openssl/ssl/statem, branch master

TLS: Generate the server random before processing ClientHello extensions

2026-10-21T16:45:28Z

The server random was only generated after all of the ClientHello extensions had been processed. In (D)TLSv1.3 the PSK callbacks are invoked while the pre_shared_key extension is being parsed, so a call to SSL_get_server_random() from within them returned all zeros. The TLSv1.2 psk_server_callback runs during ClientKeyExchange processing and so already observed the real value, making the behaviour inconsistent between protocol versions. Move the generation of the server random to immediately after the protocol version has been selected and before any of the remaining ClientHello processing. As a result the server random is also visible from the other callbacks invoked during ClientHello processing, such as the session ticket and servername callbacks. Fixes #26404 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Frederik Wedel-Heinen Merge-date: Wed Oct 21 16:45:34 2026 Merged-from: https://github.com/openssl/openssl/pull/33102

Cache decoded certs on client in CTX to avoid multiple asn1 parsing

2026-10-21T16:44:28Z

our TLS client path has to do an ASN1 decode on every new connection it establishes. Other TLS stacks (notably rustls) seems to not do this decode, opting instead to to do just enough der parsing to verify the certificate chain. We can't really do that, but we can maybe do some things to speed up this path. Most notably we can cache the received certificate der string in the SSL_CTX along with a previously decoded X509 certificate to avoid the overhead of additional ASN1 parsings in future connections Reviewed-by: Bob Beck Reviewed-by: Nikola Pajkovsky Merge-date: Wed Oct 21 16:44:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33085

Fix TLS 1.3 alert for missing key_share

2026-10-21T16:27:38Z

Fixes #30818 Co-authored-by: Anuj Ramesh <37349553+anujramesh@users.noreply.github.com> Assisted-by: Claude:claude-fable-5 Reviewed-by: Matt Caswell Reviewed-by: Frederik Wedel-Heinen Merge-date: Wed Oct 21 16:29:21 2026 Merged-from: https://github.com/openssl/openssl/pull/32527

ssl: handle session ID cache lock failure

2026-10-21T16:24:43Z

SSL_has_matching_session_id() returns 0 both when no matching session exists and when the cache lock cannot be acquired. Its use in the built-in generator's retry loop and the final uniqueness check can therefore treat a lock failure as proof that no conflict exists. Add an internal tri-state lookup. The final uniqueness check uses it as a backstop for IDs produced by both built-in and application callbacks, recording an internal fatal error when the cache cannot be checked. The retry loop also uses it to prevent the built-in generator from returning an ID after its own lookup failed, through the existing callback failure path. Preserve the public API's boolean contract. Correct the callback-selection cache lock failure reason from SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED to ERR_R_INTERNAL_ERROR. Remove a redundant caller-side SSLfatal() that appended a generic ERR_R_INTERNAL_ERROR after the specific error already recorded. Add a deterministic unit test for final cache lookup failure. Fixes #32358 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy Merge-date: Wed Oct 21 16:25:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32359

Don't dereference a NULL rbio in dtls1_read_failed()

2026-10-20T13:29:57Z

Connections created by a DTLS listener have no read BIO; they read from a queue that the listener's demux fills. dtls1_read_failed() still set BIO_FLAGS_READ on the read BIO unconditionally once the handshake had finished. A DTLS 1.3 server keeps its retransmission timer armed after the handshake until the client ACKs the NewSessionTickets. A client that never sends that ACK can arrange for the timer to expire while a non-blocking SSL_read() on the server is pumping the demux and finds no record (for example, by sending datagrams the record layer discards). dtls1_read_bytes() then calls dtls1_read_failed(), which crashes on the NULL BIO. Skip setting the flag when there is no read BIO. SSL_get_error() already returns SSL_ERROR_WANT_READ for listener connections without one. The DTLS listener has not been in any final release, so no released version of OpenSSL is affected. Discovered by Anthropic's OSS Scanner (finding ANT-2026-NPC3SFSW). Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Tue Oct 20 13:30:03 2026 Merged-from: https://github.com/openssl/openssl/pull/33257

DTLS 1.3: only accept plaintext alerts once the hellos are done

2026-10-20T12:38:12Z

DTLS 1.3 defers installing the handshake read keys until the peer's first epoch 2 record arrives. Until then the read record layer stays in epoch 0 and accepted plaintext handshake and ACK records. A peer that never sends an epoch 2 record could therefore send its Finished in plaintext. That Finished was checked with a finished key that was never derived (all zero), and the connection completed with its application read keys numbered epoch 1 instead of 3. From that state a client can ACK only the second NewSessionTicket and then send a record claiming epoch 2. The server performs the deferred key change on the established connection, and dtls1_clear_sent_buffer() on the partly acknowledged queue leaves a freed item linked in sent_messages, which is a use-after-free. A malicious server can do the same to a client. Once the hellos are done, tell the epoch 0 read layer that only plaintext alerts may still arrive, and discard any handshake fragments buffered before then. Make tls_process_finished() refuse a DTLS 1.3 Finished read before the handshake keys are installed. Disarm the deferred key change once it has run, and reset it with the connection. DTLS 1.3 has not been in any final release, so no released version of OpenSSL is affected. Discovered by Anthropic's OSS Scanner (finding ANT-2026-YZ5U4MXB). Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Mounir Idrassi Reviewed-by: Daniel Kubec Merge-date: Tue Oct 20 12:38:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33256

TLS 1.3: Enforce the ticket lifetime when offering a ticket

2026-10-19T12:34:18Z

Bound the effective lifetime to 604800 seconds and treat a zero lifetime as unusable in tls13_check_tick_lifetime_hint(), which gates both the pre_shared_key offer and the early_data advertisement. The cap in the message parser is kept so that SSL_SESSION_get_ticket_lifetime_hint() and the session cache callbacks keep seeing the capped value for tickets received from the wire. - RFC 9846 4.7.1: Servers MUST NOT use any value greater than 604800 seconds (7 days). The value of zero indicates that the ticket should be discarded immediately. Clients MUST NOT use tickets for longer than 7 days after issuance, regardless of the ticket_lifetime, and MAY delete tickets earlier based on local policy. A server MAY treat a ticket as valid for a shorter period of time than what is stated in the ticket_lifetime. Complements: 17bf6c48ea8a "TLS 1.3: Suppress early_data on PSK ticket age mismatch" Complements: 66985198d233 "TLS 1.3: Apply the cap to the lifetime hint in the session" Co-authored-by: Mounir IDRASSI Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 19 12:37:00 2026 Merged-from: https://github.com/openssl/openssl/pull/32808

PSK: Check for invalid server PSK ciphers

2026-10-09T13:56:02Z

If an application fails to set the PSK session cipher, or sets it to a TLS 1.2 cipher by mistake, skip the invalid PSK, avoiding a crash or an invalid outcome. Tests added to make sure a full handshake takes place instead. Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Fri Oct 9 13:56:05 2026 Merged-from: https://github.com/openssl/openssl/pull/31925

Polish psk callback error path cleanup

2026-10-09T13:56:02Z

- Avoid SSL_SESSION leak - Always cleanse the returned PSK secret Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Fri Oct 9 13:56:04 2026 Merged-from: https://github.com/openssl/openssl/pull/31925

Test PHA verification results across session resumption

2026-10-08T16:16:15Z

An application verification callback may accept a nonempty client certificate or RPK while retaining a nonzero verification error. That result must survive post-handshake authentication and resumption, without changing the previously published session. Expand pending-identity coverage to exercise X.509 and RPK replacement with successful and callback-accepted error results, using stateful and stateless refreshed tickets. Check the replacement identity and result on the live connection and session, then on a resumed connection. Also check that the retained cache-owned session remains unchanged. Start empty-RPK tests with a nonzero prior verification result. An optional empty response must remove that stale result, while a required empty response must fail without replacing the previous session state. Document that the empty-response helper retains the SSL_get_verify_result() semantics for an absent peer certificate: X509_V_OK does not establish authentication. The helper does not clear errors for supplied credentials. Remove two unused local pointer resets immediately before successful parse returns. No library verification-result behavior is changed. Validation: debug --strict-warnings build; test_sslapi, test_rpk, test_dtls and test_dtls13_internal all pass (no-fips). Assisted-by: Codex:gpt-6-astra Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Merge-date: Thu Oct 8 16:16:17 2026 Merged-from: https://github.com/openssl/openssl/pull/32638