Document the non-copying interface functions for BIO pairs that allow
direct access to the internal buffer:
- BIO_nread0/BIO_nread for zero-copy reading
- BIO_nwrite0/BIO_nwrite for zero-copy writing
Also add return value documentation for these functions and remove
the placeholder "[XXXXX: More return values need to be added here]".
Fixes#16366
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 6 14:51:27 2026
(Merged from https://github.com/openssl/openssl/pull/29849)
SSL_CTX_set_session_cache_mode and SSL_CTX_get_session_cache_mode
were documented with SSL_CTX ctx instead of SSL_CTX *ctx in their
synopsis.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed May 6 11:53:35 2026
(Merged from https://github.com/openssl/openssl/pull/30965)
Document the X509_STORE_CTX_set_time() function which sets the
verification time for certificate chain validation. This is a
convenience wrapper around X509_VERIFY_PARAM_set_time().
Remove X509_STORE_CTX_set_time from missingcrypto.txt and
missingcrypto111.txt.
Fixes#21362
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sun May 3 15:38:26 2026
(Merged from https://github.com/openssl/openssl/pull/29899)
Otherwise the counting done by shouldfail() does not account for calls
that are diverted to non-standard implementation and zero-sized
allocations, making it diverge from the sum of malloc_count
and realloc_count.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 30 06:59:07 2026
(Merged from https://github.com/openssl/openssl/pull/30991)
The man page previously stated that X509_CRL_delete_ext() and
X509_REVOKED_add_ext() are 'otherwise identical to the X509v3 functions,'
which is inaccurate. These routines use X509v3_delete_extension(), not
X509v3_delete_ext(), following the changes in #30350 and #30518.
Update the documentation to accurately describe this difference.
CLA: trivial
Signed-off-by: legin hpesoj <ncj2394@rit.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Apr 22 08:10:46 2026
(Merged from https://github.com/openssl/openssl/pull/30677)
Clarify when they can be used, and introduce some warnings about using
them too late in the handshake. In particular using them in the server
name callback is too late.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:46:26 2026
(Merged from https://github.com/openssl/openssl/pull/30797)
The -hex option description was ambiguous about its exact behavior.
Clarify that:
- With -generate: outputs the prime in hex instead of decimal
- When checking: interprets input as hex instead of decimal
- Output when checking is always hex regardless of this option
Fixes#19208
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 12:33:18 2026
(Merged from https://github.com/openssl/openssl/pull/29913)
The documentation for BN_add and related functions did not explicitly
state that the ctx parameter cannot be NULL. Users may assume NULL is
acceptable since some other OpenSSL functions allow it, but passing
NULL to functions like BN_mod_add() or BN_mod() causes a crash.
Update the documentation to explicitly state that ctx must not be NULL.
Fixes#12092
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 11:47:59 2026
(Merged from https://github.com/openssl/openssl/pull/29773)
Add its mentions to NAME, SYNOPSIS, and RETURN VALUES sections.
Also, while at it, put OPENSSL_{str,strn,mem}dup() with the other
OPENSSL_* interfaces, and add mentions of OPENSSL_str{,n}dup()
to RETURN VALUES.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:55 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Addition of those has been originally overlooked.
Complements: cc4ea5e000 "Introduce new internal hashtable implementation"
Complements: fa9b7b930e "Add array memory allocation routines"
Complements: 14a24fd14f "doc/man3/OPENSSL_malloc.pod: explicitly document freeptr value on failures"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:55 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Improve the description of X509_STORE_lock() in X509_STORE_new.pod to
emphasize it acquires an exclusive write lock.
Add a NOTES section to X509_STORE_new.pod covering which operations are
internally thread-safe and which are not, as well as documentation on
lifetime management and reference counting.
Add a NOTES section to X509_STORE_CTX_get_by_subject.pod explaining
that the store's internal lock is released before the found object's
reference count is incremented, so the caller must ensure the store
outlives the lookup.
Clarify the reference counting and the caller's responsibilities.
Remove internal details for conciseness.
Related to #30310
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/30382)
The names of the X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD and
X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD in the man page have
the first _ERR_ spelt out as _ERROR_ instead.
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Apr 1 17:06:53 2026
(Merged from https://github.com/openssl/openssl/pull/30643)
(cherry picked from commit e39a6de5c8)
The -signcert option was incorrectly grouped with -sign and -xsign at
line 109, which implied they were equivalent. However, -signcert is
different: it expects a self-signed certificate (not a certificate
request) in newreq.pem, and converts it to a request before signing.
This is correctly documented in its own separate section at line 123,
which states "-signcert is the same as -sign except it expects a self
signed certificate".
Remove -signcert from the -sign/-xsign grouping to eliminate the
contradiction.
Resolves: https://github.com/openssl/openssl/issues/29165
Fixes: 022696cab0 "Allow CA.pl script user to pass extra arguments to openssl command"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:10:50 2026
(Merged from https://github.com/openssl/openssl/pull/29794)
When using openssl pkeyutl -rawin or openssl dgst for one-shot sign/verify
(e.g. Ed25519, Ed448), file input is now read via mmap() on Unix where
supported, avoiding a full buffer allocation and copy. Large files are
supported without doubling memory use; on failure of the mmap path we
do not fall back to the buffer path.
- Add app_mmap_file() in apps/lib/apps.c: stat/open/mmap/close, tri-state
return (1 mapped, 0 size zero, -1 error). Parameter err_bio avoids
shadowing global bio_err (-Wshadow).
- apps/pkeyutl.c and apps/dgst.c: use app_mmap_file(); single exit for
mmap path in pkeyutl; dgst includes apps.h first for _FILE_OFFSET_BITS;
do_fp_oneshot_sign returns EXIT_SUCCESS/EXIT_FAILURE like do_fp(); no
fallback when mmap attempted but fails.
- pkeyutl mmap/buffer path: pass filesize to EVP_DigestVerify and
EVP_DigestSign (review suggestion, avoids casting buf_len).
- Error messages: per-file messages for stat/size (dgst, pkeyutl); CHANGES.md
"Unix-like" and "16 MB" (documentation style).
- Centralize _FILE_OFFSET_BITS and mmap includes in apps/include/apps.h.
- Tests: pkeyutl/dgst oneshot from file, no-fallback regression tests;
use srctop_dir for test paths; stderr patterns for mmap errors.
- Docs: man pages and CHANGES.md.
CI fixes: return failure from dgst one-shot sign when mmap fails; treat
non-regular paths as mmap errors in app_mmap_file() and pkeyutl; reject
directories before mmap.
Addresses review feedback from DDvO, npajkovsky, and vdukhovni (PR #30429).
Fixes#11677
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>
Co-authored-by: David von Oheimb <DDvO@users.noreply.github.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 27 16:25:33 2026
(Merged from https://github.com/openssl/openssl/pull/30429)
* Fix inconsistent doc (so far using purpose names smime_sign and smime_encrypt) vs. implementation
* Add the info that "smimesign" is the default purpose here.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Fri Mar 27 06:25:20 2026
(Merged from https://github.com/openssl/openssl/pull/18914)
Igor Ustinov
kovan
Nyveruus
slontis
Eugene Adell
Joshua Rogers
Eugene Syromiatnikov
andrei2308
Michael Richardson
Joe Orton
Norbert Pocs
Dmitry Belyavskiy
legin hpesoj
Daniel Gustafsson
Matt Caswell
Taavi Eomäe
Josh Auler
Jon Ericson
Neil Horman
Arne Schwabe
Tomas Mraz
sftcd
Stacey Zheng
Emmalee Carpenter
Herman Malik
William Faber
herbenderbler
Zoey Chapell
Dr. David von Oheimb