Commit bc79a23e6c for openssl.org

commit bc79a23e6c68512d9929576995007009c9daa2d0
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Sun Apr 12 15:57:43 2026 +0200

    Deprecate unit-test configure option and SSL_test_functions

    The unit-test configure option exists only to expose the
    SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
    Instead of renaming it, deprecate the option and the SSL_test_functions()
    function so both can be removed in OpenSSL 5.0.

    Assisted-by: Claude:claude-fable-5

    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Thu Jul  9 17:39:13 2026
    (Merged from https://github.com/openssl/openssl/pull/30788)

diff --git a/CHANGES.md b/CHANGES.md
index da1eeb519a..275dc6c7c8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -31,6 +31,11 @@ OpenSSL Releases

 ### Changes between 4.0 and 4.1 [xx XXX xxxx]

+ * Deprecated the `enable-unit-test` configure option and the
+   `SSL_test_functions()` function. Both will be removed in OpenSSL 5.0.
+
+   *Jakub Zelenka*
+
  * Added -testmode option for `s_time` app.

    *Jakub Zelenka*
diff --git a/INSTALL.md b/INSTALL.md
index f087ab93fd..f907a89556 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -1098,6 +1098,8 @@ Enable additional unit test APIs.

 This should not typically be used in production deployments.

+This option is deprecated and will be removed in OpenSSL 5.0.
+
 ### no-uplink

 Don't build support for UPLINK interface.
diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index 7fc254d75e..b010a6e677 100644
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -2784,8 +2784,11 @@ __owur void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx);
 int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings);

 #ifndef OPENSSL_NO_UNIT_TEST
+#ifndef OPENSSL_NO_DEPRECATED_4_1
+OSSL_DEPRECATEDIN_4_1
 __owur const struct openssl_ssl_test_functions *SSL_test_functions(void);
 #endif
+#endif

 __owur int SSL_free_buffers(SSL *ssl);
 __owur int SSL_alloc_buffers(SSL *ssl);
diff --git a/ssl/ssl_utst.c b/ssl/ssl_utst.c
index 91be7398ca..7ff8932e42 100644
--- a/ssl/ssl_utst.c
+++ b/ssl/ssl_utst.c
@@ -7,6 +7,9 @@
  * https://www.openssl.org/source/license.html
  */

+/* SSL_test_functions() is deprecated but still needs to be implemented */
+#include "internal/deprecated.h"
+
 #include "ssl_local.h"

 #ifndef OPENSSL_NO_UNIT_TEST
diff --git a/util/libssl.num b/util/libssl.num
index 9fe992bc39..9b24054a7c 100644
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -558,7 +558,7 @@ SSL_CTX_get_security_callback           557	4_0_0	EXIST::FUNCTION:
 SSL_CTX_set0_security_ex_data           558	4_0_0	EXIST::FUNCTION:
 SSL_CTX_get0_security_ex_data           559	4_0_0	EXIST::FUNCTION:
 OPENSSL_init_ssl                        560	4_0_0	EXIST::FUNCTION:
-SSL_test_functions                      561	4_0_0	EXIST::FUNCTION:UNIT_TEST
+SSL_test_functions                      561	4_0_0	EXIST::FUNCTION:DEPRECATEDIN_4_1,UNIT_TEST
 SSL_free_buffers                        562	4_0_0	EXIST::FUNCTION:
 SSL_alloc_buffers                       563	4_0_0	EXIST::FUNCTION:
 SSL_CTX_set_session_ticket_cb           564	4_0_0	EXIST::FUNCTION: