Commit 3f11738c2a for openssl.org

commit 3f11738c2ae80e0c820e778e2db01f79f2d92f2a
Author: Dmitry Misharov <dmitry@openssl.org>
Date:   Thu Nov 12 13:51:34 2026 +0100

    Add missing doxygen blocks reported by check-doc-comments

    ossl_rand_hash_salt(), X509v3_addr_get_safi(),
    and dtls1_sent_buffer_uses_current_wrl() landed without the blocks
    the doc-comments hook requires, so it fails on every PR touching master
    changes since then.

    Complements: 32acc578282c "x509: draw the duplicate-extension hash key with a RAND fallback"
    Complements: 0a5b2323077a "Add X509v3_addr_get_safi()"
    Complements: 14a6de1652f6 "Retransmit the DTLS 1.3 ClientHello when sending early data"
    Assisted-by: Claude:claude-opus-5-5
    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Thu Nov 12 14:54:27 2026
    Merged-from: https://github.com/openssl/openssl/pull/33683

diff --git a/include/crypto/rand.h b/include/crypto/rand.h
index 4ac417ea43..c50442af48 100644
--- a/include/crypto/rand.h
+++ b/include/crypto/rand.h
@@ -167,9 +167,10 @@ uint32_t ossl_rand_uniform_uint32(OSSL_LIB_CTX *ctx, uint32_t upper, int *err);
 uint32_t ossl_rand_range_uint32(OSSL_LIB_CTX *ctx, uint32_t lower, uint32_t upper,
     int *err);

-/*
- * Random salt for hashing untrusted input, e.g. the SipHash key of a hash
- * table, with fallbacks for library contexts without a usable RAND.
+#ifndef FIPS_MODULE
+/**
+ * @brief Random salt for hashing untrusted input, e.g. the SipHash key of a
+ * hash table, with fallbacks for library contexts without a usable RAND.
  * Not suitable for cryptographic keys, IVs, nonces or other secrets.
  *
  * Only built into libcrypto: its fallbacks rely on the libcrypto seeding
@@ -178,8 +179,12 @@ uint32_t ossl_rand_range_uint32(OSSL_LIB_CTX *ctx, uint32_t lower, uint32_t uppe
  * fallback is needed there. Hiding the declaration from FIPS_MODULE builds
  * turns an accidental use into a compile error rather than a link failure
  * of the FIPS provider.
+ *
+ * @param[in] ctx the library context whose RAND is tried first
+ * @param[out] buf output buffer for the salt
+ * @param[in] num number of bytes to write to @p buf
+ * @returns 1 on success, 0 if no source could supply the bytes
  */
-#ifndef FIPS_MODULE
 int ossl_rand_hash_salt(OSSL_LIB_CTX *ctx, unsigned char *buf, size_t num);
 #endif

diff --git a/include/openssl/x509v3.h.in b/include/openssl/x509v3.h.in
index 28bd80bc30..37924454a1 100644
--- a/include/openssl/x509v3.h.in
+++ b/include/openssl/x509v3.h.in
@@ -965,6 +965,10 @@ int X509v3_addr_add_range(IPAddrBlocks *addr,
     unsigned afi, const unsigned *safi,
     unsigned char *min, unsigned char *max);
 unsigned X509v3_addr_get_afi(const IPAddressFamily *f);
+/**
+ * @brief Get the SAFI of an IPAddressFamily, or 0 if it has none.
+ * @see X509v3_addr_get_safi(3)
+ */
 unsigned X509v3_addr_get_safi(const IPAddressFamily *f);
 int X509v3_addr_get_range(IPAddressOrRange *aor, unsigned afi,
     unsigned char *min, unsigned char *max,
diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h
index ecf7ddb01e..50c2e15e0b 100644
--- a/ssl/ssl_local.h
+++ b/ssl/ssl_local.h
@@ -3147,6 +3147,13 @@ void dtls1_start_timer(SSL_CONNECTION *s);
 void dtls1_stop_timer(SSL_CONNECTION *s);
 __owur int dtls1_is_timer_expired(SSL_CONNECTION *s);
 void dtls1_clear_current_wrl_from_sent_buffer(SSL_CONNECTION *s);
+/**
+ * @brief Check whether the current write record layer is still needed for
+ * retransmissions.
+ * @param[in] s the DTLS connection
+ * @returns 1 if a message in the sent_messages queue was sent with the
+ *          current write record layer, which then has to be kept, 0 otherwise
+ */
 int dtls1_sent_buffer_uses_current_wrl(SSL_CONNECTION *s);
 __owur int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie,
     size_t cookie_len);