openssl-sys

What's Changed

• Bump aws-ls-sys to 0.41 by @joshgodsiff in #2640
• Add brainpoolP224r1 and brainpoolP224t1 NID constants by @sfarestam-iproov in #2642
• x509: add minimal support for CRL building by @DavidFontaineOcd in #2538
• add mldsa.h to the boringssl bindgen by @reaperhulk in #2650
• Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string by @alex in #2652
• Fix verify_mode() panic on unmodeled verify mode bits by @alex in #2651
• Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2653
• Release openssl 0.10.81 and openssl-sys 0.9.117 by @reaperhulk in #2655

New Contributors

• @joshgodsiff made their first contribution in #2640
• @sfarestam-iproov made their first contribution in #2642
• @DavidFontaineOcd made their first contribution in #2538

Full Changelog: openssl-sys-v0.9.116...openssl-sys-v0.9.117

Added

• Added SSL_VERIFY_CLIENT_ONCE and SSL_VERIFY_POST_HANDSHAKE.
• Added NID_brainpoolP224r1 and NID_brainpoolP224t1.
• Added ML-DSA bindings on BoringSSL.

Changed

• Bumped aws-lc-sys to 0.41.

What's Changed

• Prefer Homebrew openssl@4 and stop looking for [email protected] by @alex in #2633
• Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-padding by @alex in #2638
• Release openssl 0.10.80 and openssl-sys 0.9.116 by @alex in #2639

Full Changelog: openssl-sys-v0.9.115...openssl-sys-v0.9.116

Changed

• On macOS, the Homebrew auto-detection now prefers openssl@4, falls back to openssl@3/[email protected], and no longer looks for [email protected].

What's Changed

• Bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #2610
• Try to fix OpenSSL 1.1.0l download by @botovq in #2614
• Require &mut BigNumContextRef for EcPointRef mul/invert by @alex in #2615
• Fix UB in EcGroupRef::generator on groups without a generator by @alex in #2617
• Replace use libc::*; with targeted imports in openssl-sys by @alex in #2618
• Add PKeyRef::is_a and KeyType for name-based key identification by @reaperhulk in #2619
• Add PKey::{public,private}_key_from_raw_bytes_ex by @reaperhulk in #2620
• Bump MSRV to 1.80 by @reaperhulk in #2622
• Drop once_cell in favor of std::sync::{LazyLock, OnceLock} by @reaperhulk in #2623
• Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import by @reaperhulk in #2621
• parallelize more builds in CI for cold caches by @reaperhulk in #2625
• Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction by @reaperhulk in #2626
• Fix process abort when verify/PSK callbacks fire after SSL_CTX swap by @alex in #2624
• Bind OSSL_PARAM_modified and use it for seed_into by @reaperhulk in #2628
• Add PkeyCtxRef::set_context_string for ML-DSA by @reaperhulk in #2629
• Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders by @alex in #2631
• Fix output buffer overflow for AES key-wrap-with-padding ciphers by @alex in #2630
• Release openssl 0.10.79 and openssl-sys 0.9.115 by @reaperhulk in #2632

Full Changelog: openssl-sys-v0.9.114...openssl-sys-v0.9.115

Added

• Added OSSL_PARAM_modified and exposed the OSSL_PARAM struct fields, so callers can detect whether a get-params call wrote into a parameter and read its return_size.
• Added EVP_CIPHER_flags / EVP_CIPHER_get_flags, the EVP_CIPH_MODE mask, and the EVP_CIPH_WRAP_MODE constant.

Changed

• Bumped MSRV to 1.80.

What's Changed

• Fix Suite B flag assignments in verify.rs by @alex in #2592
• Use cvt_p for OPENSSL_malloc error handling by @alex in #2593
• Mark BIO_get_mem_data on AWS-LC to be unsafe by @alex in #2594
• Set timeout for package installation step by @alex in #2595
• Panic in Crypter::new when IV is required but not provided by @alex in #2596
• openssl 4 support by @reaperhulk in #2591
• Avoid panic for overlong OIDs by @botovq in #2598
• Fix dangling stack pointer in custom extension add callback by @alex in #2599
• Add support for LibreSSL 4.3.x by @botovq in #2603
• fix inverted bounds assertion in AES key unwrap by @reaperhulk in #2604
• Reject oversized length returns from password callback trampoline by @alex in #2605
• Validate callback-returned lengths in PSK and cookie trampolines by @alex in #2607
• Error for short out in MdCtxRef::digest_final() by @botovq in #2608
• Check derive output buffer length on OpenSSL 1.1.x by @alex in #2606
• Release openssl v0.10.78 and openssl-sys v0.9.114 by @alex in #2609

Full Changelog: openssl-sys-v0.9.113...openssl-sys-v0.9.114

Added

• Added support for OpenSSL 4.x.
• Added support for LibreSSL 4.3.x.

Changed

• Marked BIO_get_mem_data as unsafe on AWS-LC -- this matches other backends.
• X509_NAME_ENTRY_get_data, X509_NAME_ENTRY_get_object, and X509_CRL_get_issuer now return *const pointers under ossl400 to match OpenSSL 4.

What's Changed

• CI: Hash-pin all action usage, avoid credential persistence in actions/checkout by @woodruffw in #2587
• Bump aws-lc-sys to 0.39 by @goffrie in #2588
• md_ctx: enable sign/verify/reset on BoringSSL, LibreSSL, and AWS-LC by @alex in #2589
• Release openssl v0.10.77 and openssl-sys v0.9.113 by @alex in #2590

New Contributors

• @woodruffw made their first contribution in #2587

Full Changelog: openssl-sys-v0.9.112...openssl-sys-v0.9.113

Added

• Exposed EVP_MD_CTX_reset on LibreSSL.

Changed

• Bumped aws-lc-sys to 0.39.

Added

• Added bindings for HKDF support.
• Added OSSL_PARAM_BLD_push_int.
• Added bindings for EVP_PKEY_new_raw_public_key_ex, EVP_PKEY_new_raw_private_key_ex, and EVP_PKEY_is_a.
• Added brainpool curve NID constants.
• Added NID for AES_*_OCB.
• Unconditionally exposed X509_NAME_dup and other *_dup() functions.
• Added support for pregenerated Rust bindings from AWS-LC installations.
• Added support for LibreSSL 4.3.0.

Changed

• Bumped aws-lc-sys from 0.27 to 0.38. 0.38 includes security fixes (CVEs).

Removed

• Removed ASN1_STRING_data for LibreSSL 4.3.0.
• Removed X509_VERIFY_PARAM_ID for LibreSSL 4.3.0.
• Removed ASN1_ENCODING for LibreSSL 4.3.0.

Added

• Added bindings to EVP_MAC APIs.
• Added bindings to ASN1_GENERALIZEDTIME_new and ASN1_GENERALIZEDTIME_set_string.

Added

• Added support for LibreSSL 4.2.0.
• Added bindings to many OpenSSL APIs.

Changed

• Bumped bindgen to 0.72.0.
• Bumped MSRV to 1.70.

Fixed

• Fixed missing __off_t on NetBSD 10.
• Fixed building with OPENSSL_NO_COMP.
• Fixed building with OPENSSL_NO_SRTP.
• Fixed finding OpenSSL on AIX.

Removed

• Removed support for OpenSSL <1.0.2.
• Removed support for LibreSSL <3.5.

Fixed

• Fixed building with vcpkg, a statically linked OpenSSL, and rust 1.87.0.
• Fixed building on the latest BoringSSL.

Added

• Added support for LibreSSL 4.1.x.

Added

• Support for building with AWS-LC.

Added

• Support building with OPENSSL_NO_RC2.
• Exposed EVP_rc2_cbc and EVP_rc2_40_cbc.

Added

• Added DTLS_server_method and DTLS_client_method.

Added

• Added support for LibreSSL 4.0.x.
• Added EVP_KDF_* and EVP_KDF_CTX_* bindings.
• Added EVP_DigestSqueeze.
• Added OSSL_PARAM_construct_octet_string.
• Added OSSL_set_max_threads and OSSL_get_max_threads.

Changed

• openssl-sys is now a 2021 edition crate
• Explicitly specify the MSRV in Cargo.toml
• Raised the bindgen (optional) dependency from 0.65 to 0.69

Added

• Added several functions and constants for datagram BIOs.
• Added EVP_PKEY_set1_DSA, EVP_PKEY_set1_DH, and EVP_PKEY_set1_EC_KEY.
• Added several functions related to QUIC support.

Added

• Added support for LibreSSL 3.9.x.

Fixed

• Fixed a bug where, when building with the vendored feature, this crate always needed to be rebuilt.

Added

• Added OSSL_PARAM, OSSL_PARAM_construct_uint , OSSL_PARAM_construct_end.
• Added EVP_PKEY_CTX_set_params and EVP_PKEY_CTX_get_params.
• Added X509_alias_get0.
• Added EVP_default_properties_enable_fips.

Added

• On macOS added Homebrew's [email protected] to the list of candidates to build against.
• NID_brainpoolP256r1, NID_brainpoolP320r1, NID_brainpoolP384r1, and NID_brainpoolP512r1 are now available on LibreSSL.

Changed

• X509_PURPOSE is now opaque on LibreSSL 3.9.0+.

Added

• Added RAND_priv_bytes.
• Added NID_brainpoolP320r1.

Changed

• X509_PURPOSE_get0 now returns a const pointer on LibreSSL 3.9.0+.
• X509V3_EXT_add_alias is removed on LibreSSL 3.9.0+.

Changed

• libatomic is no longer dynamically linked for 32 bit ARM targets.

Added

• Added SSL_read_ex, SSL_peek_ex, and SSL_write_ex.

Changed

• EVP_chacha20 is now available on LibreSSL

Added

• Added EVP_des_ede3_ecb, EVP_des_ede3_cfb8, EVP_des_ede3_ofb, EVP_camellia_128_ofb, EVP_camellia_192_ofb, EVP_camellia_256_ofb, EVP_cast5_ofb, EVP_idea_ofb
• Added X509_STORE_get1_all_certs
• Added SSL_CTRL_GET_PEER_TMP_KEY, SSL_CTRL_GET_TMP_KEY, SSL_get_peer_tmp_key, SSL_get_tmp_key

Changed

• Fixed the availability of EVP_PKEY_RSA_PSS on OpenSSL

Added

• Added support for LibreSSL 3.8.x.
• Added NID_chacha20_poly1305

Changed

• X509_ALGOR is now opaque on new LibreSSL releases

Added

• Added support for building with OPENSSL_NO_SCRYPT
• Added EVP_PKEY_RSA_PSS and EVP_PKEY_DHX
• Functions and constants for using HKDF EVP_PKEY are now available on LibreSSL.
• Added SSL_CTX_set_security_level, SSL_set_security_level, SSL_CTX_get_security_level, SSL_get_security_level
• Added X509_check_host, X509_check_email, X509_check_ip, X509_check_ip_asc

Changed

• The vendored Cargo feature now builds OpenSSL 3.1, as 1.1.1 is reaching its EOL.

Added

• Added support for LibreSSL 3.8.1.

Added

• Added EVP_CIPHER_CTX_copy
• Expose EVP_chacha20_poly1305 on LibreSSL
• Added X509_VERIFY_PARAM_set1_email

Added

• Expose poly1305_state, CRYPTO_poly1305_init, CRYPTO_poly1305_update, and CRYPTO_poly1305_finish on BoringSSL and LibreSSL.
• Fix detection of libraries on OpenBSD.
• Added EC_POINT_point2hex and EC_POINT_hex2point.
• Added EVP_PKEY_verify_recover_init, EVP_PKEY_verify_recover, and EVP_PKEY_CTX_set_signature_md.
• Added EVP_CIPHER_CTX_FLAG_WRAP_ALLOW and EVP_CTX_set_flags.
• Added BN_mod_sqrt.

Fixed

• Fixed compilation with BoringSSL when building with the bindgen CLI.

Fixed

• Fixed compilation with recent versions of BoringSSL.

Added

• Added support for detecting OpenSSL compiled with OPENSSL_NO_OCB.
• Added EVP_PKEY_SM2 and NID_sm2.
• Added EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH, and EVP_PKEY_assign_EC_KEY.
• Added EC_GROUP_get_asn1_flag.
• Expose EC_POINT_get_affine_coordinates on BoringSSL and LibreSSL.
• Added EVP_PKEY_derive_set_peer_ex.

Added

• Added support for the LibreSSL 3.8.0.
• Added support for detecting OPENSSL_NO_RC4.
• Added OBJ_dup.
• Added ASN1_TYPE_new, ASN1_TYPE_set, d2i_ASN1_TYPE, and i2d_ASN1_TYPE.
• Added SSL_bytes_to_cipher_list, SSL_CTX_get_num_tickets, and SSL_get_num_tickets.
• Added GENERAL_NAME_set0_othername.
• Added X509_get_pathlen.

Added

• Added DH_CHECK.
• Added CMAC_CTX_new, CMAC_CTX_free, CMAC_Init, CMAC_Update, CMAC_Final, and CMAC_CTX_copy.
• Added EVP_default_properties_is_fips_enabled.
• Added X509_get0_subject_key_id, X509_get0_authority_key_id, X509_get0_authority_issuer, and X509_get0_authority_serial.
• Added NID_poly1305.

Fixed

• Fixed BoringSSL support with the latest bindgen release.

Added

• Added bindings for PKCS#7 functions and more X.509 functions.

Added

• Added support for LibreSSL 3.7.x.

Added

• Added ASN1_INTEGER_dup and ASN1_INTEGER_cmp.
• Added stack_st_X509_NAME_ENTRY.
• Added DIST_POINT_NAME, DIST_POINT, stack_st_DIST_POINT, DIST_POINT_free, and DIST_POINT_NAME_free.

Fixed

• Fixed version checks for LibreSSL.

Added

• Added i2d_X509_EXTENSION.
• Added GENERAL_NAME_new.

Added

• Added support for LibreSSL 3.7.1.
• Added support for X25519 and Ed25519 on LibreSSL and BoringSSL.

Fixed

Fixed builds against OpenSSL built with no-cast.

Added

• Added experimental bindgen support for BoringSSL.
• Added X509_VERIFY_PARAM_set_auth_level, X509_VERIFY_PARAM_get_auth_level, and X509_VERIFY_PARAM_set_purpose.
• Added X509_PURPOSE_* consts.
• Added X509_NAME_add_entry.
• Added X509_load_crl_file.
• Added SSL_set_cipher_list, SSL_set_ssl_method, SSL_use_PrivateKey_file, SSL_use_PrivateKey, SSL_use_certificate, SSL_use_certificate_chain_file, SSL_set_client_CA_list, SSL_add_client_CA, and SSL_set0_verify_cert_store.
• Added X509_PURPOSE, X509_STORE_set_purpose, and X509_STORE_set_trust.
• Added SSL_CTX_set_num_tickets, SSL_set_num_tickets, SSL_CTX_get_num_tickets, and SSL_get_num_tickets.
• Added CMS_verify.

Removed

• Removed an unnecessary link to libatomic for 32-bit android targets.

Fixed

• Added NO_DEPRECATED_3_0 cfg checks for more APIs.

Added

• Added support for LibreSSL 3.7.0.
• Added SSL_CTRL_CHAIN_CERT and SSL_add0_chain_cert.
• Added EVP_PKEY_get_security_bits and EVP_PKEY_security_bits.
• Added OSSL_PROVIDER_set_default_search_path.

Added

• Added EVP_CIPHER_CTX_num.
• Added X509_LOOKUP_file and X509_load_cert_file.

Added

• Added support for LibreSSL 3.6.x.
• Added NID_brainpoolP256r1, NID_brainpoolP384r1, and NID_brainpool512r1.
• Added EVP_camellia_128_cfb128, EVP_camellia_128_ecb, EVP_camellia_192_cfb128, EVP_camellia_192_ecb, EVP_camellia_256_cfb128, and EVP_camellia_256_ecb.
• Added EVP_cast5_cfb64 and EVP_cast5_ecb.
• Added EVP_idea_cfb64 and EVP_idea_ecb.
• Added DSA_SIG, d2i_DSA_SIG, i2d_DSA_SIG, DSA_SIG_new, DSA_SIG_free, DSA_SIG_get0, and DSA_SIG_set0.
• Added X509_STORE_set1_param, X509_VERIFY_PARAM_new, X509_VERIFY_PARAM_set_time, and X509_VERIFY_PARAM_set_depth.

Added

• Added support for LibreSSL 3.6.0
• Added assume_init.

Added

• Added SSL_get_psk_identity_hint and SSL_get_psk_identity.
• Added SHA-3 NID constants.
• Added SSL_OP_PRIORITIZE_CHACHA.
• Added X509_REQ_print.
• Added EVP_MD_CTX_size and EVP_MD_CTX_get_size
• Added EVP_MD_CTX_reset.
• Added experimental, unstable support for BoringSSL.

Fixed

• Fixed the deprecation note on SSL_CTX_set_alpn_select_cb.

Added

• Added SM4 bindings.
• Added EC_GROUP_set_generator and EC_POINT_set_affine_coordinates_GFp.

Added

• Added EVP_MD_block_size.
• Added X509V3_EXT_add_alias.
• Added X509_V_ERR_INVALID_CA back when building against OpenSSL 3.0.

Added

• Added support for installations that place libraries in $OPENSSL_DIR/lib64 in addition to $OPENSSL_DIR/lib.
• Added X509_issuer_name_hash.
• Added ASN1_string_set.
• Added X509_CRL_dup, X509_REQ_dup, X509_NAME_dup, and X509_dup.
• Added X509_print.
• Added support for LibreSSL 3.5.x.

Changed

• Temporarily downgraded the vendored OpenSSL back to 1.1.1 due to significant performance regressions. We will move back to 3.0.0 when a future release resolves those issues.

Added

• Added PKCS12_set_mac.
• Added EVP_PKEY_sign_init, EVP_PKEY_sign, EVP_PKEY_verify_init, and EVP_PKEY_verify.
• Added support for LibreSSL 3.4.x.

Fixed

• Fixed linkage to static 3.0.0 OpenSSL libraries on some 32 bit architectures.

Changed

• Upgraded the vendored OpenSSL to 3.0.0.

Added

• Added support for automatic detection of Homebrew openssl@3 installs.
• Added EVP_PKEY_Q_keygen and EVP_EC_gen.

Added

• Added BN_bn2binpad.
• Added i2d_X509_NAME and d2i_X509_NAME.
• Added BN_FLG_MALLOCED, BN_FLG_STATIC_DATA, BN_FLG_CONSTTIME, and BN_FLG_SECURE.
• Added BN_CTX_secure_new, BN_secure_new, BN_set_flags, and BN_get_flags.

Added

• Added support for LibreSSL 3.4.0

Added

• Added EVP_seed_cbc, EVP_seed_cfb128, EVP_seed_ecb, and EVP_seed_ofb.
• Added OBJ_length and OBJ_get0_data.
• Added i2d_PKCS8PrivateKey_bio.

Fixed

• Restored the accidentally deleted PEM_read_bio_X509_CRL function.

Added

• Added support for OpenSSL 3.x.x.
• Added SSL_peek.
• Added ERR_LIB_ASN1 and ASN1_R_HEADER_TOO_LONG.
• Added d2i_X509_bio.
• Added OBJ_nid2obj.
• Added RAND_add.
• Added SSL_CTX_set_post_handshake_auth.
• Added COMP_get_type.
• Added X509_get_default_cert_file_env, X509_get_default_cert_file, X509_get_default_cert_dir_env, and X509_get_default_cirt_dir.

Added

• Added support for LibreSSL 3.3.x.

Added

• Added support for LibreSSL 3.3.2.
• Added DH_set0_key.
• Added EC_POINT_get_affine_coordinates.

Added

• Added support for automatic detection of OpenSSL installations via pkgsrc and MacPorts on macOS.
• Added various V_ASN1_* constants.
• Added DH_generate_parameters_ex.
• Added EC_POINT_is_at_infinity and EC_POINT_is_on_curve.
• Added EVP_CIPHER_nid.
• Added EVP_sm3.
• Added NID_* constants related to SM3.
• Added PKCS7_get0_signers.
• Added EVP_PKEY_CTX_set0_rsa_oaep_label.
• Added ACCESS_DESCRIPTION and ACCESS_DESCRIPTION_free.

Added

• Added support for the default Homebrew install directory on ARM.
• Added EVP_PKEY_CTX_set_rsa_oaep_md and EVP_PKEY_CTRL_RSA_OAEP_MD.

Added

• Added support for LibreSSL 3.2.x, 3.3.0, and 3.3.1.
• Added DH_generate_parameters, DH_generate_key, DH_compute_key, and DH_size.
• Added NID_X25519, NID_X448, EVP_PKEY_x25519 and EVP_PKEY_x448.
• Added OBJ_txt2obj.
• Added d2i_PKCS7 and i2d_PKCS7.
• Added SRTP_AEAD_AES_128_GCM and SRTP_AEAD_AES_256_GCM.

Added

• Added SSL_set_mtu.
• Added support for LibreSSL 3.2.0.
• Added PEM_read_bio_EC_PUBKEY, PEM_write_bio_EC_PUBKEY, d2i_EC_PUBKEY, and i2d_EC_PUBKEY.
• Added EVP_PKEY_encrypt_init, EVP_PKEY_encrypt, EVP_PKEY_decrypt_init, EVP_PKEY_decrypt, EVP_PKEY_get_raw_public_key, EVP_PKEY_new_raw_public_key, EVP_PKEY_get_raw_private_key, and EVP_PKEY_new_raw_private_key.
• Added OBJ_sn2nid.