openbsd/src/regress/lib/libssl, branch masterA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=master2026-04-03T07:40:14+00:00Fix min vs max in failure output.2026-04-03T07:40:14+00:00jsing2026-04-03T07:40:14+00:00urn:sha1:d8c990b8ab23e4f390c5f883d8da8177ef804444Use DTLS_client_method() instead of DTLSv1_client_method().2026-04-03T07:37:52+00:00jsing2026-04-03T07:37:52+00:00urn:sha1:4e96afcd8aab7bbc0e9ad7f32a9c2dd0dc055a61libssl regress: adjust golden numbers for RSASSA-PSS2026-03-30T06:23:33+00:00tb2026-03-30T06:23:33+00:00urn:sha1:ccb38f6d4da1788074ffa4e9a4a99bc33073b703
Add the three RSASSA-PSS SignatureScheme 0x080b, 0x080a, 0x0809 in the
appropriate spots in (components of) the ClientHello and adjust various
length octets by adding 6.
Hook up X25519MKLEM768 to the TLS 1.3 handshake2025-12-04T21:16:17+00:00beck2025-12-04T21:16:17+00:00urn:sha1:dccd1f43a0c2de3852d9515f57353d756629c97a
This does the following:
1) Adds a second key share prediction to the TLS 1.3 handshake.
We only add one as we are unlikely to want to send more than
one PQ one, and one classical one and are unlikely to waste
bytes on a second PQ algorithm (anything that wants something
else that we support can HRR to get it)
2) Adds X25519MLKEM768 (4588) to our list of supported groups.
We add this to our preferred client and server key shares for TLS 1.3
and we now have a separate list for TLS 1.2 which does not do this,
cleaning up the old "full list" from the comments.
3) Updates the golden magic numbers in the regression tests to allow
for the above two things changing the handshake, so the regress
tests pass.
With this you can successfully hybrid PQ with servers and clients
that support it.
ok tb@ kenjiro@
Add a MLKEM768_X25519 hybrid key share.2025-12-04T21:03:42+00:00beck2025-12-04T21:03:42+00:00urn:sha1:f8fcf556caab3fb1fb9d9b496d2724345c90a3eb
This implements the currently in use MLKEM768_X25519 hybrid
key share as outlined in
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
This commit does not yet wire this up to anything, that is done
in follow on changes.
ok tb@ jsing@ kenjiro@
Add some regress coverage for SSL_SESSION_dup()2025-10-24T11:45:08+00:00tb2025-10-24T11:45:08+00:00urn:sha1:8c82be46a0f9e21b9defa002abd3b6d0f82f4974
ok kenjiro
The ssl_verify_param.c test can now link dynamically against libcrypto2025-10-24T11:44:08+00:00tb2025-10-24T11:44:08+00:00urn:sha1:dc4d56b5f3d1f310b754d8e69d1b35ba3c5d17ddUse X509_VERIFY_PARAM_get_hostflags() prototype from x509_vfy.h2025-10-24T11:43:34+00:00tb2025-10-24T11:43:34+00:00urn:sha1:c168e7d61d28218d9000b840a46e75e38f2ac5ffconst correct X509_VERIFY_PARAM_get_hostflags()2025-10-10T23:07:40+00:00tb2025-10-10T23:07:40+00:00urn:sha1:43419247d48fcba182defe04d984a4fc8ab42654
This is currently an internal helper only used by a regress test.
We'll have to expose in the public API for Python 3.14:
https://github.com/libressl/portable/issues/1202
Retire interop tests with OpenSSL 3.3 and 3.42025-07-25T16:33:15+00:00tb2025-07-25T16:33:15+00:00urn:sha1:6618a43ea7b02c5b0f466548f4b922be713de484