.pl +6b5f35bf328f19b3add87a9715736ca92a8165920264311e20d3477a41a90a82 crypto/bn/asm/rsaz-3k-avx512.pl +b0ef4c3bb3a835066e9f7cafab22efc9d668b6debf5b9b9ec312cabae9412631 crypto/bn/asm/rsaz-3k-avxifma.pl +ca2d4486ee67f2015a8580664f3bbc28c23201205a2422d3a972cdf6ba59147a crypto/bn/asm/rsaz-4k-avx512.pl +80b0e7aca0ebee78fb3c651723e7f0eaac43a5b6a2bcf87b98a454a248abb945 crypto/bn/asm/rsaz-4k-avxifma.pl +7d686b484ea2bb65091c6ed3e74d5f4063ed4a8ecc09b7bef8d3a3aa57c4121e crypto/bn/asm/rsaz-avx2.pl +bec7e89c5a33652bbff20c95a6fe82bd96f7f2f61a3544c122f3af6f4f162110 crypto/bn/asm/rsaz-x86_64.pl 30fedf48dfc5fec1c2044b6c226dd9fc42a92522cc589797a23a79d452bdd2cf crypto/bn/asm/s390x-gf2m.pl 590388d69d7ac3a0e9af4014792f4f0fdb9552719e8fb48ebc7e5dfca2a491d4 crypto/bn/asm/s390x-mont.pl aa02597f3dc09cfbc190aedb75711859ba0f3efff87067ebfba1ec78ebee40d7 crypto/bn/asm/s390x.S @@ -81,9 +81,9 @@ d24f3e97239c8eed5efc721521b025b7256c15e67a54ea6b5c4cf8f7cd0f89ea crypto/bn/asm/ 90d4ae234c08267adce9ed38d56e0edc223f7480cb9605f5d7399d0b3914c6be crypto/bn/asm/x86-mont.pl 0e3e572cd864bcb9222cdad7ca4e8dae4250f6f76c2b66e1f0e46df1cc0cf371 crypto/bn/asm/x86_64-gcc.c 709ddee92e9222ee0ed27bfb90db556e85e2d302e4a9131afa25fdc14c4d858f crypto/bn/asm/x86_64-gf2m.pl -da7f7780d27eed164797e5334cd45b35d9c113e86afaca051463aef9a8fd787c crypto/bn/asm/x86_64-mont.pl -efe70ef06b5d92539f8a239c98c0261d93a15b3e418ca87d97ec569da9e6e9d3 crypto/bn/asm/x86_64-mont5.pl -0ea8185a037a2951bb3d1e590bbbdeac305176d5e618f3e43a04c09733a9de34 crypto/bn/bn_add.c +4ad5e97a7ed376d2cc079a3eabfbdc0cce3fe6e61751324ef18b72d24f7851d6 crypto/bn/asm/x86_64-mont.pl +11eebbeb8ae59158e780d74300b333de9705aefdde73cff280286c053c8743da crypto/bn/asm/x86_64-mont5.pl +7c81cd72fbf6f2dd85cbcbf40027301c98c1701928d3199edb2b8fdf04a5ca5e crypto/bn/bn_add.c 529933a6592cf82abde515dae10db17833a16ec29cb89ec577c0a184838fe27b crypto/bn/bn_asm.c feef3a84a40034291286882d483ac23ab55631c3c93f40ba0ea98944916ff3ec crypto/bn/bn_blind.c 1b8f89064c287669a834fe032ef823796f7355ed7e6da08d6c56c0a4cd0bba01 crypto/bn/bn_const.c @@ -91,13 +91,13 @@ eee3d2710144b0e860c57e84f5adc6b2bf64fc27cbd202a8ca2630aefed3b84c crypto/bn/bn_c 282f06fbdeb991d90337787c6407020e940b6d5e187a06866f1a7787c10a0c1b crypto/bn/bn_ctx.c b1b1c5fb8a45fde5755dfd5da62b68100b94f8c492c950719c108c384ea7f3c4 crypto/bn/bn_dh.c 4824f271f0ddc487b5991fbd92f7f7695aeeac234e076078f37da027999cdd88 crypto/bn/bn_div.c -d36b2be05469f144f52173616e413a7bdd836607fccf94cf543cc7f5a343b962 crypto/bn/bn_exp.c +f1e98f178356791a3d54f586c19d1639d8e89b2cf6e6a4de783327ceada296a2 crypto/bn/bn_exp.c ce5219203bf869561297978d6d416357a441864cd801865503dfd455c481960c crypto/bn/bn_exp2.c 18ac3f6fe64225f72243689199839ea2ce2aa61d80b084bc4cd9efe1c7cc9d89 crypto/bn/bn_gcd.c b643fdcd91ad7dfcfa97a0bb235221b024b8a77faa7890f0bcb9681ea2c64c49 crypto/bn/bn_gf2m.c 73ee247467879d4ec984c9900dfe7761233c5b889b8762be37c7e8fdd6d1d210 crypto/bn/bn_intern.c ff147e5e032cc7c772b73a91fc6e24d8d9516e642d29354445d1f82d64b1d924 crypto/bn/bn_kron.c -df9aebbdcca87fc5715dde430687fb516d8de0dac70c8910409fb73d6dd2305b crypto/bn/bn_lib.c +c4bae573e4e7132106b1151e8983cb63200dd9e49dc464e805f0fc50d55374d0 crypto/bn/bn_lib.c cd7bade0f2e223fe34f6e2f8cc87098ac8f0af96ec62ada5e67f6a2344d48ef0 crypto/bn/bn_local.h b494fd85387afa7816422922e52987e0faefc3c890c972e7d4fe04f620dfc59a crypto/bn/bn_mod.c 39a8fe0bb625b4c11b74998ce6fd99b7655228aaa7d7ad3076f61741937ae14d crypto/bn/bn_mont.c @@ -126,7 +126,7 @@ ab29529cca1308302d852999f2790c404a4dc0ef8cd6653260739f70b2f22758 crypto/core_fe 0e3519aec0d93b0700d1175616b8bfca9c045989fad515d2202dd7dff9caa5ac crypto/core_namemap.c a62f653b8a6ee765be704980425617e04e1d242f9735efaf35fc6e00815ff2a7 crypto/cpuid.c a73118d14eeb232ff250ae908204ddd7cf33deba5f3ca68a2dbb51b020946b0e crypto/cryptlib.c -66dbfc58916709d5a6913777346083247942a8d9458ee9b2bf443f0ea4988d64 crypto/ctype.c +0145299d43dbb60e85ef6b97cf7496dec55cc37b75433e1403c11adfa3e90c5f crypto/ctype.c b9fabcf8480b8c9c7847a0c9af0fcc13b6c4b4a4558d5e445e6409221e6f8113 crypto/der_writer.c 135ef65f7602432f8c87ad18fdd90b867f1c46b1c631522d56181fbed2106b05 crypto/des/des_enc.c 7c2cea4c850398158b4aff172b242de0cc436b66f62fc701ccca3fe5489925a5 crypto/des/des_local.h @@ -136,7 +136,7 @@ c1e015556147b40c854bf0ab275c54235f99001d04c6d49f158fba6865eb5439 crypto/des/fcr dc2e7899593032fdf0fcab18f5549c52f12bad2225aac9a08c4622ffee34b193 crypto/des/set_key.c 41b7fc5e67814311b878684e3f29cff60e228f1516f670d81bf43130f2668ae8 crypto/des/spr.h b842e39f34996d74cdc9b9be5fc93c27fc91ef6141fae83163e09f6b0eff1e09 crypto/dh/dh_backend.c -091ec05b6316cce34305ae8f8014043c7c9b72098aa1abe9c35dcbcdb4b77cd0 crypto/dh/dh_check.c +380d55ea09a50ba3ece173e64db90782efae08ca56ac51cb4d31b9a303b429ea crypto/dh/dh_check.c c117ac4fd24369c7813ac9dc9685640700a82bb32b0f7e038e85afd6c8db75c7 crypto/dh/dh_gen.c 1149e214ed664540434912e284730a3c87385172e4c6d1c944ea56659e2dd762 crypto/dh/dh_group_params.c a539a8930035fee3b723d74a1d13e931ff69a2b523c83d4a2d0d9db6c78ba902 crypto/dh/dh_kdf.c @@ -146,7 +146,7 @@ a9166c3cc60f4281e9d471c64145e0a78fc9dc43b8bc9e5de96d91eb7d277da3 crypto/dh/dh_l 40065939139ac28aa52838aa54d257da82fce73504557f7a9ad34d13824e0cb9 crypto/dsa/dsa_backend.c 786d6c65ced7ee4e25f5dd7c3150259ec95b6aa321a7590d905757b8139f8230 crypto/dsa/dsa_check.c ae727bf6319eb57e682de35d75ea357921987953b3688365c710e7fba51c7c58 crypto/dsa/dsa_gen.c -dee83cb278b3f712a62bd3477bdecf7b83e6df38ada2f3e1ca043d37327e2da4 crypto/dsa/dsa_key.c +43f8fba4f50fbc94b1532a7667c9cfdc91b357e8658fd5fe0dcd302ea93ae9a0 crypto/dsa/dsa_key.c 7d44106570c0ff9a44de874ea2daeaa87ea4c814fef6af0a26f655120a54f529 crypto/dsa/dsa_lib.c 98ce52d325d2409d7851f1e1226755136f115c884d227d2ae3e4f9b61fc323b8 crypto/dsa/dsa_local.h 3428bc7602f344f8b8d4a5807b0a7e982cbead1ec28be73ad77b5f849b034993 crypto/dsa/dsa_ossl.c @@ -159,9 +159,9 @@ d9722ad8c6b6e209865a921f3cda831d09bf54a55cacd1edd9802edb6559190a crypto/ec/asm/ 3715ddd921425f3018741037f01455ed26a840ace08691a800708170a66cf4d2 crypto/ec/asm/ecp_nistz256-ppc64.pl cfe7e75a2fddc87a7251684469a8808b9da82b2f5725eafad5806920f89932bd crypto/ec/asm/ecp_nistz256-sparcv9.pl 922725c4761cfa567af6ed9ecab04f2c7729ae2595f2fc0fa46dc67879dc87b0 crypto/ec/asm/ecp_nistz256-x86.pl -afa4497cfbf9ef7805e42ae6a61c7d983e8a789b270d498a07785570ab85a9fa crypto/ec/asm/ecp_nistz256-x86_64.pl +f5c4f8c74a44c8723293e3bb64c0c2cf75dc354466ac9f93ebfdab1df34b64c4 crypto/ec/asm/ecp_nistz256-x86_64.pl cc727533130f5f1a29229929b3d4e8454585d647be25d6344f3c6a0240998368 crypto/ec/asm/x25519-ppc64.pl -ee897e230964511baa0d1bf95fb938312407a40a88ebe01476879c2763e5f732 crypto/ec/asm/x25519-x86_64.pl +ee576a748991bb2cf0a37437e46a23dd55dfd35d989e087d122c7cf0f332eb2a crypto/ec/asm/x25519-x86_64.pl 2e7b5d2a3eff0b8a90c1de3f28a7bf59b1057e7694c0e36909e774343cef609f crypto/ec/curve25519.c 784c03c3f81fd0c363cd0500fbd95f3e49c65f47a249f7ba25fad42a41d3eea2 crypto/ec/curve448/arch_32/f_impl32.c 8e75602d4d492316d318bac147eaa09d87b0eeda0d450e18683d935673ab61b0 crypto/ec/curve448/arch_64/arch_intrinsics.h @@ -185,7 +185,7 @@ dfbccf591879eecbd9ed75da1fbe6c7b1672d07648fd43b37755dfe248253bb2 crypto/ec/ec_b 3a3c4f4767513b4fbbabdea2918d7c7d105eb573334a7fd893b866989463c4d2 crypto/ec/ec_check.c f3991bfc65a7371b84afd0cc328e3cbd4736edf7267e4b731dd82677bfab047a crypto/ec/ec_curve.c 8cfd0dcfb5acbf6105691a2d5e2826dba1ff3906707bc9dd6ff9bffcc306468f crypto/ec/ec_cvt.c -add58bcaf43a28e66b3a6ec1f70ed9b0b4a4a0d40230e903a26a1ff1129649e0 crypto/ec/ec_key.c +b94eb087740dde2bf697cfbc5e8a17efd80e84c5072c9c72f8ed2f9155976d37 crypto/ec/ec_key.c 35515133fb3c33c5736a9f744e835b9fc0775193357ab2492f11d0f63503c65e crypto/ec/ec_kmeth.c 652a1544120bf0fecde46a8e18cc28fffcb7cd864be2e2b84c99d571ba320e64 crypto/ec/ec_lib.c 0d113ac5dbdb420ba3d1c060f4fa3300fc0a81b571a919c2b176022fdca89878 crypto/ec/ec_local.h @@ -214,7 +214,7 @@ ed0217e7c2049b44a454b40e7e18385eadb34bce1bcf54337f420cbf988775da crypto/evp/asy e997e921669076c51e230ccb2e36b1c6755fe408c61b1177d2aa67529cab15f3 crypto/evp/evp_local.h 8963ef06e4d228f7067917434f60f0502dc4bbdf3b271649498b734f4074bfb0 crypto/evp/evp_rand.c 0bdae4714221662282dccd5b1f2485370d24e463c11bdbb71a310f34616954fe crypto/evp/evp_utils.c -8f4194bcc2e0de69236925aa7515bc31f36ed113dcd3cee5d71167ac770cdfdd crypto/evp/exchange.c +1d78745866dde8224eec50c8553a15b51aa14bc3313969479806b3c3024c7282 crypto/evp/exchange.c 294284ad040fe4b74845f91b1903c961c757e1ef3fcc2ffa35f43f37f1655e64 crypto/evp/kdf_lib.c 532f0ff4ab32068f160016f39cd520fadfbd09b81b3b3b562bf543acafb38889 crypto/evp/kdf_meth.c d911878128b90b98f3a4a1fb844ef3a20d35eafda3f80773dac8ce93c55bc352 crypto/evp/kem.c @@ -239,7 +239,7 @@ bb208ef3a2c7ebdc518bd38f2f07a17cff356040f1c5d68eea13bd9275897a52 crypto/ffc/ffc e9a500ddbe96cb5b302fd2db74fac0924a6ac45732df5ee1c09e82b19d06ccfd crypto/ffc/ffc_params_validate.c f172c8c2112ee82716a7bc3a3e05d5cc26188c66b9d768ac1ff906845063d2cc crypto/hashtable/hashfunc.c ed523d9793ff9db947857bca354067d17b8de5a4b28604dbf902320e62d93e33 crypto/hashtable/hashtable.c -7a9af0b14f1463b36de0689bc434a318adcb7990bb23862bf1d2a0adf510583a crypto/hmac/hmac.c +9a63ec43c8b9a55e0b135394a659026c1d1236978ebbb5df0e3c4c5c58b62ef4 crypto/hmac/hmac.c 907dd44e0bf873eebefcb4d82975b72ecec9e0f3c348c79314450fdaa78d4073 crypto/hmac/hmac_local.h 0e2d6129504d15ffaf5baa63158ccec0e4b6193a8275333956d8f868ef35127e crypto/ia64cpuid.S 29c020cf599c24ef9969a42e00e690a7b463c20dd90356b0a4117ca31b13db6f crypto/initthread.c @@ -248,28 +248,28 @@ ed523d9793ff9db947857bca354067d17b8de5a4b28604dbf902320e62d93e33 crypto/hashtab 899ba6a9049a61d5b175637907f747f58863cd8950409cefac8fbc8f574f970c crypto/loongarch64cpuid.pl 460a7af09cde89a820b091522ada1310cfcec99c60aee505f94c48c35e9a29e8 crypto/loongarchcap.c f866aafae928db1b439ac950dc90744a2397dfe222672fe68b3798396190c8b0 crypto/mem_clr.c -23ff635daa1a3149e14de6c2a41b82a7587801581bdf39b8a82e9c624da95471 crypto/ml_dsa/ml_dsa_encoders.c +1812ee360303b9fdcebe6dd0690944646bd9605ee67e3554c691cf5993293c46 crypto/ml_dsa/ml_dsa_encoders.c 825105b0a2c4844b2b4229001650ff7e61e1348e52f1072210f70b97cd4adb71 crypto/ml_dsa/ml_dsa_hash.h -2fbef0188a8606c56f2ffffecfbbbd13ccd454c2af949d6e37fb7c929974f1d4 crypto/ml_dsa/ml_dsa_key.c +2bebd01093de6f77dabb8b6e5ac3deaad9104904956691e22d80f105a3e526c2 crypto/ml_dsa/ml_dsa_key.c 579c1a12a5c5f014476a6bf695dc271f63074fb187e23ffc3f9ccb5b7ea044f1 crypto/ml_dsa/ml_dsa_key.h 3f98eb0467033d0a40867ef1c1036dcfea5d231eeac2321196f7d7c7243edace crypto/ml_dsa/ml_dsa_key_compress.c 170292bfc8761e39b688ccfb21b3660af6e1a875aa38ff7448cc22f71f5874c5 crypto/ml_dsa/ml_dsa_local.h -0490a89372b79d98c2fdc294f836fddd7a54a148202ffbd50c2d4371816a94d8 crypto/ml_dsa/ml_dsa_matrix.c +6ac18f9ef27efc7fddc38ad5edec94fcf76a972ca9fcb6bdc5472673d885d238 crypto/ml_dsa/ml_dsa_matrix.c ff65c82c56e341f47df03d0c74de7fb537de0e68a4fa23fa07a9fdb51c511f1c crypto/ml_dsa/ml_dsa_matrix.h c2652262227348b8bb053a239e8491b26f08d6fadc47ba3471302f5797ae1c62 crypto/ml_dsa/ml_dsa_ntt.c 3e0980e67842c4d8637fa449ac41e9d650c614c1074c29f1021605d229a4f73d crypto/ml_dsa/ml_dsa_params.c 10e37ab3ee09a45d99007665e073efb2b062c819f30af8694c6b0f411eb33822 crypto/ml_dsa/ml_dsa_poly.h -26be5266a9f1a33999a5a68c96cffc7932ba64521d9554dabe7397591611c852 crypto/ml_dsa/ml_dsa_sample.c -26ce39dd4cdac0a1c00cee24d53e156c16a1577c71a8a96bce3e2b4130afa6f5 crypto/ml_dsa/ml_dsa_sign.c +abb4f2263fb9b6d08911e1b8e2df2c2de636d6255f7cf3eee594f50dedcefc0c crypto/ml_dsa/ml_dsa_sample.c +f1cbf5ebe46fe456e338a496193bf028d48a28bb3d4804591094babe84d83b25 crypto/ml_dsa/ml_dsa_sign.c 5217ef237e21872205703b95577290c34898423466a465c7bd609b2eb4627964 crypto/ml_dsa/ml_dsa_sign.h -8311e08d9d0e2e073092d0cfaf64851fb8d0f0708dfc2707422f525f87f269d0 crypto/ml_dsa/ml_dsa_vector.h -0fbbb11e30b7e3f4e5366334e273dcc3f6440ed04a0758f0c99279c25b8c0baf crypto/ml_kem/ml_kem.c +afc44b2cdf6a03555cebcc0398179b44f5810098d0b17dcb2b0c0c62023d6964 crypto/ml_dsa/ml_dsa_vector.h +dd95a5261fd1624e1e93270b0dc9404c887506a402d55521a5074975db833fd6 crypto/ml_kem/ml_kem.c 36e24eae5d38cc9666ae40e4e8a2dc12328e1159fea68447cb19dab174d25adf crypto/modes/asm/aes-gcm-armv8-unroll8_64.pl 33357356cd739d4ae89d52f0804b6900e4b94d8829323819c6f64c8908e978df crypto/modes/asm/aes-gcm-armv8_64.pl -a91995f81b384b175ecf252690030bb068d6af64bfcdab2fe753484b2d07a184 crypto/modes/asm/aes-gcm-avx512.pl +573c286991352233cb068d0e218c5cb1e6fe5d07a924496dbccca95fa82e1d4d crypto/modes/asm/aes-gcm-avx512.pl 8fab6574aa99ee635d564dbe68b014562b61af37fa4f151210690837cdae6707 crypto/modes/asm/aes-gcm-ppc.pl dd0de5ca8913a941cfff781a42fba43227e133976a24d0fddebf63909f7e010a crypto/modes/asm/aes-gcm-riscv64-zvkb-zvkg-zvkned.pl -9dcd3be86cda832ebe0394f5a859a761f4b711f2010fb606457f754722c5fb84 crypto/modes/asm/aesni-gcm-x86_64.pl +a4fad5a5cb112929323632e4f3f5fce7d6f0ceb6ea2e3ed1a4a2165f05fbf0b5 crypto/modes/asm/aesni-gcm-x86_64.pl c2e874a8deb418b5d8c935b2e256370566a5150e040c9fa008cdb5b463c26904 crypto/modes/asm/ghash-alpha.pl 6bc7d63569c73d7020ede481f2de05221ac92403c7cc11e7263ada7644f6aa9b crypto/modes/asm/ghash-armv4.pl 097975df63370de7ebea012d17de14fc1f361fb83acf03b432a99ae7d5bceb24 crypto/modes/asm/ghash-c64xplus.pl @@ -281,7 +281,7 @@ e6d6ce559210aee1e97f098683e290c221cc90f6f4f8047b331e8071a8387559 crypto/modes/a 92071f9c046f312c4eb7df483f385bc71ade863392e1acf3e821912bcc5cfaa7 crypto/modes/asm/ghash-s390x.pl 6af1a05981e1d41e4dea51e58938360e3abc4a4f58e179908242466d032b1a8a crypto/modes/asm/ghash-sparcv9.pl 26f55a57e77f774d17dfba93d757f78edfa3a03f68a71ffa37ccf3bfc468b1e2 crypto/modes/asm/ghash-x86.pl -487e23973c9c782d375a956da6231e91f450182d8822d3f86fd4924e143fed70 crypto/modes/asm/ghash-x86_64.pl +3d746cc0cf6cca866e34cdbbd79f5660244033fa440ed82aaaa9dd16cebf821f crypto/modes/asm/ghash-x86_64.pl a4e9f2e496bd9362b17a1b5989aa4682647cefcff6117f0607122a9e11a9dfd9 crypto/modes/asm/ghashp8-ppc.pl 92f17ee53bd40123358ce5b37bcd6063bfa7d6860dd734d4ac585249c03a6b32 crypto/modes/asm/ghashv8-armx.pl ca4be187fc1805d498f2adb823509f0519e214644029c18d331b5b01a0891a9d crypto/modes/cbc128.c @@ -312,7 +312,7 @@ ed6956c34da5127fbf8f1a067654b617c261039743a12fd1d296a1dd01b05c26 crypto/params_ fcafd9ac56254e921f43dda47aa6d19ff42b3461ff3a72e0bff1840793f96701 crypto/provider_core.c aa58d7800d3ccf2989b0de3c2e2710dfac36c88dc51659129897b0dfd2162527 crypto/provider_local.h 5ba2e1c74ddcd0453d02e32612299d1eef18eff8493a7606c15d0dc3738ad1d9 crypto/provider_predefined.c -5f077b3d3c0127c9051907f91b7184d18ad045452e0cd891937932c8fb1f129f crypto/rand/rand_lib.c +1e919f7f3c860eb21bf2f6f868dae076c64c53f1ad794c6764f69329724c3fc2 crypto/rand/rand_lib.c 9e162caba63741e3df4d0f1c49a7555263ebc120cfb643546ea7e34d3f5eb862 crypto/rand/rand_local.h dce7413b4c4e588c9a099c6fd7c6c9a397e034f259a2027d4ea8bdfe149164fa crypto/rcu_internal.h 0c1d3e0e857e9e4f84752a8ef0b619d8af0d81427b52facbd0174e685dac9a47 crypto/riscv32cpuid.pl @@ -322,7 +322,7 @@ f0c8792a99132e0b9c027cfa7370f45594a115934cdc9e8f23bdd64abecaf7fd crypto/rsa/rsa b1584c4a1a5f83a1fd43d854ce72bb11735aa34945f2b2f983228f36f27fdad2 crypto/rsa/rsa_backend.c 38a102cd1da1f6ca5a46e6a22f018237964336274385f5c70cbedcaa6997647e crypto/rsa/rsa_chk.c e762c599b17d5c89f4b1c9eb7d0ca1f04a95d815c86a3e72c30b231ce57fb199 crypto/rsa/rsa_crpt.c -e666568eadfd01ff3e435364dee2575fca7ff3e6855b2c258fa1e4d04239d933 crypto/rsa/rsa_gen.c +157eec6c45b95ed974324055f594885c50e33616af3af06efb558d651a786c69 crypto/rsa/rsa_gen.c f22bc4e2c3acab83e67820c906c1caf048ec1f0d4fcb7472c1bec753c75f8e93 crypto/rsa/rsa_lib.c 969a13b951b8a77337fef84437b1aeec49ab1c73ecbceeb4b0df2174ae16a9a2 crypto/rsa/rsa_local.h cf0b75cd54b61b9b9a290ef18d0ddce9fb26a029a54eb3f720d9b25188440f00 crypto/rsa/rsa_mp_names.c @@ -350,13 +350,13 @@ be1e7dd9998e3f31cfa6e1b17bc198aeec584a8b76820e38f71d51b05f8a9f2a crypto/sha/asm 79dec13ccbee4a6758a22d92bfd5694565416219e48b6894dfb63c6b0029ae28 crypto/sha/asm/keccak1600-s390x.pl 3fb93b9440f5c3008b5c876a8106acc5f8d38f1afedd79381f0befec7dd7d72b crypto/sha/asm/keccak1600-x86_64.pl 831b8b02ab25d78ba6300ce960d96c13439bfba5844e13061e19c4e25cbacc3d crypto/sha/asm/keccak1600p8-ppc.pl -75d832db9bf0e98e7a5c522169060a6dd276c5118cfb297fc3f1111f55cd4007 crypto/sha/asm/sha1-586.pl +131d338bc716d9b5d4c1d3e8de213aa621f7581f91ec0ee7e2e56a9a94f1822b crypto/sha/asm/sha1-586.pl c96e87d4f5311cd73bbdf499acc03418588be12426d878e157dd67e0099e0219 crypto/sha/asm/sha1-alpha.pl 695ef6f8041f37f4b39cb7099e9c7c3a29d6f823823df7333530d375f5f5e01b crypto/sha/asm/sha1-armv4-large.pl cb32284af92d99d7046b99dd5bbd894d53531f7b99d351235a939c542680193b crypto/sha/asm/sha1-armv8.pl 11d332b4e058e9fa418d6633316d2e9f9bf520a08b2d933e877bdf38b2edefcf crypto/sha/asm/sha1-c64xplus.pl 32ff0e701a7b8f25bcfe8477b20795de54f536527bd87d3ce694fd9aaae356d4 crypto/sha/asm/sha1-ia64.pl -de6c7e8c1e27779a8cf1ce2a04f487a3d4dc510d5ba240cd06128ecc8574e424 crypto/sha/asm/sha1-mb-x86_64.pl +9fdde42e62c5a5c0457316ac35e6f6f940061634ab1e44a1ef5cdbacb656d738 crypto/sha/asm/sha1-mb-x86_64.pl 0f5c63cf09e950d1b488935ab3b5562e3e9d5cd1a563fb88a41e3dae90a35e6d crypto/sha/asm/sha1-mips.pl b5ffd7b6dbb04c05de7efa2945adb67ea845e7e61a3bf163a532f7b6acdf4267 crypto/sha/asm/sha1-parisc.pl 482cd23ca6ec38d6f62b90c68f9f20643579c50f2c0fbb0dab1c10a0e35efe77 crypto/sha/asm/sha1-ppc.pl @@ -364,11 +364,11 @@ b5ffd7b6dbb04c05de7efa2945adb67ea845e7e61a3bf163a532f7b6acdf4267 crypto/sha/asm 7fd355b412ddfa1c510e0ba3284f75b1c0d621b6db2ecb1d2a935d5cdb706628 crypto/sha/asm/sha1-sparcv9.pl 24554e68b0e7b7db7b635ff149549015f623ca0bcd9ae90439586a2076f6ae80 crypto/sha/asm/sha1-sparcv9a.pl 74d197cdd72400cabbff7e173f72c8976723081508b095dc995e8cd1abf3daa6 crypto/sha/asm/sha1-thumb.pl -dc363497de4fa3bc88b16e834ddf4967aecabdba5ea3ddd6113cf00da7e278bd crypto/sha/asm/sha1-x86_64.pl -c099059ef107f548ea2c2bab64a4eb8c277070ce6d74c4d32bb9808dc19c5fa3 crypto/sha/asm/sha256-586.pl +a579c0ab82151f8879bac23ef1ffb198dfbf9b02d2015c500a232baafc6a3722 crypto/sha/asm/sha1-x86_64.pl +494390ee974a00a0bfdb0ee46116efa45379b5e63988c0a3be9ff6183be2359d crypto/sha/asm/sha256-586.pl 0f01f7b5b0699f1e8ca260439d009febfa5b85b9e7b0933d236467e383aaaa2e crypto/sha/asm/sha256-armv4.pl 93ddc97651ee3e779144a3c6b3e46a1bc4aa81e75cd7b9df068a2aef8743d25f crypto/sha/asm/sha256-c64xplus.pl -9a68b6642b20e3cdccd636c4a934a6e0114160506784583f684ad65aefac2872 crypto/sha/asm/sha256-mb-x86_64.pl +478035fb599566f468f68ae9a3c5311b1e9c6257de6c47a7a32082c8aee41c8d crypto/sha/asm/sha256-mb-x86_64.pl b14670492f24cd0d2fedf8780e981b7da123203395c085334d4571b619b0a610 crypto/sha/asm/sha256-riscv64-zvkb-zvknha_or_zvknhb.pl dd82e1311703abb019975fc7b61fb87d67e1ed916dddd065aced051e851114b9 crypto/sha/asm/sha512-586.pl 16e68ac669860c5bf8e4db81cd3d64fc2c22168e129c2597e94b0f56fafcdfa8 crypto/sha/asm/sha512-armv4.pl @@ -381,7 +381,7 @@ fb06844e7c3b014a58dccc8ec6020c71843cfdc5be08288bc7d204f0a840c474 crypto/sha/asm 07804b96dda856cffaef291641c4ae7f59288ed1e65e38823cfdcb74f8ac5295 crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl 38e0455fd6a2b93a7a5385379ca92bc6526585ca1eb4af365fac4c78f7285c72 crypto/sha/asm/sha512-s390x.pl 0611845c52091b0208dd41f22ddef9dd1e68d3d92fa4c4360738b840a6314de6 crypto/sha/asm/sha512-sparcv9.pl -473874a27b031e3d6c3dd0388c7231aa299e07c5832fa7499a081488e6f5680a crypto/sha/asm/sha512-x86_64.pl +14b563ed790d9bd76b0f45e27b75b5fa46d393d7bea8704d2894004adc3f4ac6 crypto/sha/asm/sha512-x86_64.pl 8725cabb8d695c576619f19283b034074a3fa0f1c0be952a9dbe9793be15b907 crypto/sha/asm/sha512p8-ppc.pl 93858e3b530333a129127b8df8cd3326cf55b770238b4fff2474c4e6e3def1dd crypto/sha/keccak1600.c 306cacd3f86e5cacaca74c58ef862516515e5c0cafaff48636d537fd84f1c2fb crypto/sha/sha1dgst.c @@ -391,19 +391,19 @@ a7e074a2f2cea0c33e7875eacc8adb465b5802e4c1d100cda79ac3dd52cdb453 crypto/sha/sha 61ab6d7d7da9e65120ec59cfa9f5ede785502ae371696c3e4e04e039743ca111 crypto/sha/sha_local.h dfd99e02830973ab349409ac6ba0ee901ba7736216030965bd7e5a54356abd7c crypto/slh_dsa/slh_adrs.c c9b270de1259d9fa71a4d352786357bcf1dd3d22075edab84501e2f8e550b271 crypto/slh_dsa/slh_adrs.h -95d42ca839ff34a050a7006734a06c157ad259512c1a10b978e9f899efe69f12 crypto/slh_dsa/slh_dsa.c -ab7b580b1cba302c5675918b457794a3b3d00aac42297312d9447bc6f6a40b09 crypto/slh_dsa/slh_dsa_hash_ctx.c -892a5ed5213c0898882bfc42f72be2864b363cd62d08a3b337c20b4fa557bef0 crypto/slh_dsa/slh_dsa_key.c +26566d0e641456101bd17338dbbb16f59dfacd34f76cff5882133a0ab7323130 crypto/slh_dsa/slh_dsa.c +6b88a8ca514dd2ead7808bf08ea7c7e89125cdcfae8f0db4f3518069382fdfa0 crypto/slh_dsa/slh_dsa_hash_ctx.c +924e686178fdc5984d1a09b02d91e04d4b9c4eb818ee384107ca64357c237e39 crypto/slh_dsa/slh_dsa_key.c 4c7981f7db69025f52495c549fb3b3a76be62b9e13072c3f3b7f1dedeaf8cc91 crypto/slh_dsa/slh_dsa_key.h -5dcb631891eb6afcd27a6b19d2de4d493c71dab159e53620d86d9b96642e97e8 crypto/slh_dsa/slh_dsa_local.h -adb3f4dea52396935b8442df7b36ed99324d3f3e8ce3fdf714d6dfd683e1f9f0 crypto/slh_dsa/slh_fors.c -5d3855cb2927efa4b28fec4357694bf863ac8dc6556009bdfa800ba16cb80b4d crypto/slh_dsa/slh_hash.c +f8007c0f93908810f138f872809cd49013e22192907f4c38d290b6c4566230f5 crypto/slh_dsa/slh_dsa_local.h +6d3f3c0be706c1dd871db863f2344f709a2b7fbb60a0d91298aeb2222f767a87 crypto/slh_dsa/slh_fors.c +f6f5286c6ce9f37cbb527144ec09fd86ae796ac3e71f0bdbb45b5a08a0692122 crypto/slh_dsa/slh_hash.c 3af167addbfd97f831f2a1981133bf4e2b62b95dc9477767797f7e4a653556db crypto/slh_dsa/slh_hash.h -6402664fbb259808a6f7b5a5d6be2b4a3cc8a905399d97b160cdb3e4a97c02c4 crypto/slh_dsa/slh_hypertree.c +1eebf59ebd0859be5a8deddd2f664f99158060904234532af608a44dd6d92d19 crypto/slh_dsa/slh_hypertree.c 1ce9b4f4f90a6f82005c9cdc0ea1f6b6876556c76f8bfd95f4c003a1c195a266 crypto/slh_dsa/slh_params.c 86b16a2c36d708cb880ba49648bb3051c2997188c8ea6aec9292534b97232c7f crypto/slh_dsa/slh_params.h -1aa9dc1c6fe59d024485df9a6b782ac4d0656a31b12faee749fe098911799eaf crypto/slh_dsa/slh_wots.c -59db81a3342c0c89b030756168b9a7f09c938b2cd3498335108e0a32c041b6e7 crypto/slh_dsa/slh_xmss.c +668a2431034f8c604970ed531e32b7b20b6b710e258d1db0a8eb06a13d900f0e crypto/slh_dsa/slh_wots.c +37fff5f88dd8bcd0ad8cdbab130c5a9a018422fe59b141bdb11bcee8fd1b046f crypto/slh_dsa/slh_xmss.c 9ef5a01caccc2eb15f72e367d0424737040ac8018479bbbbce3d216c655765c2 crypto/sparccpuid.S b462d1efe0acd798e1ec5f37fd1c824a587e1773e6a6f984d5a332581573ecbc crypto/sparcv9cap.c 9e16e8641ac5ec2cb2fcc8e4796af5b698d6fa4ce85e374bd8f5b4edb51e6428 crypto/sparse_array.c @@ -417,7 +417,7 @@ f06b08138d73b834471abc4a3ba43b2be838f7196c937c3e933694d6cd69f74d crypto/thread/ 2e5955d706b96c487e4875ffbe208fac15bdca06b33cee916d5343978c14efa1 crypto/threads_lib.c b3743dfd1c13fe70dc57a5a0b2ec540ab3afa748699eb6ef36f56f4d36d06ef3 crypto/threads_none.c 7b97b0f57f6b7cac89c1b8bd03bee34fb39d33cfae1632e75571ba106a5b9442 crypto/threads_pthread.c -9dac146cda57fb53d9b9eb30ff1fc81090f5e62dbe05d4cd97ed11cf501fc78c crypto/threads_win.c +a4692ad34bd148e06344672e08a3ba928719ca5af4d11ba54d97926759dcda0b crypto/threads_win.c 93f8fe09f96492a6be6772ddbf0cc37912fc2a90acb7faea378da1735fe20f6f crypto/time.c 88c5f9f4d2611223d283ebd2ae10ae5ecbb9972d00f747d93fcb74b62641e3f9 crypto/x86_64cpuid.pl 085d9fe93adf232f1ff838be9235046c2c2abe2daeb0e6342921d8f2e955dc18 crypto/x86cpuid.pl @@ -468,7 +468,7 @@ b41a5d9a7bdf60df169e327b41f16489830b82393dd663d1f89f81da4483eaa7 include/intern 9bafa62442fdeda25b97fdbe8e8bf8ea62a5b5167adb2ac7ebbb13db271673f9 include/internal/ffc.h 0a82ff0abab6ab815f9cb523b9643854346b47ff276f8868d1cbe48efc1b20ee include/internal/fips.h 923d4fb14a08f9b251b9bf9727bc50930d0279e8b63243faf85374bdcbbfc4e0 include/internal/hashfunc.h -a37a58d887ae4331a19179900b8d077afa1174c5152d53dc1533c37a65f319d6 include/internal/hashtable.h +d76c942d91e97f8954852ec7ae5a790a591b44762bba31930af585ed5f861fe0 include/internal/hashtable.h f6f30785e3eced1ccdd4b149286ff2b8bbb860eb7e070cbe54c997aa022854da include/internal/namemap.h c367e6120d26a2b629f4db7e179973e33fb095e1102d5c7a69c744b88ebe4469 include/internal/nelem.h eef3ec603b9877bd24a8fa1dbcd7752618fa74943b045515720bb0ca61394ae5 include/internal/numbers.h @@ -568,7 +568,7 @@ a481e8762c694b3dac0e74aac8626fe60fa94962a14914f1f6969ea1214c40b1 include/openss 9e04a3e9ca5352adffbdd75a5ea5237e8ff96a8c0a842368cc3a29de006b2ee7 include/openssl/types.h 62e0cddeedfc217ac02bf37f3669ccea8d0822a88a74a8ec82b844a85b2700aa include/openssl/x509.h.in 869959c3d557d2ace84f38b7a8d0f23b3b0854de7f952f46310e828af04554dd include/openssl/x509_vfy.h.in -5dbee881fe4e1f08a773e8bd34eeda7639be7c474a3d4d6e7c8d779e19c7eb2a include/openssl/x509err.h +53a45ca5d00026ef0a256f7ff27f5708d5af0a44177a0fc4b209ec054d44e18c include/openssl/x509err.h c0a9551efccf43f3dd748d4fd8ec897ddaabbc629c00ec1ad76ce983e1195a13 providers/common/bio_prov.c 6d25e1b61731cc558c2f801350d0cd874d3c19a3b0a03f52394c11fcaf2d51a5 providers/common/capabilities.c f94b7435d4ec888ec30df1c611afa8b9eedbb59e905a2c7cb17cfc8c4b9b85b8 providers/common/der/der_digests_gen.c.in @@ -611,7 +611,7 @@ b10730f4d302344579c09f43d5f9c5538bb6b4acd60de7430c24269fc522d5a5 providers/comm e2f8f00519d81aa16f1c30e8cbf9a0d8e898a1cb5c8b38bb01dd9ab513e34c9e providers/common/securitycheck_fips.c abd5997bc33b681a4ab275978b92aebca0806a4a3f0c2f41dacf11b3b6f4e101 providers/fips/fips_entry.c d8cb05784ae8533a7d9569d4fbaaea4175b63a7c9f4fb0f254215224069dea6b providers/fips/fipsindicator.c -0c473190a4b6809caed57997e44ee9ec949bcf01c542633e2881d07c809d3a51 providers/fips/fipsprov.c +f0f1486219ddb5817b5105c36f384cb9ef095ddceec50966fe178f4b4177028c providers/fips/fipsprov.c 8f52eead96febbce9e7f2bf5aaea557efe8f94ce078044959e80e5ae78432539 providers/fips/include/fips/fipsindicator.h ef204adc49776214dbb299265bc4f2c40b48848cbea4c25b8029f2b46a5c9797 providers/fips/include/fips_indicator_params.inc f2581d7b4e105f2bb6d30908f3c2d9959313be08cec6dbeb49030c125a7676d3 providers/fips/include/fips_selftest_params.inc @@ -639,7 +639,7 @@ be18c20e0197f25fe7b9e0268657a2271a69d216b89cb100f082fa5fcaad1e07 providers/impl 60c4f604cf9b5457be48f31cc24ca21729660381081b2dbf99f362a013a09684 providers/implementations/ciphers/cipher_aes_gcm_hw_vaes_avx512.inc e2886780637db72b12c9bc488d81647ed55a7f5c850efd4bdbf88ef7127e1913 providers/implementations/ciphers/cipher_aes_hw.c 89de794c090192459d99d95bc4a422e7782e62192cd0fdb3bdef4128cfedee68 providers/implementations/ciphers/cipher_aes_hw_aesni.inc -eac58fff6aa9918d657228c2707f1b3f0ef8f1210c97575f3c264db78bfd996f providers/implementations/ciphers/cipher_aes_ocb.c +b88e88831695dfc165ce83e64802ffb8240f1f696d9c67f350b9ff1b2e913212 providers/implementations/ciphers/cipher_aes_ocb.c 88138a1aff9705e608c0557653be92eb4de65b152555a2b79ec8b2a8fae73e8f providers/implementations/ciphers/cipher_aes_ocb.h 6c3a89771719b36d6917d23464be5441836378393731af96ba165fd788df1a41 providers/implementations/ciphers/cipher_aes_ocb_hw.c c7aac28a9dca1ad46e5bce4de93e07dffec1f89fab82394c3ff7cf1bda8b483f providers/implementations/ciphers/cipher_aes_wrp.c @@ -655,7 +655,7 @@ dc4626becaabc3990549483d9ef5f05c7dd9a9c2cf9be96ade3ba6a6e203f7f5 providers/impl cca34f1c7baf3a98964f7ce19a59e06d1eaf2ada121a0d4a438f4078a072b325 providers/implementations/ciphers/cipher_tdes_hw.c d2f418806c7ed45f118683bc13329573804592684e522efced0fd0921f4548fd providers/implementations/ciphers/ciphercommon.c ab9a2edb23aa61cf31da6addd8674a6028f93399eceeeee35a56ee770338fd6c providers/implementations/ciphers/ciphercommon_block.c -6b6090c233ddf29d819f2559361aeeae03505de7626a127628d5f0f6d3bce295 providers/implementations/ciphers/ciphercommon_ccm.c +fafb07c3fd77a89cff1d2efbb6edc0767132fc30c57f9e282080da04e6762499 providers/implementations/ciphers/ciphercommon_ccm.c 6632a555d5bcd5af67d0355ce46c2906bb3a0dcdf1651595b29189c40a5ca675 providers/implementations/ciphers/ciphercommon_ccm_hw.c ab51261da6aea5a3cca74a7561e4b89e6ce83f2ac497a5c766ecd3c3bff95152 providers/implementations/ciphers/ciphercommon_gcm.c bb67eaa7a98494ca938726f9218213870fc97dd87b56bda950626cc794baf20b providers/implementations/ciphers/ciphercommon_gcm_hw.c @@ -692,39 +692,39 @@ abe2b0f3711eaa34846e155cffc9242e4051c45de896f747afd5ac9d87f637dc providers/impl a9a5a3ba575b1a372f5a09135667ac1b0e303f8b19b0707804390aba9e266eca providers/implementations/kdfs/sskdf.c f01cbd7c5351d4aa9ae667627503b2cfef6fc0695e7a42296b7bf015c9a418b3 providers/implementations/kdfs/tls1_prf.c 39207243a84beb670cb0e64b6d0fe7bfc6a3dd84000617b647a3ecf52a1da3c2 providers/implementations/kdfs/x942kdf.c -748af266d06006da10524f3a621c65b8c3eeddf8b1ccd06ecdc6b689564d220c providers/implementations/kem/ml_kem_kem.c -35549cec7031452bb5b46aa8a86028abc7a3a2b39f9f6564fa4bd402451bc647 providers/implementations/kem/mlx_kem.c -e89b894af920504160abfc11860b89b505d116d978162a02213f72500180903b providers/implementations/kem/rsa_kem.c -aa13d72bc69a374db72b6d44e2f2c2ddd5f7bddbe16b950e3c4666d876c63735 providers/implementations/keymgmt/dh_kmgmt.c +b1431361b8a3448b73f4a46c48b3a4f9fd378c2abba67563f4407b1c7f007fca providers/implementations/kem/ml_kem_kem.c +926e08e60171cc867220e0f106533ed155132a034690bddea1e7793a879ebf73 providers/implementations/kem/mlx_kem.c +ff22e920552b82db3dab51b09f9dd2fd038ef0d57fb76cea5578e703653d28c9 providers/implementations/kem/rsa_kem.c +6599ad60eef3554741e049c3ff1bd9cc6064d4f3d1835e1ea5dec3a0c14c80bb providers/implementations/keymgmt/dh_kmgmt.c c0446d1b2101ddd977063516b87d23f424cdca33473f293db4c3974b674169b0 providers/implementations/keymgmt/dsa_kmgmt.c -2b98ba2124a86eae2adc7b88bfa26e47b548e9628b99180cc2cd841eed5ed8da providers/implementations/keymgmt/ec_kmgmt.c +45480796e6ea50cbe9529c17f9fa04228a9126dc7e7e32971519eeb6d6ac267c providers/implementations/keymgmt/ec_kmgmt.c 258ae17bb2dd87ed1511a8eb3fe99eed9b77f5c2f757215ff6b3d0e8791fc251 providers/implementations/keymgmt/ec_kmgmt_imexport.inc -167cd7df056bf46f3481cf6101fb6cfca55dea592f896c2b29649df1939885c4 providers/implementations/keymgmt/ecx_kmgmt.c +c559f1f265388e7b1c8195188fcc71ac8af09b3398530ec8ed7a9afd7b41281e providers/implementations/keymgmt/ecx_kmgmt.c daf35a7ab961ef70aefca981d80407935904c5da39dca6692432d6e6bc98759d providers/implementations/keymgmt/kdf_legacy_kmgmt.c 69b509e9c7fe9692622d1059917c3adb991c0047e11bc116f0a393a3a0539445 providers/implementations/keymgmt/mac_legacy_kmgmt.c -3c63e65bd1a6a2e853828205c015a50c38a82f2fee9bf6787dce6dab7331bb91 providers/implementations/keymgmt/ml_dsa_kmgmt.c -5c95eb8192483b2d81435e52aef6b2c96180bb22a67f717c29661a13b5861b02 providers/implementations/keymgmt/ml_kem_kmgmt.c -f37c8b7bb59d4b199889044992cb1b18ad39f2eafc87029f5348c55a95195e8c providers/implementations/keymgmt/mlx_kmgmt.c +7d197679dc4ae59f0e697749c56cb76399fc5eed88e94585dfd5ebdb23466e53 providers/implementations/keymgmt/ml_dsa_kmgmt.c +2df9ca1a68a9b6e1d1b108148b54ccf5454da3afa34e510beb2f4516e473e4c6 providers/implementations/keymgmt/ml_kem_kmgmt.c +4cec24edda3df01c08bef98a0a177ccdd1f8ba84e37c399dc568e010d7c0b29f providers/implementations/keymgmt/mlx_kmgmt.c cd4b8129eaccbd77f9b6c725d3cb57b71109c4649115ec786b6495100afaddf2 providers/implementations/keymgmt/rsa_kmgmt.c -d640cff1c46911b69866eb83f48beba42a1741bb1d3f1db6e7201077a57761fc providers/implementations/keymgmt/slh_dsa_kmgmt.c -9d02d481b9c7c0c9e0932267d1a3e1fef00830aaa03093f000b88aa042972b9f providers/implementations/macs/cmac_prov.c +92621573e975489b821884151d2de751e462fcf91efa83cb3bf8f4fd40cd241b providers/implementations/keymgmt/slh_dsa_kmgmt.c +2a66bc54579cb1fcd72674a1e60a7a1f798c13ab964a45e5603bed699268354f providers/implementations/macs/cmac_prov.c a3bb4d7914f45cf82f86cd92135e20a712274ca153d9ed5ad24db7f33710726c providers/implementations/macs/gmac_prov.c 2d6b8c42c67e3e43d8d0035463cbff590dabb7da815f9e437a3a72d4b6596319 providers/implementations/macs/hmac_prov.c 40686337be4261685f176bb10042d903d46ab10c90e10ac42d3842e9b5ddd960 providers/implementations/macs/kmac_prov.c 0ebc5a48655a697231918644397308e64914c32421e9b8ee7afd7779b6a2fdb8 providers/implementations/rands/drbg.c -d9e41abc1780bb253bdca6c58cc32af7d0a774e52c91fc5d64577f71defc52c2 providers/implementations/rands/drbg_ctr.c -cf98646defb0b385d6ce4bedcd51559c9a03424491f4576ea7eb41e3db8a18b3 providers/implementations/rands/drbg_hash.c -57561d4bd3a79e6a250310a989958409437dfa68b2818d5f0dbb8a5e7ef04bb7 providers/implementations/rands/drbg_hmac.c +d2805527aa28c27dc0d10f3e35b64e18626691b3c864806dd644b7dd1640ec49 providers/implementations/rands/drbg_ctr.c +e624059b1c9f878655d6a21a4c295c43d147ea913f638a2d007a1a68379180f8 providers/implementations/rands/drbg_hash.c +3aa1dd31f0db1ab0a7a5a3037f722e284587c244126810268622fae65bef77d7 providers/implementations/rands/drbg_hmac.c 841617c81d6d5eae5ea59064e8b45947d436d3e53b49283329d17016866d8f34 providers/implementations/rands/drbg_local.h 355bd437dde9ecd1da89f42691147f2b5cf9a012ff5f55062bf83b6bead1e181 providers/implementations/rands/fips_crng_test.c -4913fec58a2648fcec0e5a94dba9decab0505a6d725bed6eb861ce854db81df8 providers/implementations/rands/test_rng.c +90ea602ec88f7c0a78f3e7c801cdd3574a221f04497121a9ea7dcb05b7ee6765 providers/implementations/rands/test_rng.c c6c709dfd8b1be036e2a5232d3b21dc25f0150f2aae24cc7db6b09cd790a04ee providers/implementations/signature/dsa_sig.c d10d611713a6d9aa5cdbe636f1ba90404043431fd1df01fc1a1ce8499bf96ad0 providers/implementations/signature/ecdsa_sig.c a837f69cb1aa5d0327372e26a63a8492b6ffb1156325f66e880c202011d07cbe providers/implementations/signature/eddsa_sig.c e0e67e402ff19b0d2eb5228d7ebd70b9477c12595ac34d6f201373d7c8a516f4 providers/implementations/signature/mac_legacy_sig.c 51251a1ca4c0b6faea059de5d5268167fe47565163317177d09db39978134f78 providers/implementations/signature/ml_dsa_sig.c -94725f9e466c60c710900ca9878196f359e8421f46d5fb62fda91f5f845caff3 providers/implementations/signature/rsa_sig.c -539d3f55b8fd28826c786cb4e5c0e735173dc0faf268527ea007052be623cd37 providers/implementations/signature/slh_dsa_sig.c +6b293ca81102cd2f234d60f52f839e5bd7a746a42df3fe8a4489e6c214108f50 providers/implementations/signature/rsa_sig.c +ec630d49078bdd901132e7651eaf3478ff3b04e5558c435ffd7c77dcb62e46b3 providers/implementations/signature/slh_dsa_sig.c 21f537f9083f0341d9d1b0ace090a8d8f0b2b9e9cf76771c359b6ea00667a469 providers/implementations/skeymgmt/aes_skmgmt.c 2dbf9b8e738fad556c3248fb554ff4cc269ade3c86fa3d2786ba9b6d6016bf22 providers/implementations/skeymgmt/generic.c 9ba8db9b0e18847ef79ecb77fbc383d8762694be29dfb7d269df6f02dc977222 providers/implementations/skeymgmt/skeymgmt_lcl.h diff --git a/deps/openssl/openssl/providers/fips.checksum b/deps/openssl/openssl/providers/fips.checksum index 7d8252550bd4..f236b8ff81a4 100644 --- a/deps/openssl/openssl/providers/fips.checksum +++ b/deps/openssl/openssl/providers/fips.checksum @@ -1 +1 @@ -f24213807982cf5d2859d5d1b78caa54c249ec28725645d1af28f092d543962d providers/fips-sources.checksums +ee77588030ee4df89ad9ff70a12118a9b89ebc4fde306fd25e9c01ef719d0b26 providers/fips-sources.checksums diff --git a/deps/openssl/openssl/providers/fips/fipsprov.c b/deps/openssl/openssl/providers/fips/fipsprov.c index 419878719e98..3c749018bcfc 100644 --- a/deps/openssl/openssl/providers/fips/fipsprov.c +++ b/deps/openssl/openssl/providers/fips/fipsprov.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -56,7 +56,6 @@ extern OSSL_FUNC_core_thread_start_fn *c_thread_start; */ /* Functions provided by the core */ -static OSSL_FUNC_core_gettable_params_fn *c_gettable_params; static OSSL_FUNC_core_get_params_fn *c_get_params; OSSL_FUNC_core_thread_start_fn *c_thread_start; static OSSL_FUNC_core_new_error_fn *c_new_error; @@ -541,7 +540,7 @@ static const OSSL_ALGORITHM fips_asym_kem[] = { { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions }, #if !defined(OPENSSL_NO_ECX) { "X25519MLKEM768", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions }, - { "X448MLKEM1024", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions }, + { "X448MLKEM1024", FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_kem_asym_kem_functions }, #endif #if !defined(OPENSSL_NO_EC) { "SecP256r1MLKEM768", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions }, @@ -608,7 +607,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { #if !defined(OPENSSL_NO_ECX) { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions, PROV_DESCS_X25519MLKEM768 }, - { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions, + { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions, PROV_DESCS_X448MLKEM1024 }, #endif #if !defined(OPENSSL_NO_EC) @@ -771,9 +770,6 @@ int OSSL_provider_init_int(const OSSL_CORE_HANDLE *handle, case OSSL_FUNC_CORE_GET_LIBCTX: set_func(c_get_libctx, OSSL_FUNC_core_get_libctx(in)); break; - case OSSL_FUNC_CORE_GETTABLE_PARAMS: - set_func(c_gettable_params, OSSL_FUNC_core_gettable_params(in)); - break; case OSSL_FUNC_CORE_GET_PARAMS: set_func(c_get_params, OSSL_FUNC_core_get_params(in)); break; diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c index bf3275f97b38..c1079e0e7874 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c @@ -267,11 +267,17 @@ static int aes_gcm_siv_finish(PROV_AES_GCM_SIV_CTX *ctx) { int ret = 0; - if (ctx->enc) + if (ctx->enc) { + /* Generate the tag when Final is the first empty-message operation. */ + if (ctx->generated_tag == 0 + && aes_gcm_siv_encrypt(ctx, NULL, NULL, 0) == 0) + return 0; return ctx->generated_tag; - if (!ctx->generated_tag) - aes_gcm_siv_decrypt(ctx, NULL, NULL, 0); - ret = !CRYPTO_memcmp(ctx->tag, ctx->user_tag, sizeof(ctx->tag)); + } + if (ctx->generated_tag == 0 + && aes_gcm_siv_decrypt(ctx, NULL, NULL, 0) == 0) + return 0; + ret = CRYPTO_memcmp(ctx->tag, ctx->user_tag, sizeof(ctx->tag)) == 0; ret &= ctx->have_user_tag; return ret; } diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c index 99254cb49a88..62e5a0c1a766 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c @@ -509,6 +509,10 @@ static int aes_ocb_cipher(void *vctx, unsigned char *out, size_t *outl, if (!ossl_prov_is_running()) return 0; + /* NULL input indicates Final, which must generate or check the tag. */ + if (in == NULL) + return aes_ocb_block_final(vctx, out, outl, outsize); + if (outsize < inl) { ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); return 0; diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c index 977f7000c289..673e18702cf7 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -30,11 +30,11 @@ static OSSL_FUNC_cipher_get_params_fn chacha20_poly1305_get_params; static OSSL_FUNC_cipher_get_ctx_params_fn chacha20_poly1305_get_ctx_params; static OSSL_FUNC_cipher_set_ctx_params_fn chacha20_poly1305_set_ctx_params; static OSSL_FUNC_cipher_cipher_fn chacha20_poly1305_cipher; +static OSSL_FUNC_cipher_update_fn chacha20_poly1305_update; static OSSL_FUNC_cipher_final_fn chacha20_poly1305_final; static OSSL_FUNC_cipher_gettable_ctx_params_fn chacha20_poly1305_gettable_ctx_params; static OSSL_FUNC_cipher_settable_ctx_params_fn chacha20_poly1305_settable_ctx_params; #define chacha20_poly1305_gettable_params ossl_cipher_generic_gettable_params -#define chacha20_poly1305_update chacha20_poly1305_cipher static void *chacha20_poly1305_newctx(void *provctx) { @@ -301,11 +301,6 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out, if (!ossl_prov_is_running()) return 0; - if (inl == 0) { - *outl = 0; - return 1; - } - if (outsize < inl) { ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); return 0; @@ -317,6 +312,24 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out, return 1; } +static int chacha20_poly1305_update(void *vctx, unsigned char *out, + size_t *outl, size_t outsize, + const unsigned char *in, size_t inl) +{ + /* + * A zero-length update is a no-op. Only EVP_Cipher() and Final produce or + * check the authentication tag. + */ + if (inl == 0) { + if (!ossl_prov_is_running()) + return 0; + *outl = 0; + return 1; + } + + return chacha20_poly1305_cipher(vctx, out, outl, outsize, in, inl); +} + static int chacha20_poly1305_final(void *vctx, unsigned char *out, size_t *outl, size_t outsize) { diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c index 733547a7e732..1bd0d6a5fc81 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -301,6 +301,8 @@ static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx, if (in != NULL) { /* aad or text */ if (out == NULL) { /* aad */ + if (ctx->len.text != 0) + goto err; Poly1305_Update(poly, in, inl); ctx->len.aad += inl; ctx->aad = 1; diff --git a/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c b/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c index 2b5bddddeb78..7a70b1b09995 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -288,13 +288,19 @@ int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl, size_t outsize) { PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; - int i; + unsigned char dummy_in = 0, dummy_out = 0; if (!ossl_prov_is_running()) return 0; - i = ccm_cipher_internal(ctx, out, outl, NULL, 0); - if (i <= 0) + /* + * Encryption sets tag_set after processing the payload, while successful + * decryption clears iv_set. Use those transitions to avoid processing an + * operation twice. + */ + if (!ctx->key_set + || (ctx->iv_set && (!ctx->enc || !ctx->tag_set) + && ccm_cipher_internal(ctx, &dummy_out, outl, &dummy_in, 0) <= 0)) return 0; *outl = 0; @@ -309,6 +315,9 @@ int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize if (!ossl_prov_is_running()) return 0; + if (in == NULL) + return ossl_ccm_stream_final(vctx, out, outl, outsize); + if (outsize < inl) { ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); return 0; diff --git a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c index 362a806589e6..2c9bff42bbba 100644 --- a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c +++ b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -65,10 +65,11 @@ static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout, return ret; } +static OSSL_FUNC_encoder_newctx_fn key2ms_newctx; static OSSL_FUNC_encoder_freectx_fn key2ms_freectx; static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection; -static struct key2ms_ctx_st *key2ms_newctx(void *provctx) +static void *key2ms_newctx(void *provctx) { struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx)); diff --git a/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c b/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c index 722eadf22897..14c670784c54 100644 --- a/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c +++ b/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -125,6 +125,7 @@ static int ml_kem_set_ctx_params(void *vctx, const OSSL_PARAM params[]) /* Possibly, but much less likely wrong type */ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH); + OPENSSL_cleanse((void *)ctx->entropy_buf, sizeof(ctx->entropy_buf)); ctx->entropy = NULL; return 0; } diff --git a/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c b/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c index 376b3342ddfa..a917fa93d5ca 100644 --- a/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c +++ b/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -118,7 +118,7 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen, if (!mlx_kem_have_pubkey(key)) { ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY); - goto end; + return 0; } encap_clen = key->minfo->ctext_bytes + key->xinfo->pubkey_bytes; encap_slen = ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes; @@ -236,6 +236,10 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen, ret = 1; end: + /* Erase any partial shared secret on failure */ + if (ret == 0) + OPENSSL_cleanse(shsec, + ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes); EVP_PKEY_free(xkey); EVP_PKEY_CTX_free(ctx); return ret; @@ -324,6 +328,10 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, ret = 1; end: + /* Erase any partial shared secret on failure */ + if (ret == 0) + OPENSSL_cleanse(shsec, + ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes); EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(xkey); return ret; diff --git a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c index 78925809d985..47f0c80c9443 100644 --- a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c +++ b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c @@ -131,6 +131,7 @@ static int rsakem_init(void *vprsactx, void *vrsa, const char *desc) { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; + const BIGNUM *e = NULL; int protect = 0; if (!ossl_prov_is_running()) @@ -146,6 +147,18 @@ static int rsakem_init(void *vprsactx, void *vrsa, RSA_free(prsactx->rsa); prsactx->rsa = vrsa; + /* + * Reject the trivial public exponent e <= 1. The FIPS module enforces the + * full SP 800-56B §6.4.1.1 constraints via ossl_fips_ind_rsa_key_check() + * below; non-FIPS callers wanting the complete §6.4.2 vetting can use + * EVP_PKEY_public_check(). + */ + RSA_get0_key(prsactx->rsa, NULL, &e, NULL); + if (e == NULL || BN_cmp(e, BN_value_one()) <= 0) { + ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY); + return 0; + } + OSSL_FIPS_IND_SET_APPROVED(prsactx) if (!rsakem_set_ctx_params(prsactx, params)) return 0; @@ -389,6 +402,44 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx, return 0; } +#ifndef FIPS_MODULE + /* + * Reject clearly degenerate ciphertexts, c in {0, 1, n-1}. + * + * SP 800-56B Rev 2, 7.1.2.1 requires RSADP to enforce 1 < c < n-1. In a + * FIPS build that bound is applied by the RSADP primitive itself (see + * crypto/rsa/rsa_ossl.c, guarded by FIPS_MODULE), where it is also needed + * for KTS-OAEP; the primitive does not apply it in a non-FIPS build, so + * enforce it here for RSASVE. Raise the same errors as the primitive so + * the behaviour matches in both builds; keep the two sites in step. + */ + { + const BIGNUM *n = RSA_get0_n(prsactx->rsa); + BIGNUM *c = BN_new(); + BIGNUM *nminus1 = BN_new(); + int reason = 0; + + if (n == NULL || c == NULL || nminus1 == NULL + || BN_bin2bn(in, (int)inlen, c) == NULL + || BN_copy(nminus1, n) == NULL + || !BN_sub_word(nminus1, 1)) { + BN_free(c); + BN_free(nminus1); + return 0; + } + if (BN_ucmp(c, BN_value_one()) <= 0) + reason = RSA_R_DATA_TOO_SMALL; + else if (BN_ucmp(c, nminus1) >= 0) + reason = RSA_R_DATA_TOO_LARGE_FOR_MODULUS; + BN_free(c); + BN_free(nminus1); + if (reason != 0) { + ERR_raise(ERR_LIB_RSA, reason); + return 0; + } + } +#endif + /* Step (3): out = RSADP((n,d), in) */ ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING); if (ret > 0 && outlen != NULL) diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c index 8a1afe7907b1..eac99a4fed07 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -793,10 +793,8 @@ static void *dh_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) #ifdef FIPS_MODULE if (!ossl_fips_self_testing()) { ret = ossl_dh_check_pairwise(dh, 0); - if (ret <= 0) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); + if (ret <= 0) goto end; - } } #endif /* FIPS_MODULE */ } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c index 305dc3a6b831..1d740307f6a4 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -847,8 +847,8 @@ static const OSSL_PARAM sm2_known_gettable_params[] = { OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_DECODED_FROM_EXPLICIT_PARAMS, NULL), EC_IMEXPORTABLE_DOM_PARAMETERS, EC_IMEXPORTABLE_PUBLIC_KEY, - OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_X, NULL, 0), - OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_Y, NULL, 0), + OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_PUB_X, NULL, 0), + OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_PUB_Y, NULL, 0), EC_IMEXPORTABLE_PRIVATE_KEY, OSSL_PARAM_END }; @@ -1298,20 +1298,6 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (gctx->group_check != NULL) ret = ret && ossl_ec_set_check_group_type_from_name(ec, gctx->group_check); -#ifdef FIPS_MODULE - if (ret > 0 - && !ossl_fips_self_testing() - && EC_KEY_get0_public_key(ec) != NULL - && EC_KEY_get0_private_key(ec) != NULL - && EC_KEY_get0_group(ec) != NULL) { - BN_CTX *bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec)); - - ret = bnctx != NULL && ossl_ec_key_pairwise_check(ec, bnctx); - BN_CTX_free(bnctx); - if (ret <= 0) - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); - } -#endif /* FIPS_MODULE */ if (ret) return ec; diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c index 54af7a6a3956..42a0b9d7aa67 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c @@ -811,7 +811,6 @@ static void *ed25519_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (!key || ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)) return key; if (ecd_fips140_pairwise_test(key, ECX_KEY_TYPE_ED25519, 1) != 1) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); ossl_ecx_key_free(key); return NULL; } @@ -844,7 +843,6 @@ static void *ed448_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (!key || ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)) return key; if (ecd_fips140_pairwise_test(key, ECX_KEY_TYPE_ED448, 1) != 1) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); ossl_ecx_key_free(key); return NULL; } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c index 5ebeaae662bf..70e943ff5a03 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -96,6 +96,7 @@ static int ml_dsa_pairwise_test(const ML_DSA_KEY *key) err: OSSL_SELF_TEST_onend(st, ret); OSSL_SELF_TEST_free(st); + OPENSSL_cleanse(sig, sizeof(sig)); return ret; } #endif @@ -283,10 +284,8 @@ static int ml_dsa_import(void *keydata, int selection, const OSSL_PARAM params[] #ifdef FIPS_MODULE if (res > 0) { res = ml_dsa_pairwise_test(key); - if (!res) { + if (!res) ossl_ml_dsa_key_reset(key); - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT); - } } #endif /* FIPS_MODULE */ return res; @@ -483,10 +482,8 @@ static void *ml_dsa_gen(void *genctx, int evp_type) goto err; } #ifdef FIPS_MODULE - if (!ml_dsa_pairwise_test(key)) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); + if (!ml_dsa_pairwise_test(key)) goto err; - } #endif return key; err: @@ -541,7 +538,7 @@ static void ml_dsa_gen_cleanup(void *genctx) if (gctx == NULL) return; - OPENSSL_cleanse(gctx->entropy, gctx->entropy_len); + OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy)); OPENSSL_free(gctx->propq); OPENSSL_free(gctx); } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c index d95f021eef70..1422a3775c74 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c @@ -109,10 +109,6 @@ static int ml_kem_pairwise_test(const ML_KEM_KEY *key, int key_flags) memset(out, 0, sizeof(out)); - /* - * The pairwise test is skipped unless either RANDOM or FIXED entropy PCTs - * are enabled. - */ if (key_flags & ML_KEM_KEY_RANDOM_PCT) { operation_result = ossl_ml_kem_encap_rand(ctext, v->ctext_bytes, secret, sizeof(secret), key); @@ -147,7 +143,10 @@ static int ml_kem_pairwise_test(const ML_KEM_KEY *key, int key_flags) v->algorithm_name); } #endif - OPENSSL_free(ctext); + OPENSSL_cleanse((void *)entropy, sizeof(entropy)); + OPENSSL_cleanse((void *)secret, sizeof(secret)); + OPENSSL_cleanse((void *)out, sizeof(out)); + OPENSSL_clear_free(ctext, v->ctext_bytes); return ret; } @@ -237,7 +236,7 @@ static int ml_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb, { ML_KEM_KEY *key = vkey; OSSL_PARAM_BLD *tmpl = NULL; - OSSL_PARAM *params = NULL; + OSSL_PARAM *params = NULL, *p; const ML_KEM_VINFO *v; uint8_t *pubenc = NULL, *prvenc = NULL, *seedenc = NULL; size_t prvlen = 0, seedlen = 0; @@ -316,13 +315,19 @@ static int ml_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb, goto err; ret = param_cb(params, cbarg); + /* + * OSSL_PARAM_free() only wipes the secure-heap data block, + * so wipe the key material copies held in the params first. + */ + for (p = params; p->key != NULL; p++) + OPENSSL_cleanse(p->data, p->data_size); OSSL_PARAM_free(params); err: OSSL_PARAM_BLD_free(tmpl); OPENSSL_secure_clear_free(seedenc, seedlen); OPENSSL_secure_clear_free(prvenc, prvlen); - OPENSSL_free(pubenc); + OPENSSL_clear_free(pubenc, v->pubkey_bytes); return ret; } @@ -477,9 +482,6 @@ static int ml_kem_import(void *vkey, int selection, const OSSL_PARAM params[]) res = ml_kem_key_fromdata(key, params, include_private); if (res > 0 && include_private && !ml_kem_pairwise_test(key, key->prov_flags)) { -#ifdef FIPS_MODULE - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT); -#endif ossl_ml_kem_key_reset(key); res = 0; } @@ -542,12 +544,15 @@ static void *ml_kem_load(const void *reference, size_t reference_sz) if (!ml_kem_pairwise_test(key, key->prov_flags)) goto err; } - OPENSSL_free(encoded_dk); + OPENSSL_clear_free(encoded_dk, key->vinfo->prvkey_bytes); + OPENSSL_cleanse((void *)seed, sizeof(seed)); return key; } err: - OPENSSL_free(encoded_dk); + if (key != NULL && key->vinfo != NULL) + OPENSSL_clear_free(encoded_dk, key->vinfo->prvkey_bytes); + OPENSSL_cleanse((void *)seed, sizeof(seed)); ossl_ml_kem_key_free(key); return NULL; } @@ -708,6 +713,7 @@ static int ml_kem_gen_set_params(void *vgctx, const OSSL_PARAM params[]) /* Possibly, but less likely wrong data type */ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH); + OPENSSL_cleanse((void *)gctx->seedbuf, sizeof(gctx->seedbuf)); gctx->seed = NULL; return 0; } @@ -768,8 +774,10 @@ static void *ml_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0) return key; - if (seed != NULL && !ossl_ml_kem_set_seed(seed, ML_KEM_SEED_BYTES, key)) + if (seed != NULL && !ossl_ml_kem_set_seed(seed, ML_KEM_SEED_BYTES, key)) { + ossl_ml_kem_key_free(key); return NULL; + } genok = ossl_ml_kem_genkey(nopub, 0, key); /* Erase the single-use seed */ @@ -780,7 +788,6 @@ static void *ml_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) if (genok) { #ifdef FIPS_MODULE if (!ml_kem_pairwise_test(key, ML_KEM_KEY_FIXED_PCT)) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); ossl_ml_kem_key_free(key); return NULL; } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c index 5d1902ce637c..75267f88e761 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c @@ -245,7 +245,7 @@ static int mlx_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb, { MLX_KEY *key = vkey; OSSL_PARAM_BLD *tmpl = NULL; - OSSL_PARAM *params = NULL; + OSSL_PARAM *params = NULL, *p; size_t publen; size_t prvlen; int ret = 0; @@ -307,12 +307,18 @@ static int mlx_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb, goto err; ret = param_cb(params, cbarg); + /* + * OSSL_PARAM_free() only wipes the secure-heap data block, + * so wipe the key material copies held in the params first. + */ + for (p = params; p->key != NULL; p++) + OPENSSL_cleanse(p->data, p->data_size); OSSL_PARAM_free(params); err: OSSL_PARAM_BLD_free(tmpl); OPENSSL_secure_clear_free(sub_arg.prvenc, prvlen); - OPENSSL_free(sub_arg.pubenc); + OPENSSL_clear_free(sub_arg.pubenc, publen); return ret; } @@ -562,12 +568,18 @@ static int mlx_kem_get_params(void *vkey, OSSL_PARAM params[]) selection |= OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS; /* Extract sub-component key material */ - if (!export_sub(&sub_arg, selection, key)) - return 0; - - if ((pub != NULL && sub_arg.pubcount != 2) - || (prv != NULL && sub_arg.prvcount != 2)) + if (!export_sub(&sub_arg, selection, key) + || (pub != NULL && sub_arg.pubcount != 2) + || (prv != NULL && sub_arg.prvcount != 2)) { + /* Erase any partial key material on failure */ + if (sub_arg.pubenc != NULL) + OPENSSL_cleanse(sub_arg.pubenc, + key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes); + if (sub_arg.prvenc != NULL) + OPENSSL_cleanse(sub_arg.prvenc, + key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes); return 0; + } return 1; } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c index 8a676213903f..8799df6be6d5 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -223,7 +223,7 @@ static int slh_dsa_export(void *keydata, int selection, OSSL_CALLBACK *param_cb, { SLH_DSA_KEY *key = keydata; OSSL_PARAM_BLD *tmpl; - OSSL_PARAM *params = NULL; + OSSL_PARAM *params = NULL, *p; int ret = 0; if (!ossl_prov_is_running() || key == NULL) @@ -244,6 +244,12 @@ static int slh_dsa_export(void *keydata, int selection, OSSL_CALLBACK *param_cb, goto err; ret = param_cb(params, cbarg); + /* + * OSSL_PARAM_free() only wipes the secure-heap data block, + * so wipe the key material copies held in the params first. + */ + for (p = params; p->key != NULL; p++) + OPENSSL_cleanse(p->data, p->data_size); OSSL_PARAM_free(params); err: OSSL_PARAM_BLD_free(tmpl); @@ -298,7 +304,7 @@ static int slh_dsa_fips140_pairwise_test(const SLH_DSA_KEY *key, uint8_t msg[16] = { 0 }; size_t msg_len = sizeof(msg); uint8_t *sig = NULL; - size_t sig_len; + size_t sig_len = 0; OSSL_LIB_CTX *lib_ctx; int alloc_ctx = 0; @@ -341,7 +347,7 @@ static int slh_dsa_fips140_pairwise_test(const SLH_DSA_KEY *key, err: if (alloc_ctx) ossl_slh_dsa_hash_ctx_free(ctx); - OPENSSL_free(sig); + OPENSSL_clear_free(sig, sig_len); OSSL_SELF_TEST_onend(st, ret); OSSL_SELF_TEST_free(st); return ret; @@ -366,10 +372,8 @@ static void *slh_dsa_gen(void *genctx, const char *alg) gctx->entropy, gctx->entropy_len)) goto err; #ifdef FIPS_MODULE - if (!slh_dsa_fips140_pairwise_test(key, ctx)) { - ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT); + if (!slh_dsa_fips140_pairwise_test(key, ctx)) goto err; - } #endif /* FIPS_MODULE */ ossl_slh_dsa_hash_ctx_free(ctx); return key; @@ -428,7 +432,7 @@ static void slh_dsa_gen_cleanup(void *genctx) if (gctx == NULL) return; - OPENSSL_cleanse(gctx->entropy, gctx->entropy_len); + OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy)); OPENSSL_free(gctx->propq); OPENSSL_free(gctx); } diff --git a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c index 58a842776233..14542c6716f2 100644 --- a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -275,7 +275,7 @@ static int cmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) && !EVP_CIPHER_is_a(cipher, "AES-192-CBC") && !EVP_CIPHER_is_a(cipher, "AES-128-CBC") && !EVP_CIPHER_is_a(cipher, "DES-EDE3-CBC")) { - ERR_raise(ERR_LIB_PROV, EVP_R_UNSUPPORTED_CIPHER); + ERR_raise(ERR_LIB_PROV, PROV_R_NOT_SUPPORTED); return 0; } } diff --git a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c index 22ff0a283739..69d4444a58d7 100644 --- a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c @@ -82,7 +82,7 @@ static size_t poly1305_size(void) static int poly1305_setkey(struct poly1305_data_st *ctx, const unsigned char *key, size_t keylen) { - if (keylen != POLY1305_KEY_SIZE) { + if (key == NULL || keylen != POLY1305_KEY_SIZE) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); return 0; } @@ -111,6 +111,10 @@ static int poly1305_update(void *vmacctx, const unsigned char *data, { struct poly1305_data_st *ctx = vmacctx; + if (!ctx->key_set) { + ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET); + return 0; + } ctx->updated = 1; if (datalen == 0) return 1; diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c index d42f08585713..57da1cfdf33d 100644 --- a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c +++ b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c @@ -1,5 +1,5 @@ /* - * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -588,6 +588,18 @@ static int drbg_ctr_init(PROV_DRBG *drbg) drbg->strength = keylen * 8; drbg->seedlen = keylen + 16; +#ifdef FIPS_MODULE + /* + * FIPS requires that we use a derivation function since our + * entropy source is outside the fips boundary + */ + if (ctr->use_df == 0) { + ERR_raise_data(ERR_LIB_PROV, PROV_R_DERIVATION_FUNCTION_INIT_FAILED, + "FIPS requires the use of a derivation function"); + goto err; + } +#endif + if (ctr->use_df) { /* df initialisation */ static const unsigned char df_key[32] = { @@ -713,7 +725,6 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]) PROV_DRBG *ctx = (PROV_DRBG *)vctx; PROV_DRBG_CTR *ctr = (PROV_DRBG_CTR *)ctx->data; OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx); - OSSL_PROVIDER *prov = NULL; const OSSL_PARAM *p; char *ecb; const char *propquery = NULL; @@ -731,19 +742,14 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]) != NULL) { if (p->data_type != OSSL_PARAM_UTF8_STRING) return 0; - propquery = (const char *)p->data; } - if ((p = OSSL_PARAM_locate_const(params, - OSSL_PROV_PARAM_CORE_PROV_NAME)) - != NULL) { - if (p->data_type != OSSL_PARAM_UTF8_STRING) - return 0; - if ((prov = ossl_provider_find(libctx, - (const char *)p->data, 1)) - == NULL) - return 0; - } +#ifndef FIPS_MODULE + propquery = "provider=default"; + if (p != NULL + && p->data_type == OSSL_PARAM_UTF8_STRING) + propquery = (const char *)p->data; +#endif if ((p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_CIPHER)) != NULL) { const char *base = (const char *)p->data; @@ -752,50 +758,33 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]) if (p->data_type != OSSL_PARAM_UTF8_STRING || p->data_size < ctr_str_len) { - ossl_provider_free(prov); return 0; } if (OPENSSL_strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) { ERR_raise(ERR_LIB_PROV, PROV_R_REQUIRE_CTR_MODE_CIPHER); - ossl_provider_free(prov); return 0; } if ((ecb = OPENSSL_strndup(base, p->data_size)) == NULL) { - ossl_provider_free(prov); return 0; } strcpy(ecb + p->data_size - ecb_str_len, "ECB"); EVP_CIPHER_free(ctr->cipher_ecb); EVP_CIPHER_free(ctr->cipher_ctr); + ctr->cipher_ctr = NULL; + ctr->cipher_ecb = NULL; /* * Try to fetch algorithms from our own provider code, fallback * to generic fetch only if that fails */ - (void)ERR_set_mark(); - ctr->cipher_ctr = evp_cipher_fetch_from_prov(prov, base, NULL); - if (ctr->cipher_ctr == NULL) { - (void)ERR_pop_to_mark(); - ctr->cipher_ctr = EVP_CIPHER_fetch(libctx, base, propquery); - } else { - (void)ERR_clear_last_mark(); - } - (void)ERR_set_mark(); - ctr->cipher_ecb = evp_cipher_fetch_from_prov(prov, ecb, NULL); - if (ctr->cipher_ecb == NULL) { - (void)ERR_pop_to_mark(); - ctr->cipher_ecb = EVP_CIPHER_fetch(libctx, ecb, propquery); - } else { - (void)ERR_clear_last_mark(); - } + ctr->cipher_ctr = EVP_CIPHER_fetch(libctx, base, propquery); + ctr->cipher_ecb = EVP_CIPHER_fetch(libctx, ecb, propquery); OPENSSL_free(ecb); if (ctr->cipher_ctr == NULL || ctr->cipher_ecb == NULL) { ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_FIND_CIPHERS); - ossl_provider_free(prov); return 0; } cipher_init = 1; } - ossl_provider_free(prov); if (cipher_init && !drbg_ctr_init(ctx)) return 0; diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c b/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c index 92eb443c6e82..504af87d5e13 100644 --- a/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c +++ b/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c @@ -1,5 +1,5 @@ /* - * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -508,23 +508,22 @@ static const OSSL_PARAM *drbg_hash_gettable_ctx_params(ossl_unused void *vctx, static int drbg_fetch_digest_from_prov(const OSSL_PARAM params[], OSSL_LIB_CTX *libctx, - EVP_MD **digest) + EVP_MD **digest, + const char *propq) { - OSSL_PROVIDER *prov = NULL; const OSSL_PARAM *p; EVP_MD *md = NULL; int ret = 0; + const char *propquery = NULL; - if (digest == NULL) - return 0; +#ifndef FIPS_MODULE + if (propq == NULL) + propquery = "provider=default"; + else + propquery = propq; +#endif - if ((p = OSSL_PARAM_locate_const(params, - OSSL_PROV_PARAM_CORE_PROV_NAME)) - == NULL) - return 0; - if (p->data_type != OSSL_PARAM_UTF8_STRING) - return 0; - if ((prov = ossl_provider_find(libctx, (const char *)p->data, 1)) == NULL) + if (digest == NULL) return 0; p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST); @@ -536,15 +535,13 @@ static int drbg_fetch_digest_from_prov(const OSSL_PARAM params[], if (p->data_type != OSSL_PARAM_UTF8_STRING) goto done; - md = evp_digest_fetch_from_prov(prov, (const char *)p->data, NULL); + md = EVP_MD_fetch(libctx, p->data, propquery); if (md) { EVP_MD_free(*digest); *digest = md; ret = 1; } - done: - ossl_provider_free(prov); return ret; } @@ -556,15 +553,24 @@ static int drbg_hash_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] EVP_MD *prov_md = NULL; const EVP_MD *md; int md_size; + const OSSL_PARAM *p; if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params, OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK)) return 0; /* try to fetch digest from provider */ + p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_PROPERTIES); (void)ERR_set_mark(); - if (!drbg_fetch_digest_from_prov(params, libctx, &prov_md)) { + if (!drbg_fetch_digest_from_prov(params, libctx, &prov_md, + (p != NULL && p->data_type == OSSL_PARAM_UTF8_STRING) ? p->data : NULL)) { (void)ERR_pop_to_mark(); + /* + * Its possible for drbg_fetch_digest_from_prov to return 0 after having set prov_md + * so we need to ensure we free it here + */ + EVP_MD_free(prov_md); + /* fall back to full implementation search */ if (!ossl_prov_digest_load_from_params(&hash->digest, params, libctx)) return 0; diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c b/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c index d3191e55a929..87050764fe46 100644 --- a/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c +++ b/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c @@ -412,27 +412,25 @@ static const OSSL_PARAM *drbg_hmac_gettable_ctx_params(ossl_unused void *vctx, static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[], OSSL_LIB_CTX *libctx, EVP_MAC_CTX **macctx, - EVP_MD **digest) + EVP_MD **digest, const char *propq) { - OSSL_PROVIDER *prov = NULL; const OSSL_PARAM *p; const char *digest_name = NULL; const char *hmac_name = NULL; EVP_MD *md = NULL; EVP_MAC *mac = NULL; - OSSL_PARAM mac_params[2], *mp = mac_params; + OSSL_PARAM mac_params[3], *mp = mac_params; int ret = 0; + const char *propquery = NULL; - if (macctx == NULL || digest == NULL) - return 0; +#ifndef FIPS_MODULE + if (propq == NULL) + propquery = "provider=default"; + else + propquery = propq; +#endif - if ((p = OSSL_PARAM_locate_const(params, - OSSL_PROV_PARAM_CORE_PROV_NAME)) - == NULL) - return 0; - if (p->data_type != OSSL_PARAM_UTF8_STRING) - return 0; - if ((prov = ossl_provider_find(libctx, (const char *)p->data, 1)) == NULL) + if (macctx == NULL || digest == NULL) return 0; p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST); @@ -441,7 +439,7 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[], ERR_raise(ERR_LIB_PROV, PROV_R_VALUE_ERROR); goto done; } - md = evp_digest_fetch_from_prov(prov, digest_name, NULL); + md = EVP_MD_fetch(libctx, p->data, propquery); if (md) { EVP_MD_free(*digest); *digest = md; @@ -467,12 +465,14 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[], EVP_MAC_CTX_free(*macctx); *macctx = NULL; - mac = evp_mac_fetch_from_prov(prov, hmac_name, NULL); + mac = EVP_MAC_fetch(libctx, hmac_name, propquery); if (mac) { *macctx = EVP_MAC_CTX_new(mac); /* The context holds on to the MAC */ EVP_MAC_free(mac); *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, (char *)digest_name, 0); + if (propquery) + *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_PROPERTIES, (char *)propquery, 0); *mp = OSSL_PARAM_construct_end(); if (!EVP_MAC_CTX_set_params(*macctx, mac_params)) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MAC); @@ -484,7 +484,6 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[], } done: - ossl_provider_free(prov); return ret; } @@ -496,15 +495,23 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] EVP_MD *prov_md = NULL; const EVP_MD *md; int md_size; + const OSSL_PARAM *p; if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params, OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK)) return 0; /* try to fetch mac and digest from provider */ + p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_PROPERTIES); (void)ERR_set_mark(); - if (!drbg_fetch_algs_from_prov(params, libctx, &hmac->ctx, &prov_md)) { + if (!drbg_fetch_algs_from_prov(params, libctx, &hmac->ctx, &prov_md, + (p != NULL && p->data_type == OSSL_PARAM_UTF8_STRING) ? p->data : NULL)) { (void)ERR_pop_to_mark(); + /* + * Its possible for drbg_fetch_algs_from_prov to return 0 and set prov_md here + * so we need to free prov_md to be leak free + */ + EVP_MD_free(prov_md); /* fall back to full implementation search */ if (!ossl_prov_digest_load_from_params(&hmac->digest, params, libctx)) return 0; diff --git a/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c b/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c index 80ae8173131d..0b8a9ec341d9 100644 --- a/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c +++ b/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -394,7 +394,7 @@ static ssize_t syscall_random(void *buf, size_t buflen) return getrandom(buf, buflen, 0); #elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND) return sysctl_random(buf, buflen); -#elif defined(__wasi__) +#elif defined(__wasi__) || defined(__EMSCRIPTEN__) if (getentropy(buf, buflen) == 0) return (ssize_t)buflen; return -1; diff --git a/deps/openssl/openssl/providers/implementations/rands/test_rng.c b/deps/openssl/openssl/providers/implementations/rands/test_rng.c index 7942537879f1..88e5fb982aed 100644 --- a/deps/openssl/openssl/providers/implementations/rands/test_rng.c +++ b/deps/openssl/openssl/providers/implementations/rands/test_rng.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,7 +15,7 @@ #include #include #include -#include +#include #include "prov/securitycheck.h" #include "prov/providercommon.h" #include "prov/provider_ctx.h" @@ -305,7 +305,7 @@ static int test_rng_enable_locking(void *vtest) if (t != NULL && t->lock == NULL) { t->lock = CRYPTO_THREAD_lock_new(); if (t->lock == NULL) { - ERR_raise(ERR_LIB_PROV, RAND_R_FAILED_TO_CREATE_LOCK); + ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_CREATE_LOCK); return 0; } } diff --git a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c index 28f3e15b5985..4980474ac03d 100644 --- a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c +++ b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c @@ -591,7 +591,7 @@ rsa_signverify_init(PROV_RSA_CTX *prsactx, void *vrsa, break; default: - ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); + ERR_raise(ERR_LIB_PROV, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); return 0; } @@ -1015,7 +1015,13 @@ static int rsa_verify_recover(void *vprsactx, } ret = RSA_public_decrypt((int)siglen, sig, rout, prsactx->rsa, prsactx->pad_mode); - if (ret <= 0) { + /* + * RSA_public_decrypt() returns -1 on error and otherwise the number + * of recovered bytes, which may legitimately be zero for a raw + * PKCS#1 v1.5 signature that encodes an empty payload. Treat only + * a negative result as an error. + */ + if (ret < 0) { ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB); return 0; } @@ -1947,7 +1953,7 @@ static int rsa_sigalg_signverify_init(void *vprsactx, void *vrsa, /* PSS is currently not supported as a sigalg */ if (prsactx->pad_mode == RSA_PKCS1_PSS_PADDING) { - ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); + ERR_raise(ERR_LIB_PROV, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); return 0; } diff --git a/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c index c6d4e04c1b84..6d43be32f4d2 100644 --- a/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c +++ b/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c @@ -61,7 +61,7 @@ static void slh_dsa_freectx(void *vctx) ossl_slh_dsa_hash_ctx_free(ctx->hash_ctx); OPENSSL_free(ctx->propq); - OPENSSL_cleanse(ctx->add_random, ctx->add_random_len); + OPENSSL_cleanse(ctx->add_random, sizeof(ctx->add_random)); OPENSSL_free(ctx); } diff --git a/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c b/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c index f5553b97da37..03560ab4902d 100644 --- a/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c +++ b/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -191,6 +191,10 @@ static int msblob2obj_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, ok = 0; mem_want = ossl_blob_length(bitlen, isdss, ispub); + + if (mem_want > BLOB_MAX_LENGTH) { + goto next; + } if (!BUF_MEM_grow(mem, mem_len + mem_want)) { ERR_raise(ERR_LIB_PEM, ERR_R_BUF_LIB); goto err; diff --git a/deps/openssl/openssl/ssl/quic/quic_ackm.c b/deps/openssl/openssl/ssl/quic/quic_ackm.c index 58318a123a85..5da8af882ade 100644 --- a/deps/openssl/openssl/ssl/quic/quic_ackm.c +++ b/deps/openssl/openssl/ssl/quic/quic_ackm.c @@ -1003,6 +1003,7 @@ static void ackm_on_pkts_acked(OSSL_ACKM *ackm, const OSSL_ACKM_TX_PKT *apkt) const OSSL_ACKM_TX_PKT *anext; QUIC_PN last_pn_acked = 0; OSSL_CC_ACK_INFO ainfo = { 0 }; + unsigned int is_inflight; for (; apkt != NULL; apkt = anext) { if (apkt->is_inflight) { @@ -1027,10 +1028,11 @@ static void ackm_on_pkts_acked(OSSL_ACKM *ackm, const OSSL_ACKM_TX_PKT *apkt) ainfo.tx_time = apkt->time; ainfo.tx_size = apkt->num_bytes; + is_inflight = apkt->is_inflight; anext = apkt->anext; apkt->on_acked(apkt->cb_arg); /* may free apkt */ - if (apkt->is_inflight) + if (is_inflight) ackm->cc_method->on_data_acked(ackm->cc_data, &ainfo); } } @@ -1133,6 +1135,38 @@ int ossl_ackm_on_tx_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt) return 1; } +int ossl_ackm_on_tx_ack_only_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt) +{ + struct tx_pkt_history_st *h; + unsigned int pkt_space; + + if (pkt == NULL || pkt->pkt_space >= QUIC_PN_SPACE_NUM) + return 0; + + /* + * A packet containing only an ACK frame must not be treated as + * in-flight or ack-eliciting; if it were, ossl_ackm_on_tx_packet() + * below would (correctly) perform bytes-in-flight/timer/CC bookkeeping + * for a packet we are about to discard from history, which would be + * incorrect. + */ + if (pkt->is_inflight || pkt->is_ack_eliciting) + return 0; + + pkt_space = pkt->pkt_space; + + /* + * No one can expect ACK for packet which carries ACK frames only + * (ack_only packet). The ACKM does not need to keep record for ack_only + * packet. For ack_only packet the ACKM manager must be updated by the + * highest packet number which got sent. + */ + h = get_tx_history(ackm, pkt_space); + h->highest_sent = pkt->pkt_num; + + return 1; +} + int ossl_ackm_on_rx_datagram(OSSL_ACKM *ackm, size_t num_bytes) { /* No-op on the client. */ @@ -1167,8 +1201,21 @@ int ossl_ackm_on_rx_ack_frame(OSSL_ACKM *ackm, const OSSL_QUIC_FRAME_ACK *ack, int pkt_space, OSSL_TIME rx_time) { OSSL_ACKM_TX_PKT *na_pkts, *lost_pkts; + struct tx_pkt_history_st *h = get_tx_history(ackm, pkt_space); int must_set_timer = 0; + /* + * RFC 9000 s. 13.1 recommends treating an acknowledgment for a packet we + * did not send as a PROTOCOL_VIOLATION, where detectable. The largest + * acknowledged PN is ack_ranges[0].end; if it exceeds the highest PN we have + * sent in this space, reject the ACK. Otherwise the peer-controlled value is + * stored into largest_acked_pkt below, which only ever increases and drives + * loss detection, so a single such ACK would permanently force every + * in-flight and subsequently-sent packet to be declared lost. + */ + if (ack->ack_ranges[0].end > h->highest_sent) + return 0; + if (ackm->largest_acked_pkt[pkt_space] == QUIC_PN_INVALID) ackm->largest_acked_pkt[pkt_space] = ack->ack_ranges[0].end; else diff --git a/deps/openssl/openssl/ssl/quic/quic_impl.c b/deps/openssl/openssl/ssl/quic/quic_impl.c index 97efa4908a49..13bb007fa49b 100644 --- a/deps/openssl/openssl/ssl/quic/quic_impl.c +++ b/deps/openssl/openssl/ssl/quic/quic_impl.c @@ -410,6 +410,11 @@ static int expect_quic_cs(const SSL *s, QCTX *ctx) return expect_quic_as(s, ctx, QCTX_C | QCTX_S); } +static int expect_quic_cl(const SSL *s, QCTX *ctx) +{ + return expect_quic_as(s, ctx, QCTX_C | QCTX_L); +} + static int expect_quic_csl(const SSL *s, QCTX *ctx) { return expect_quic_as(s, ctx, QCTX_C | QCTX_S | QCTX_L); @@ -3643,6 +3648,33 @@ static int qc_getset_idle_timeout(QCTX *ctx, uint32_t class_, return ret; } +QUIC_TAKES_LOCK +static int qc_getset_max_pending_channels(QCTX *ctx, uint32_t class_, + uint64_t *p_value_out, uint64_t *p_value_in) +{ + int ret = 0; + uint64_t value_out = 0; + + qctx_lock(ctx); + + if (class_ == SSL_VALUE_CLASS_GENERIC && ctx->is_listener) { + value_out = ossl_quic_port_get_max_pending_channels(ctx->ql->port); + if (p_value_in != NULL) + ossl_quic_port_set_max_pending_channels(ctx->ql->port, *p_value_in); + ret = 1; + } else { + QUIC_RAISE_NON_NORMAL_ERROR(ctx, SSL_R_UNSUPPORTED_CONFIG_VALUE_CLASS, NULL); + ret = 0; + } + + qctx_unlock(ctx); + + if (ret && p_value_out != NULL) + *p_value_out = value_out; + + return ret; +} + QUIC_TAKES_LOCK static int qc_get_stream_avail(QCTX *ctx, uint32_t class_, int is_uni, int is_remote, @@ -3778,6 +3810,8 @@ static int expect_quic_for_value(SSL *s, QCTX *ctx, uint32_t id) case SSL_VALUE_STREAM_WRITE_BUF_USED: case SSL_VALUE_STREAM_WRITE_BUF_AVAIL: return expect_quic_cs(s, ctx); + case SSL_VALUE_QUIC_MAX_PENDING_CONNS: + return expect_quic_cl(s, ctx); default: return expect_quic_conn_only(s, ctx); } @@ -3799,6 +3833,8 @@ int ossl_quic_get_value_uint(SSL *s, uint32_t class_, uint32_t id, switch (id) { case SSL_VALUE_QUIC_IDLE_TIMEOUT: return qc_getset_idle_timeout(&ctx, class_, value, NULL); + case SSL_VALUE_QUIC_MAX_PENDING_CONNS: + return qc_getset_max_pending_channels(&ctx, class_, value, NULL); case SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL: return qc_get_stream_avail(&ctx, class_, /*uni=*/0, /*remote=*/0, value); @@ -3845,6 +3881,8 @@ int ossl_quic_set_value_uint(SSL *s, uint32_t class_, uint32_t id, case SSL_VALUE_EVENT_HANDLING_MODE: return qc_getset_event_handling(&ctx, class_, NULL, &value); + case SSL_VALUE_QUIC_MAX_PENDING_CONNS: + return qc_getset_max_pending_channels(&ctx, class_, NULL, &value); default: return QUIC_RAISE_NON_NORMAL_ERROR(&ctx, @@ -4915,6 +4953,11 @@ int ossl_quic_set_peer_token(SSL_CTX *ctx, BIO_ADDR *peer, ossl_quic_free_peer_token(old); } lh_QUIC_TOKEN_insert(c->cache, tok); + if (lh_QUIC_TOKEN_error(c->cache)) { + ossl_quic_free_peer_token(tok); + ossl_crypto_mutex_unlock(c->mutex); + return 0; + } ossl_crypto_mutex_unlock(c->mutex); return 1; @@ -5406,6 +5449,19 @@ QUIC_CHANNEL *ossl_quic_conn_get_channel(SSL *s) return ctx.qc->ch; } +QUIC_PORT *ossl_quic_listener_get_port(SSL *s) +{ + QCTX ctx; + + /* + * expect listerner only + */ + if (!expect_quic_listener(s, &ctx)) + return NULL; + + return ctx.ql->port; +} + int ossl_quic_set_diag_title(SSL_CTX *ctx, const char *title) { #ifndef OPENSSL_NO_QLOG diff --git a/deps/openssl/openssl/ssl/quic/quic_port.c b/deps/openssl/openssl/ssl/quic/quic_port.c index 200022ac2c56..aad9c3a5b3d5 100644 --- a/deps/openssl/openssl/ssl/quic/quic_port.c +++ b/deps/openssl/openssl/ssl/quic/quic_port.c @@ -93,6 +93,8 @@ typedef struct validation_token { */ #define ENCRYPTED_TOKEN_MAX_LEN (MARSHALLED_TOKEN_MAX_LEN + 16 + 12) +#define DEFAULT_MAX_PENDING_CONNS 256 + DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL); DEFINE_LIST_OF_IMPL(incoming_ch, QUIC_CHANNEL); DEFINE_LIST_OF_IMPL(port, QUIC_PORT); @@ -110,6 +112,7 @@ QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args) port->validate_addr = args->do_addr_validation; port->get_conn_user_ssl = args->get_conn_user_ssl; port->user_ssl_arg = args->user_ssl_arg; + port->max_pending_channels = DEFAULT_MAX_PENDING_CONNS; if (!port_init(port)) { OPENSSL_free(port); @@ -531,8 +534,10 @@ static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, OSSL_QRX *qrx, * start by allocation and provisioning as much of the channel as we can */ ch = ossl_quic_channel_alloc(&args); - if (ch == NULL) + if (ch == NULL) { + ossl_qrx_free(qrx); return NULL; + } /* * Fixup the channel tls connection here before we init the channel @@ -1488,7 +1493,7 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg, QUIC_CHANNEL *ch = NULL, *new_ch = NULL; QUIC_CONN_ID odcid; uint8_t gen_new_token = 0; - OSSL_QRX *qrx = NULL; + OSSL_QRX *qrx = NULL, *qrx_ref; OSSL_QRX *qrx_src = NULL; OSSL_QRX_ARGS qrx_args = { 0 }; uint64_t cause_flags = 0; @@ -1581,6 +1586,9 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg, if (hdr.type != QUIC_PKT_TYPE_INITIAL) goto undesirable; + if (port->max_pending_channels > 0 && ossl_list_incoming_ch_num(&port->incoming_channel_list) >= port->max_pending_channels) + goto undesirable; + odcid.id_len = 0; /* @@ -1678,8 +1686,22 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg, } } + qrx_ref = NULL; + if (qrx != NULL) { + /* + * if we are here, then client is validated via retry packet + * (client sent a valid token). In this case the qrx has valid + * secrets set for QUIC initial level encryption. We can pass + * reference to qrx to newly created channel. + * + * Note: port_bind_channel()/channel becomes owner of qrx_ref. + */ + qrx_ref = ossl_qrx_newref(qrx); + if (qrx_ref == NULL) + goto undesirable; + } port_bind_channel(port, &e->peer, &hdr.dst_conn_id, - &odcid, qrx, &new_ch); + &odcid, qrx_ref, &new_ch); /* * if packet validates it gets moved to channel, we've just bound @@ -1694,19 +1716,19 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg, if (gen_new_token == 1) generate_new_token(new_ch, &e->peer); - if (qrx != NULL) { + if (qrx_src != NULL) { /* - * The qrx belongs to channel now, so don't free it. - */ - qrx = NULL; - } else { - /* - * We still need to salvage packets from almost forgotten qrx - * and pass them to channel. + * Time to reinject packets from qrx to channel before + * qrx will be destroyed here. */ while (ossl_qrx_read_pkt(qrx_src, &qrx_pkt) == 1) ossl_quic_channel_inject_pkt(new_ch, qrx_pkt); ossl_qrx_update_pn_space(qrx_src, new_ch->qrx); + /* + * transfer ownership back to qrx; + */ + qrx = qrx_src; + qrx_src = NULL; } /* @@ -1723,7 +1745,7 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg, */ undesirable: - ossl_qrx_free(qrx); + ossl_qrx_free(qrx); /* releases reference */ ossl_qrx_free(qrx_src); ossl_quic_demux_release_urxe(port->demux, e); } @@ -1760,3 +1782,13 @@ void ossl_quic_port_restore_err_state(const QUIC_PORT *port) ERR_clear_error(); OSSL_ERR_STATE_restore(port->err_state); } + +uint64_t ossl_quic_port_get_max_pending_channels(const QUIC_PORT *port) +{ + return port->max_pending_channels; +} + +void ossl_quic_port_set_max_pending_channels(QUIC_PORT *port, uint64_t max_pending_channels) +{ + port->max_pending_channels = max_pending_channels; +} diff --git a/deps/openssl/openssl/ssl/quic/quic_port_local.h b/deps/openssl/openssl/ssl/quic/quic_port_local.h index 3bad3fc3a3aa..0cfc75da0ba1 100644 --- a/deps/openssl/openssl/ssl/quic/quic_port_local.h +++ b/deps/openssl/openssl/ssl/quic/quic_port_local.h @@ -1,5 +1,5 @@ /* - * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -118,6 +118,7 @@ struct quic_port_st { /* AES-256 GCM context for token encryption */ EVP_CIPHER_CTX *token_ctx; + uint64_t max_pending_channels; }; #endif diff --git a/deps/openssl/openssl/ssl/quic/quic_record_rx.c b/deps/openssl/openssl/ssl/quic/quic_record_rx.c index 8897cc6c2df0..0065f1c1e573 100644 --- a/deps/openssl/openssl/ssl/quic/quic_record_rx.c +++ b/deps/openssl/openssl/ssl/quic/quic_record_rx.c @@ -171,6 +171,8 @@ struct ossl_qrx_st { ossl_msg_cb msg_callback; void *msg_callback_arg; SSL *msg_callback_ssl; + + uint32_t refcount; }; static RXE *qrx_ensure_free_rxe(OSSL_QRX *qrx, size_t alloc_len); @@ -212,6 +214,7 @@ OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args) qrx->short_conn_id_len = args->short_conn_id_len; qrx->init_key_phase_bit = args->init_key_phase_bit; qrx->max_deferred = args->max_deferred; + qrx->refcount = 1; return qrx; } @@ -247,13 +250,10 @@ void ossl_qrx_update_pn_space(OSSL_QRX *src, OSSL_QRX *dst) return; } -void ossl_qrx_free(OSSL_QRX *qrx) +static void qrx_destroy(OSSL_QRX *qrx) { uint32_t i; - if (qrx == NULL) - return; - /* Free RXE queue data. */ qrx_cleanup_rxl(&qrx->rx_free); qrx_cleanup_rxl(&qrx->rx_pending); @@ -267,6 +267,30 @@ void ossl_qrx_free(OSSL_QRX *qrx) OPENSSL_free(qrx); } +void ossl_qrx_free(OSSL_QRX *qrx) +{ + if (qrx == NULL) + return; + + qrx->refcount--; + if (qrx->refcount == 0) + qrx_destroy(qrx); +} + +OSSL_QRX *ossl_qrx_newref(OSSL_QRX *qrx) +{ + OSSL_QRX *rv_qrx; + + if (qrx != NULL && qrx->refcount != (uint32_t)~0) { + qrx->refcount++; + rv_qrx = qrx; + } else { + rv_qrx = NULL; + } + + return rv_qrx; +} + void ossl_qrx_inject_urxe(OSSL_QRX *qrx, QUIC_URXE *urxe) { /* Initialize our own fields inside the URXE and add to the pending list. */ diff --git a/deps/openssl/openssl/ssl/quic/quic_rx_depack.c b/deps/openssl/openssl/ssl/quic/quic_rx_depack.c index 7ab59f01a1cd..59d16b2f362c 100644 --- a/deps/openssl/openssl/ssl/quic/quic_rx_depack.c +++ b/deps/openssl/openssl/ssl/quic/quic_rx_depack.c @@ -125,8 +125,19 @@ static int depack_do_frame_ack(PACKET *pkt, QUIC_CHANNEL *ch, } if (!ossl_ackm_on_rx_ack_frame(ch->ackm, &ack, - packet_space, received)) - goto malformed; + packet_space, received)) { + /* + * The ACK manager rejects the frame if it acknowledges a packet number + * we have not sent. RFC 9000 s. 13.1 recommends treating this as a + * PROTOCOL_VIOLATION connection error (distinct from a frame decoding + * error, which is handled at the malformed label below). + */ + ossl_quic_channel_raise_protocol_error(ch, + OSSL_QUIC_ERR_PROTOCOL_VIOLATION, + frame_type, + "ACK for unsent packet number"); + return 0; + } ++ch->diag_num_rx_ack; return 1; diff --git a/deps/openssl/openssl/ssl/quic/quic_stream_map.c b/deps/openssl/openssl/ssl/quic/quic_stream_map.c index 84ac6b714e38..da53d4b8054f 100644 --- a/deps/openssl/openssl/ssl/quic/quic_stream_map.c +++ b/deps/openssl/openssl/ssl/quic/quic_stream_map.c @@ -168,6 +168,10 @@ QUIC_STREAM *ossl_quic_stream_map_alloc(QUIC_STREAM_MAP *qsm, s->send_final_size = UINT64_MAX; lh_QUIC_STREAM_insert(qsm->map, s); + if (lh_QUIC_STREAM_error(qsm->map)) { + OPENSSL_free(s); + return NULL; + } return s; } diff --git a/deps/openssl/openssl/ssl/quic/quic_txp.c b/deps/openssl/openssl/ssl/quic/quic_txp.c index 5ce8e77f61e0..24314f6b34b7 100644 --- a/deps/openssl/openssl/ssl/quic/quic_txp.c +++ b/deps/openssl/openssl/ssl/quic/quic_txp.c @@ -2935,6 +2935,20 @@ static int txp_generate_for_el(OSSL_QUIC_TX_PACKETISER *txp, return TXP_ERR_INTERNAL; } +static int txp_pkt_is_ack_only(const QUIC_TXPIM_PKT *tpkt) +{ + return tpkt->had_ack_frame + && !tpkt->ackm_pkt.is_inflight + && !tpkt->ackm_pkt.is_ack_eliciting + && !tpkt->had_handshake_done_frame + && !tpkt->had_max_data_frame + && !tpkt->had_max_streams_bidi_frame + && !tpkt->had_max_streams_uni_frame + && !tpkt->had_conn_close + && tpkt->retx_head == NULL + && ossl_quic_txpim_pkt_get_num_chunks(tpkt) == 0; +} + /* * Commits and queues a packet for transmission. There is no backing out after * this. @@ -2943,8 +2957,9 @@ static int txp_generate_for_el(OSSL_QUIC_TX_PACKETISER *txp, * * - Sends the packet to the QTX for encryption and transmission; * - * - Records the packet as having been transmitted in FIFM. ACKM is informed, - * etc. and the TXPIM record is filed. + * - Records non-ACK-only packets as having been transmitted in FIFM. ACKM is + * informed, etc. and the TXPIM record is filed only when later callbacks + * need it. * * - Informs various subsystems of frames that were sent and clears frame * wanted flags so that we do not generate the same frames again. @@ -2971,7 +2986,7 @@ static int txp_pkt_commit(OSSL_QUIC_TX_PACKETISER *txp, uint32_t archetype, int *txpim_pkt_reffed) { - int rc = 1; + int ack_only, rc = 1; uint32_t enc_level = pkt->h.enc_level; uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level); QUIC_TXPIM_PKT *tpkt = pkt->tpkt; @@ -3015,28 +3030,35 @@ static int txp_pkt_commit(OSSL_QUIC_TX_PACKETISER *txp, return 0; /* alloc error */ } - /* Dispatch to FIFD. */ - if (!ossl_quic_fifd_pkt_commit(&txp->fifd, tpkt)) + ack_only = txp_pkt_is_ack_only(tpkt); + + /* Dispatch packets that need loss/retransmit callbacks to FIFD. */ + if (!ack_only && !ossl_quic_fifd_pkt_commit(&txp->fifd, tpkt)) return 0; /* * Transmission and Post-Packet Generation Bookkeeping * =================================================== * - * No backing out anymore - at this point the ACKM has recorded the packet - * as having been sent, so we need to increment our next PN counter, or - * the ACKM will complain when we try to record a duplicate packet with - * the same PN later. At this point actually sending the packet may still - * fail. In this unlikely event it will simply be handled as though it - * were a lost packet. + * No backing out anymore - at this point we need to increment our next PN + * counter, or the ACKM will complain when we try to record a duplicate + * packet with the same PN later. Non-ACK-only packets have also been + * recorded in ACKM, so if QTX write fails they are handled as though they + * were lost. ACK-only packets are not recorded and will be cleaned up by + * the caller. */ ++txp->next_pn[pn_space]; - *txpim_pkt_reffed = 1; + if (!ack_only) + *txpim_pkt_reffed = 1; /* Send the packet. */ if (!ossl_qtx_write_pkt(txp->args.qtx, &txpkt)) return 0; + if (ack_only + && !ossl_ackm_on_tx_ack_only_packet(txp->args.ackm, &tpkt->ackm_pkt)) + rc = 0; + /* * Record FC and stream abort frames as sent; deactivate streams which no * longer have anything to do. diff --git a/deps/openssl/openssl/ssl/record/methods/dtls_meth.c b/deps/openssl/openssl/ssl/record/methods/dtls_meth.c index 8cbd7678e193..c282efc5ca07 100644 --- a/deps/openssl/openssl/ssl/record/methods/dtls_meth.c +++ b/deps/openssl/openssl/ssl/record/methods/dtls_meth.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -287,7 +287,7 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu pitem *item; /* Limit the size of the queue to prevent DOS attacks */ - if (pqueue_size(queue) >= 100) + if (pqueue_size(queue) >= 16) return 0; rdata = OPENSSL_malloc(sizeof(*rdata)); @@ -299,29 +299,26 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu return -1; } - rdata->packet = rl->packet; + /* + * Take a copy of just this record's on-wire bytes (header + ciphertext) + * rather than the whole (much larger) read buffer. The live rl->rbuf is + * left untouched and continues to be used for subsequent reads. + */ rdata->packet_length = rl->packet_length; - memcpy(&(rdata->rbuf), &rl->rbuf, sizeof(TLS_BUFFER)); - memcpy(&(rdata->rrec), &rl->rrec[0], sizeof(TLS_RL_RECORD)); - - item->data = rdata; - - rl->packet = NULL; - rl->packet_length = 0; - memset(&rl->rbuf, 0, sizeof(TLS_BUFFER)); - memset(&rl->rrec[0], 0, sizeof(rl->rrec[0])); - - if (!tls_setup_read_buffer(rl)) { - /* RLAYERfatal() already called */ - OPENSSL_free(rdata->rbuf.buf); + rdata->packet = OPENSSL_memdup(rl->packet, rl->packet_length); + if (rdata->packet == NULL) { OPENSSL_free(rdata); pitem_free(item); + RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); return -1; } + memcpy(&(rdata->rrec), &rl->rrec[0], sizeof(TLS_RL_RECORD)); + + item->data = rdata; if (pqueue_insert(queue, item) == NULL) { /* Must be a duplicate so ignore it */ - OPENSSL_free(rdata->rbuf.buf); + OPENSSL_free(rdata->packet); OPENSSL_free(rdata); pitem_free(item); } @@ -329,44 +326,6 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu return 1; } -/* copy buffered record into OSSL_RECORD_LAYER structure */ -static int dtls_copy_rlayer_record(OSSL_RECORD_LAYER *rl, pitem *item) -{ - DTLS_RLAYER_RECORD_DATA *rdata; - - rdata = (DTLS_RLAYER_RECORD_DATA *)item->data; - - ossl_tls_buffer_release(&rl->rbuf); - - rl->packet = rdata->packet; - rl->packet_length = rdata->packet_length; - memcpy(&rl->rbuf, &(rdata->rbuf), sizeof(TLS_BUFFER)); - memcpy(&rl->rrec[0], &(rdata->rrec), sizeof(TLS_RL_RECORD)); - - /* Set proper sequence number for mac calculation */ - memcpy(&(rl->sequence[2]), &(rdata->packet[5]), 6); - - return 1; -} - -static int dtls_retrieve_rlayer_buffered_record(OSSL_RECORD_LAYER *rl, - struct pqueue_st *queue) -{ - pitem *item; - - item = pqueue_pop(queue); - if (item) { - dtls_copy_rlayer_record(rl, item); - - OPENSSL_free(item->data); - pitem_free(item); - - return 1; - } - - return 0; -} - /*- * Call this to get a new input record. * It will return <= 0 if more data is needed, normally due to an error @@ -400,12 +359,6 @@ int dtls_get_more_records(OSSL_RECORD_LAYER *rl) } again: - /* if we're renegotiating, then there may be buffered records */ - if (dtls_retrieve_rlayer_buffered_record(rl, rl->processed_rcds)) { - rl->num_recs = 1; - return OSSL_RECORD_RETURN_SUCCESS; - } - /* get something from the wire */ /* check if we have the header */ @@ -607,23 +560,13 @@ static int dtls_free(OSSL_RECORD_LAYER *rl) /* Push to the next record layer */ ret &= BIO_write_ex(rl->next, rdata->packet, rdata->packet_length, &written); - OPENSSL_free(rdata->rbuf.buf); + OPENSSL_free(rdata->packet); OPENSSL_free(item->data); pitem_free(item); } pqueue_free(rl->unprocessed_rcds); } - if (rl->processed_rcds != NULL) { - while ((item = pqueue_pop(rl->processed_rcds)) != NULL) { - rdata = (DTLS_RLAYER_RECORD_DATA *)item->data; - OPENSSL_free(rdata->rbuf.buf); - OPENSSL_free(item->data); - pitem_free(item); - } - pqueue_free(rl->processed_rcds); - } - return tls_free(rl) && ret; } @@ -653,10 +596,8 @@ dtls_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers, return ret; (*retrl)->unprocessed_rcds = pqueue_new(); - (*retrl)->processed_rcds = pqueue_new(); - if ((*retrl)->unprocessed_rcds == NULL - || (*retrl)->processed_rcds == NULL) { + if ((*retrl)->unprocessed_rcds == NULL) { dtls_free(*retrl); *retrl = NULL; ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); diff --git a/deps/openssl/openssl/ssl/record/methods/recmethod_local.h b/deps/openssl/openssl/ssl/record/methods/recmethod_local.h index 4ffce8d66385..5e3fdd1d0587 100644 --- a/deps/openssl/openssl/ssl/record/methods/recmethod_local.h +++ b/deps/openssl/openssl/ssl/record/methods/recmethod_local.h @@ -1,5 +1,5 @@ /* - * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -344,9 +344,8 @@ struct ossl_record_layer_st { size_t taglen; - /* DTLS received handshake records (processed and unprocessed) */ + /* DTLS received handshake records awaiting the next epoch */ struct pqueue_st *unprocessed_rcds; - struct pqueue_st *processed_rcds; /* records being received in the current epoch */ DTLS_BITMAP bitmap; @@ -374,7 +373,6 @@ struct ossl_record_layer_st { typedef struct dtls_rlayer_record_data_st { unsigned char *packet; size_t packet_length; - TLS_BUFFER rbuf; TLS_RL_RECORD rrec; } DTLS_RLAYER_RECORD_DATA; diff --git a/deps/openssl/openssl/ssl/record/methods/tls_common.c b/deps/openssl/openssl/ssl/record/methods/tls_common.c index 9f957b7cc656..e00ad084cbd9 100644 --- a/deps/openssl/openssl/ssl/record/methods/tls_common.c +++ b/deps/openssl/openssl/ssl/record/methods/tls_common.c @@ -497,7 +497,7 @@ static int tls_record_app_data_waiting(OSSL_RECORD_LAYER *rl) static int rlayer_early_data_count_ok(OSSL_RECORD_LAYER *rl, size_t length, size_t overhead, int send) { - uint32_t max_early_data = rl->max_early_data; + uint64_t max_early_data = rl->max_early_data; if (max_early_data == 0) { RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE, @@ -1919,13 +1919,14 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl) { int i, ret; TLS_BUFFER *thiswb; - size_t tmpwrit = 0; + size_t tmpwrit = 0, left; if (rl->nextwbuf >= rl->numwpipes) return OSSL_RECORD_RETURN_SUCCESS; for (;;) { thiswb = &rl->wbuf[rl->nextwbuf]; + left = TLS_BUFFER_get_left(thiswb); clear_sys_error(); if (rl->bio != NULL) { @@ -1935,13 +1936,24 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl) return ret; } i = BIO_write(rl->bio, (char *)&(TLS_BUFFER_get_buf(thiswb)[TLS_BUFFER_get_offset(thiswb)]), - (unsigned int)TLS_BUFFER_get_left(thiswb)); + (unsigned int)left); if (i >= 0) { tmpwrit = i; - if (i == 0 && BIO_should_retry(rl->bio)) - ret = OSSL_RECORD_RETURN_RETRY; - else + if (i == 0 && left != 0) { + if (BIO_should_retry(rl->bio)) { + ret = OSSL_RECORD_RETURN_RETRY; + } else { + /* + * Treat this as a fatal I/O condition. Do not queue an + * SSL reason: a zero return with no retry flag may come + * from a custom BIO and does not imply an SSL library + * or protocol error. + */ + ret = OSSL_RECORD_RETURN_FATAL; + } + } else { ret = OSSL_RECORD_RETURN_SUCCESS; + } } else { if (BIO_should_retry(rl->bio)) { ret = OSSL_RECORD_RETURN_RETRY; @@ -1964,7 +1976,7 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl) * Treat i == 0 as success rather than an error for zero byte * writes to permit this case. */ - if (i >= 0 && tmpwrit == TLS_BUFFER_get_left(thiswb)) { + if (i >= 0 && tmpwrit == left) { TLS_BUFFER_set_left(thiswb, 0); TLS_BUFFER_add_offset(thiswb, tmpwrit); if (++(rl->nextwbuf) < rl->numwpipes) @@ -1982,9 +1994,9 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl) */ if (TLS_BUFFER_is_app_buffer(thiswb) && (rl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) != 0) { - size_t left = TLS_BUFFER_get_left(thiswb); unsigned char *buf; + left = TLS_BUFFER_get_left(thiswb); buf = OPENSSL_malloc(left); if (buf == NULL) { RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); diff --git a/deps/openssl/openssl/ssl/record/rec_layer_s3.c b/deps/openssl/openssl/ssl/record/rec_layer_s3.c index ba407478b412..3ab50facc93e 100644 --- a/deps/openssl/openssl/ssl/record/rec_layer_s3.c +++ b/deps/openssl/openssl/ssl/record/rec_layer_s3.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -150,7 +150,7 @@ static uint32_t ossl_get_max_early_data(SSL_CONNECTION *s) static int ossl_early_data_count_ok(SSL_CONNECTION *s, size_t length, size_t overhead, int send) { - uint32_t max_early_data; + uint64_t max_early_data; max_early_data = ossl_get_max_early_data(s); diff --git a/deps/openssl/openssl/ssl/rio/poll_builder.c b/deps/openssl/openssl/ssl/rio/poll_builder.c index 28d93ee1947a..f808e9b01e74 100644 --- a/deps/openssl/openssl/ssl/rio/poll_builder.c +++ b/deps/openssl/openssl/ssl/rio/poll_builder.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -120,8 +120,10 @@ int ossl_rio_poll_builder_add_fd(RIO_POLL_BUILDER *rpb, int fd, assert((rpb->pfd_heap != NULL && rpb->pfd_heap == pfds) || (rpb->pfd_heap == NULL && rpb->pfds == pfds)); assert(i <= rpb->pfd_num && rpb->pfd_num <= rpb->pfd_alloc); + /* Check the index first because an appended entry is uninitialised. */ + if (i == rpb->pfd_num || pfds[i].fd == -1) + pfds[i].events = 0; pfds[i].fd = fd; - pfds[i].events = 0; if (want_read) pfds[i].events |= POLLIN; diff --git a/deps/openssl/openssl/ssl/rio/poll_builder.h b/deps/openssl/openssl/ssl/rio/poll_builder.h index 1fe13eacbaba..48605d718223 100644 --- a/deps/openssl/openssl/ssl/rio/poll_builder.h +++ b/deps/openssl/openssl/ssl/rio/poll_builder.h @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -76,4 +76,17 @@ int ossl_rio_poll_builder_poll(RIO_POLL_BUILDER *rpb, OSSL_TIME deadline); * it is currently not needed. */ +#ifndef OPENSSL_NO_QUIC +/* + * Test instrumentation only. If set, poll_translate() (see poll_immediate.c) + * calls this with the index of each item immediately before translating it, + * once all earlier items (if any) have finished translation. This lets + * tests inject a readiness change into the gap between translation of + * consecutive items, in order to deterministically exercise the + * abort-blocking path. Always NULL in production use. + */ +extern void (*ossl_quic_poll_translate_test_step_cb)(size_t idx, void *arg); +extern void *ossl_quic_poll_translate_test_step_cb_arg; +#endif + #endif diff --git a/deps/openssl/openssl/ssl/rio/poll_immediate.c b/deps/openssl/openssl/ssl/rio/poll_immediate.c index 24b82f3a6a43..95410df0d8f4 100644 --- a/deps/openssl/openssl/ssl/rio/poll_immediate.c +++ b/deps/openssl/openssl/ssl/rio/poll_immediate.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -49,6 +49,13 @@ } while (0) #ifndef OPENSSL_NO_QUIC +/* + * Test instrumentation only; see poll_builder.h. Always NULL in production + * use. + */ +void (*ossl_quic_poll_translate_test_step_cb)(size_t idx, void *arg) = NULL; +void *ossl_quic_poll_translate_test_step_cb_arg = NULL; + static int poll_translate_ssl_quic(SSL *ssl, QUIC_REACTOR_WAIT_CTX *wctx, RIO_POLL_BUILDER *rpb, @@ -216,6 +223,10 @@ static int poll_translate(SSL_POLL_ITEM *items, for (i = 0; i < num_items; ++i) { item = &ITEM_N(items, stride, i); + if (ossl_quic_poll_translate_test_step_cb != NULL) + ossl_quic_poll_translate_test_step_cb(i, + ossl_quic_poll_translate_test_step_cb_arg); + switch (item->desc.type) { case BIO_POLL_DESCRIPTOR_TYPE_SSL: ssl = item->desc.value.ssl; @@ -233,7 +244,7 @@ static int poll_translate(SSL_POLL_ITEM *items, FAIL_ITEM(i); if (*abort_blocking) - return 1; + goto out; if (!SSL_get_event_timeout(ssl, &timeout, &is_infinite)) FAIL_ITEM(i++); /* need to clean up this item too */ @@ -271,7 +282,12 @@ static int poll_translate(SSL_POLL_ITEM *items, } out: - if (!ok) + /* + * On abort_blocking, the item which triggered the abort has already + * balanced its own enter/leave of the blocking section (see + * poll_translate_ssl_quic()); only items 0..i-1 still need cleanup here. + */ + if (!ok || *abort_blocking) postpoll_translation_cleanup(items, i, stride, wctx); *p_earliest_wakeup_deadline = earliest_wakeup_deadline; @@ -320,8 +336,15 @@ static int poll_block(SSL_POLL_ITEM *items, p_result_count)) goto out; - if (abort_blocking) + if (abort_blocking) { + /* + * Nothing actually failed; we just shouldn't block because an item + * may have become ready while we were setting up. The caller's + * retry loop will call poll_readout() again to pick this up. + */ + ok = 1; goto out; + } earliest_wakeup_deadline = ossl_time_min(earliest_wakeup_deadline, user_deadline); diff --git a/deps/openssl/openssl/ssl/rio/rio_notifier.c b/deps/openssl/openssl/ssl/rio/rio_notifier.c index ea40790d627b..abc1755dae02 100644 --- a/deps/openssl/openssl/ssl/rio/rio_notifier.c +++ b/deps/openssl/openssl/ssl/rio/rio_notifier.c @@ -1,5 +1,5 @@ /* - * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,7 +10,6 @@ #include "internal/sockets.h" #include #include -#include "internal/thread_once.h" #include "internal/rio_notifier.h" /* @@ -28,32 +27,29 @@ static int set_cloexec(int fd) #if defined(OPENSSL_SYS_WINDOWS) -static CRYPTO_ONCE ensure_wsa_startup_once = CRYPTO_ONCE_STATIC_INIT; -static int wsa_started; - static void ossl_wsa_cleanup(void) { - if (wsa_started) { - wsa_started = 0; - WSACleanup(); - } + WSACleanup(); } -DEFINE_RUN_ONCE_STATIC(do_wsa_startup) +static int do_wsa_startup(void) { WORD versionreq = 0x0202; /* Version 2.2 */ WSADATA wsadata; if (WSAStartup(versionreq, &wsadata) != 0) return 0; - wsa_started = 1; - OPENSSL_atexit(ossl_wsa_cleanup); return 1; } static ossl_inline int ensure_wsa_startup(void) { - return RUN_ONCE(&ensure_wsa_startup_once, do_wsa_startup); + return do_wsa_startup(); +} + +static void wsa_done(void) +{ + ossl_wsa_cleanup(); } #endif diff --git a/deps/openssl/openssl/ssl/s3_lib.c b/deps/openssl/openssl/ssl/s3_lib.c index 213ec84b171d..079a308f6ff1 100644 --- a/deps/openssl/openssl/ssl/s3_lib.c +++ b/deps/openssl/openssl/ssl/s3_lib.c @@ -5223,8 +5223,10 @@ int ssl_generate_master_secret(SSL_CONNECTION *s, unsigned char *pms, pskpmslen = 4 + pmslen + psklen; pskpms = OPENSSL_malloc(pskpmslen); - if (pskpms == NULL) + if (pskpms == NULL) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; + } t = pskpms; s2n(pmslen, t); if (alg_k & SSL_kPSK) @@ -5248,6 +5250,7 @@ int ssl_generate_master_secret(SSL_CONNECTION *s, unsigned char *pms, OPENSSL_clear_free(pskpms, pskpmslen); #else /* Should never happen */ + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; #endif } else { diff --git a/deps/openssl/openssl/ssl/ssl_cert.c b/deps/openssl/openssl/ssl/ssl_cert.c index adc5bb3d35c3..43d1191c6e2e 100644 --- a/deps/openssl/openssl/ssl/ssl_cert.c +++ b/deps/openssl/openssl/ssl/ssl_cert.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -306,7 +306,7 @@ int ssl_cert_set0_chain(SSL_CONNECTION *s, SSL_CTX *ctx, STACK_OF(X509) *chain) for (i = 0; i < sk_X509_num(chain); i++) { X509 *x = sk_X509_value(chain, i); - r = ssl_security_cert(s, ctx, x, 0, 0); + r = ssl_security_cert(s, ctx, x, 0); if (r != 1) { ERR_raise(ERR_LIB_SSL, r); return 0; @@ -340,7 +340,7 @@ int ssl_cert_add0_chain_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x) if (!cpk) return 0; - r = ssl_security_cert(s, ctx, x, 0, 0); + r = ssl_security_cert(s, ctx, x, 0); if (r != 1) { ERR_raise(ERR_LIB_SSL, r); return 0; @@ -1149,7 +1149,7 @@ int ssl_build_cert_chain(SSL_CONNECTION *s, SSL_CTX *ctx, int flags) */ for (i = 0; i < sk_X509_num(chain); i++) { x = sk_X509_value(chain, i); - rv = ssl_security_cert(s, ctx, x, 0, 0); + rv = ssl_security_cert(s, ctx, x, 0); if (rv != 1) { ERR_raise(ERR_LIB_SSL, rv); OSSL_STACK_OF_X509_free(chain); diff --git a/deps/openssl/openssl/ssl/ssl_lib.c b/deps/openssl/openssl/ssl/ssl_lib.c index 05b0209a76b3..ba494f5fc0d0 100644 --- a/deps/openssl/openssl/ssl/ssl_lib.c +++ b/deps/openssl/openssl/ssl/ssl_lib.c @@ -5226,6 +5226,31 @@ SSL *SSL_dup(SSL *s) || !dup_ca_names(&retsc->client_ca_names, sc->client_ca_names)) goto err; + if (sc->server_cert_type != NULL) { + OPENSSL_free(retsc->server_cert_type); + retsc->server_cert_type = OPENSSL_memdup(sc->server_cert_type, + sc->server_cert_type_len); + if (retsc->server_cert_type == NULL) + goto err; + retsc->server_cert_type_len = sc->server_cert_type_len; + } + + if (sc->client_cert_type != NULL) { + OPENSSL_free(retsc->client_cert_type); + retsc->client_cert_type = OPENSSL_memdup(sc->client_cert_type, + sc->client_cert_type_len); + if (retsc->client_cert_type == NULL) + goto err; + retsc->client_cert_type_len = sc->client_cert_type_len; + } + +#ifndef OPENSSL_NO_CT + retsc->ct_validation_callback = sc->ct_validation_callback; + retsc->ct_validation_callback_arg = sc->ct_validation_callback_arg; +#endif + + retsc->ext.status_type = sc->ext.status_type; + return ret; err: diff --git a/deps/openssl/openssl/ssl/ssl_local.h b/deps/openssl/openssl/ssl/ssl_local.h index 8fc8b6440615..d974ac6ecfe0 100644 --- a/deps/openssl/openssl/ssl/ssl_local.h +++ b/deps/openssl/openssl/ssl/ssl_local.h @@ -1,5 +1,5 @@ /* - * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * @@ -2901,10 +2901,9 @@ __owur int ssl_validate_ct(SSL_CONNECTION *s); __owur EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s); -__owur int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy, - int is_ee); +__owur int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int is_ee); __owur int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk, - X509 *ex, int vfy); + X509 *ex); int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs); diff --git a/deps/openssl/openssl/ssl/ssl_rsa.c b/deps/openssl/openssl/ssl/ssl_rsa.c index 740460f5c2e0..42958d9d0c2d 100644 --- a/deps/openssl/openssl/ssl/ssl_rsa.c +++ b/deps/openssl/openssl/ssl/ssl_rsa.c @@ -42,7 +42,7 @@ int SSL_use_certificate(SSL *ssl, X509 *x) return 0; } - rv = ssl_security_cert(sc, NULL, x, 0, 1); + rv = ssl_security_cert(sc, NULL, x, 1); if (rv != 1) { ERR_raise(ERR_LIB_SSL, rv); return 0; @@ -247,7 +247,7 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) return 0; } - rv = ssl_security_cert(NULL, ctx, x, 0, 1); + rv = ssl_security_cert(NULL, ctx, x, 1); if (rv != 1) { ERR_raise(ERR_LIB_SSL, rv); return 0; @@ -993,13 +993,13 @@ static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *pr c = sc != NULL ? sc->cert : ctx->cert; /* Do all security checks before anything else */ - rv = ssl_security_cert(sc, ctx, x509, 0, 1); + rv = ssl_security_cert(sc, ctx, x509, 1); if (rv != 1) { ERR_raise(ERR_LIB_SSL, rv); goto out; } for (j = 0; j < sk_X509_num(chain); j++) { - rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0, 0); + rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0); if (rv != 1) { ERR_raise(ERR_LIB_SSL, rv); goto out; diff --git a/deps/openssl/openssl/ssl/statem/extensions.c b/deps/openssl/openssl/ssl/statem/extensions.c index 2de540f828f0..13846bc11596 100644 --- a/deps/openssl/openssl/ssl/statem/extensions.c +++ b/deps/openssl/openssl/ssl/statem/extensions.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -605,6 +605,11 @@ int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet, SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION); goto err; } + + /* The server must tolerate the unknown extension and complete. */ + if (thisex == NULL) + continue; + idx = thisex - raw_extensions; /*- * Check that we requested this extension (if appropriate). Requests can @@ -635,17 +640,15 @@ int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet, SSL_R_UNSOLICITED_EXTENSION); goto err; } - if (thisex != NULL) { - thisex->data = extension; - thisex->present = 1; - thisex->type = type; - thisex->received_order = i++; - if (s->ext.debug_cb) - s->ext.debug_cb(SSL_CONNECTION_GET_USER_SSL(s), !s->server, - thisex->type, PACKET_data(&thisex->data), - PACKET_remaining(&thisex->data), - s->ext.debug_arg); - } + thisex->data = extension; + thisex->present = 1; + thisex->type = type; + thisex->received_order = i++; + if (s->ext.debug_cb) + s->ext.debug_cb(SSL_CONNECTION_GET_USER_SSL(s), !s->server, + thisex->type, PACKET_data(&thisex->data), + (int)PACKET_remaining(&thisex->data), + s->ext.debug_arg); } if (init) { diff --git a/deps/openssl/openssl/ssl/statem/statem_clnt.c b/deps/openssl/openssl/ssl/statem/statem_clnt.c index b317b9392435..0279a62abd2e 100644 --- a/deps/openssl/openssl/ssl/statem/statem_clnt.c +++ b/deps/openssl/openssl/ssl/statem/statem_clnt.c @@ -2814,6 +2814,14 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s, if (SSL_CONNECTION_IS_TLS13(s)) { PACKET extpkt; + /* + * Fulfilling RFC8446:4.6.1 requirement: Clients MUST NOT cache + * tickets for longer than 7 days. + */ + if (ticket_lifetime_hint > 604800) { + ticket_lifetime_hint = 604800; + } + if (!PACKET_as_length_prefixed_2(pkt, &extpkt) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); diff --git a/deps/openssl/openssl/ssl/statem/statem_lib.c b/deps/openssl/openssl/ssl/statem/statem_lib.c index 7e3be12f7a71..c69008708147 100644 --- a/deps/openssl/openssl/ssl/statem/statem_lib.c +++ b/deps/openssl/openssl/ssl/statem/statem_lib.c @@ -1071,7 +1071,7 @@ static int ssl_add_cert_chain(SSL_CONNECTION *s, WPACKET *pkt, CERT_PKEY *cpk, i /* Don't leave errors in the queue */ ERR_clear_error(); chain = X509_STORE_CTX_get0_chain(xs_ctx); - i = ssl_security_cert_chain(s, chain, NULL, 0); + i = ssl_security_cert_chain(s, chain, NULL); if (i != 1) { #if 0 /* Dummy error calls so mkerr generates them */ @@ -1096,7 +1096,7 @@ static int ssl_add_cert_chain(SSL_CONNECTION *s, WPACKET *pkt, CERT_PKEY *cpk, i } X509_STORE_CTX_free(xs_ctx); } else { - i = ssl_security_cert_chain(s, extra_certs, x, 0); + i = ssl_security_cert_chain(s, extra_certs, x); if (i != 1) { if (!for_comp) SSLfatal(s, SSL_AD_INTERNAL_ERROR, i); diff --git a/deps/openssl/openssl/ssl/statem/statem_srvr.c b/deps/openssl/openssl/ssl/statem/statem_srvr.c index b2f8a0ebc43d..03fcc6eeac79 100644 --- a/deps/openssl/openssl/ssl/statem/statem_srvr.c +++ b/deps/openssl/openssl/ssl/statem/statem_srvr.c @@ -3921,8 +3921,10 @@ CON_FUNC_RETURN tls_construct_server_compressed_certificate(SSL_CONNECTION *sc, || !WPACKET_put_bytes_u24(pkt, cc->orig_len) || !WPACKET_start_sub_packet_u24(pkt) || !WPACKET_memcpy(pkt, cc->data, cc->len) - || !WPACKET_close(pkt)) + || !WPACKET_close(pkt)) { + SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; + } sc->s3.tmp.cert->cert_comp_used++; return 1; @@ -4251,7 +4253,7 @@ CON_FUNC_RETURN tls_construct_new_session_ticket(SSL_CONNECTION *s, WPACKET *pkt SSL_SESSION *new_sess = ssl_session_dup(s->session, 0); if (new_sess == NULL) { - /* SSLfatal already called */ + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); goto err; } diff --git a/deps/openssl/openssl/ssl/t1_lib.c b/deps/openssl/openssl/ssl/t1_lib.c index e11fa8bc638e..ef1114172a28 100644 --- a/deps/openssl/openssl/ssl/t1_lib.c +++ b/deps/openssl/openssl/ssl/t1_lib.c @@ -1817,53 +1817,6 @@ void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats, } } -/* Check a key is compatible with compression extension */ -static int tls1_check_pkey_comp(SSL_CONNECTION *s, EVP_PKEY *pkey) -{ - unsigned char comp_id; - size_t i; - int point_conv; - - /* If not an EC key nothing to check */ - if (!EVP_PKEY_is_a(pkey, "EC")) - return 1; - - /* Get required compression id */ - point_conv = EVP_PKEY_get_ec_point_conv_form(pkey); - if (point_conv == 0) - return 0; - if (point_conv == POINT_CONVERSION_UNCOMPRESSED) { - comp_id = TLSEXT_ECPOINTFORMAT_uncompressed; - } else if (SSL_CONNECTION_IS_TLS13(s)) { - /* - * ec_point_formats extension is not used in TLSv1.3 so we ignore - * this check. - */ - return 1; - } else { - int field_type = EVP_PKEY_get_field_type(pkey); - - if (field_type == NID_X9_62_prime_field) - comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime; - else if (field_type == NID_X9_62_characteristic_two_field) - comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2; - else - return 0; - } - /* - * If point formats extension present check it, otherwise everything is - * supported (see RFC4492). - */ - if (s->ext.peer_ecpointformats == NULL) - return 1; - - for (i = 0; i < s->ext.peer_ecpointformats_len; i++) { - if (s->ext.peer_ecpointformats[i] == comp_id) - return 1; - } - return 0; -} - /* Return group id of a key */ static uint16_t tls1_get_group_id(EVP_PKEY *pkey) { @@ -1888,9 +1841,6 @@ static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md) /* If not EC nothing to do */ if (!EVP_PKEY_is_a(pkey, "EC")) return 1; - /* Check compression */ - if (!tls1_check_pkey_comp(s, pkey)) - return 0; group_id = tls1_get_group_id(pkey); /* * For a server we allow the certificate to not be in our list of supported @@ -2788,13 +2738,6 @@ int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey) if (pkeyid == EVP_PKEY_EC) { - /* Check point compression is permitted */ - if (!tls1_check_pkey_comp(s, pkey)) { - SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, - SSL_R_ILLEGAL_POINT_COMPRESSION); - return 0; - } - /* For TLS 1.3 or Suite B check curve matches signature algorithm */ if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) { int curve = ssl_get_EC_curve_nid(pkey); @@ -4057,8 +4000,6 @@ int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk, chain = cpk->chain; strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT; if (tls12_rpk_and_privkey(s, idx)) { - if (EVP_PKEY_is_a(pk, "EC") && !tls1_check_pkey_comp(s, pk)) - return 0; *pvalid = rv = CERT_PKEY_RPK; return rv; } @@ -4401,51 +4342,29 @@ static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, return ssl_ctx_security(ctx, op, secbits, 0, x); } -static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, - int op) +int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int is_ee) { - /* Lookup signature algorithm digest */ - int secbits, nid, pknid; - - /* Don't check signature if self signed */ - if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0) - return 1; - if (!X509_get_signature_info(x, &nid, &pknid, &secbits, NULL)) - secbits = -1; - /* If digest NID not defined use signature NID */ - if (nid == NID_undef) - nid = pknid; - if (s != NULL) - return ssl_security(s, op, secbits, nid, x); - else - return ssl_ctx_security(ctx, op, secbits, nid, x); -} - -int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy, - int is_ee) -{ - if (vfy) - vfy = SSL_SECOP_PEER; if (is_ee) { - if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy)) + if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY)) return SSL_R_EE_KEY_TOO_SMALL; } else { - if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy)) + if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY)) return SSL_R_CA_KEY_TOO_SMALL; } - if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy)) - return SSL_R_CA_MD_TOO_WEAK; return 1; } /* - * Check security of a chain, if |sk| includes the end entity certificate then - * |x| is NULL. If |vfy| is 1 then we are verifying a peer chain and not sending - * one to the peer. Return values: 1 if ok otherwise error code to use + * Call ssl_security_check() on all certificates in a stack. + * If |x| is non NULL it is checked first, before checking the + * certificates in the stack. + * + * Return values: 1 if ok otherwise the error code from the first + * failing ssl_security_check().; */ int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk, - X509 *x, int vfy) + X509 *x) { int rv, start_idx, i; @@ -4457,13 +4376,13 @@ int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk, } else start_idx = 0; - rv = ssl_security_cert(s, NULL, x, vfy, 1); + rv = ssl_security_cert(s, NULL, x, 1); if (rv != 1) return rv; for (i = start_idx; i < sk_X509_num(sk); i++) { x = sk_X509_value(sk, i); - rv = ssl_security_cert(s, NULL, x, vfy, 0); + rv = ssl_security_cert(s, NULL, x, 0); if (rv != 1) return rv; } @@ -4523,6 +4442,20 @@ static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, if (supported <= 0) return 0; + /* + * When RPK is negotiated there are no certificate signatures to + * constrain, and there may not even be a certificate configured. + */ + if (TLSEXT_cert_type_rpk == (s->server ? s->ext.server_cert_type : s->ext.client_cert_type)) + return 1; + + /* + * RPK was enabled, adding candidate private-key-only slots, but was not + * negotiated, so the key-only slot is not usable. + */ + if (x == NULL) + return 0; + /* * The TLS 1.3 signature_algorithms_cert extension places restrictions * on the sigalg with which the certificate was signed (by its issuer). diff --git a/deps/openssl/openssl/util/missingcrypto.txt b/deps/openssl/openssl/util/missingcrypto.txt index 16ca0e49dfa0..ad0f165fa6ba 100644 --- a/deps/openssl/openssl/util/missingcrypto.txt +++ b/deps/openssl/openssl/util/missingcrypto.txt @@ -590,8 +590,6 @@ LONG_it(3) MD2_options(3) MD4_Transform(3) MD5_Transform(3) -NAME_CONSTRAINTS_check(3) -NAME_CONSTRAINTS_check_CN(3) NAME_CONSTRAINTS_it(3) NAMING_AUTHORITY_it(3) NCONF_WIN32(3) diff --git a/deps/openssl/openssl/util/other.syms b/deps/openssl/openssl/util/other.syms index ba188d46c796..0bb7b92bd69b 100644 --- a/deps/openssl/openssl/util/other.syms +++ b/deps/openssl/openssl/util/other.syms @@ -2,10 +2,12 @@ # that don't appear in lib*.num -- because they are define's, in # assembly language, etc. # +OPENSSL_armcap environment OPENSSL_ia32cap environment OPENSSL_ppccap environment -OPENSSL_s390xcap environment OPENSSL_riscvcap environment +OPENSSL_s390xcap environment +OPENSSL_sparcv9cap environment OPENSSL_MALLOC_FD environment OPENSSL_MALLOC_FAILURES environment OPENSSL_instrument_bus assembler @@ -783,6 +785,7 @@ SSL_VALUE_CLASS_FEATURE_REQUEST define SSL_VALUE_CLASS_FEATURE_PEER_REQUEST define SSL_VALUE_CLASS_FEATURE_NEGOTIATED define SSL_VALUE_QUIC_IDLE_TIMEOUT define +SSL_VALUE_QUIC_MAX_PENDING_CONNS define SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL define SSL_VALUE_QUIC_STREAM_BIDI_REMOTE_AVAIL define SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL define diff --git a/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm b/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm index c3db4e28db0f..729b351b3f0a 100644 --- a/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm +++ b/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm @@ -1,4 +1,4 @@ -# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -177,6 +177,7 @@ sub init server_port => 0, serverpid => 0, clientpid => 0, + clientexit => 0, execute => $execute, cert => $cert, debug => $debug, @@ -215,6 +216,7 @@ sub clearClient $self->{clientflags} = ""; $self->{sessionfile} = undef; $self->{clientpid} = 0; + $self->{clientexit} = 0; $is_tls13 = 0; $ciphersuite = undef; @@ -585,6 +587,7 @@ sub clientstart $pid = $self->{clientpid}; print "Waiting for s_client process to close: $pid...\n"; waitpid($pid, 0); + $self->{clientexit} = $?; return $success; } @@ -722,6 +725,11 @@ sub clientpid my $self = shift; return $self->{clientpid}; } +sub clientexit +{ + my $self = shift; + return $self->{clientexit}; +} #Read/write accessors sub filter diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index f27fcfa22dbf..1c5849b3f1d6 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -801,14 +801,29 @@ for (const test of TEST_CASES) { const iv = Buffer.alloc(12); const opts = { authTagLength: 10 }; + const control = crypto.createCipheriv('aes-128-ccm', key, iv, opts); + control.update(Buffer.alloc(0)); + control.final(); + const expectedTag = control.getAuthTag(); + const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts); - assert.throws(() => { - cipher.final(); - }, hasOpenSSL(3) ? { - code: 'ERR_OSSL_TAG_NOT_SET' - } : { - message: /Unsupported state/ - }); + let output; + try { + output = cipher.final(); + } catch (err) { + // OpenSSL without https://github.com/openssl/openssl/pull/32427 + // cannot finalize an empty CCM message unless update() was called. + if (hasOpenSSL(3)) { + assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET'); + } else { + assert.match(err.message, /Unsupported state/); + } + } + + if (output !== undefined) { + assert.deepStrictEqual(output, Buffer.alloc(0)); + assert.deepStrictEqual(cipher.getAuthTag(), expectedTag); + } } }