openssl/test, branch master

test/cmp_client_test.c: add RR tests with issuer or serialNumber missing

2026-10-24T09:43:46Z

Issuer and serialNumber are independently OPTIONAL in a CertTemplate, and the library hands them to the process_rr callback separately. The OpenSSL CMP client always sends both, so the mock server has never been exercised with an RR that carries only one of them. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33071

Migrate test_gcm_reinit from evp_extra_test.c to evp_aead_test.c

2026-10-23T20:40:10Z

Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Fri Oct 23 20:40:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33308

QUIC: resend the whole ClientHello after a Retry

2026-10-23T12:53:53Z

When the client received a Retry, ch_retry() marked only its first Initial packet as pseudo-lost, assuming that the ClientHello fits in it. Since 3.5 the default key shares (X25519MLKEM768 and X25519) put the ClientHello into two Initial packets. The second one stayed in flight, so the client resent only the first part of the ClientHello, and the server could do no more than acknowledge it. The rest was sent only once that acknowledgement had the second packet declared lost: one more round trip for every Retry, and a congestion event that halved the congestion window although nothing was lost. RFC 9002 section 6.3 has a client that receives a Retry reset its loss recovery state, as the server processed none of its Initial packets. Mark every Initial packet still in flight as pseudo-lost instead. ch_restart() marked only the first Initial packet after version negotiation in the same way. It now shares the helper, so ch_retry() no longer needs drop_later_pn to work out which packet number to mark. A Version Negotiation packet and a Retry can be processed in the same batch of datagrams. The first then leaves no Initial packet in flight for the second, and their data is already queued, so that is not an error. test_quic_retry_after_version_neg covers this order. The SSL_trace reference recorded the extra round trip, and is updated. The radix forbidden_frame_types script injects a frame into the server's Initial packets. With the whole ClientHello sent at once, a post-quantum ServerHello can fill the server's only Initial packet, leaving no room, so the script's server now uses classical groups. Fixes: f538b4215528 "QUIC_CHANNEL: Implementation" Fixes #33077 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298

QUIC: release pseudo-lost packets from the congestion controller

2026-10-23T12:53:45Z

On a Retry, and after version negotiation, the client marks Initial packets it has sent as pseudo-lost, so that their CRYPTO data is sent again. The ACK manager then stops counting them as in flight, but on purpose does not report them to the congestion controller as lost, since the network lost nothing. The congestion controller is not told about them at all, so NewReno kept counting their bytes as in flight for the rest of the connection, and allowed that much less to be sent. Release them with on_data_invalidated(), as when a packet number space is discarded. The congestion window is left alone. This follows the approach proposed in #33099. Fixes: 90699176b074 "QUIC CC: Major revisions to CC abstract interface" Fixes #33079 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Saša Nedvědický Merge-date: Fri Oct 23 12:53:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33298

test: clear stale RADIX handshake injection selectors

2026-10-23T12:40:34Z

The handshake injection helpers share radix_fault with earlier scripts but left its selector words unchanged. script_68 leaves word0 set to 1, which selects CertificateRequest. script_69 installs the same callback before it sets word0 to 2 for KeyUpdate. A session ticket generated in that interval can trigger the previous script's fault and close the connection before the intended KeyUpdate injection. Clear both selector words in the handshake injection setup paths, as the plaintext injection setup already does. Request a normal session ticket in script_69 before arming its fault, so the test exercises the interval where an inherited selector caused the unexpected close. Keep the expected KeyUpdate close code unchanged. Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Merge-date: Fri Oct 23 12:40:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33213

test: make RADIX QUIC objects nonblocking by default

2026-10-23T12:40:34Z

RADIX drives both endpoints and advances its simulated clock from one interpreter. Accepted server connections inherit blocking mode from their listeners, even though the underlying UDP sockets are nonblocking. Extra handshake retries advance fake time and can inflate the initial RTT estimates. In the one-way key update loops the server's estimate can stay high while later samples reduce the client's PTO. The server can then retain its previous receive keys for longer than the client waits before its next update. Packets starting that update are then discarded, as permitted by RFC 9001 section 6.5. A blocking server read prevents the interpreter from driving client retransmission or advancing the clock, so this recoverable discard becomes a hang. The interpreter's 60-second deadline cannot interrupt the call, leaving the process watchdog to abort. External UDP loss is not required to reproduce the failure. Set clients and listeners to nonblocking mode at construction, including listeners created from a domain and the custom listener constructors. Accepted connections and their streams inherit this setting. The client setting makes the construction policy consistent before OP_CONNECT_WAIT, which also sets its mode. Retain the domain blocking capability needed by SSL_poll and document how tests can explicitly enable blocking I/O. Add a regression using existing opcodes to delay an ACK, increase the server's PTO and require recovery across successive client key updates. Cover both listener creation paths. Check listener and client modes before connection establishment and the accepted server's mode, so a recurrence fails promptly instead of waiting for the process watchdog. Fixes #33206. Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Merge-date: Fri Oct 23 12:40:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33213

DTLS listener: do not drive idle pending connections every tick

2026-10-22T14:52:20Z

Every listener tick called SSL_accept() on every pending connection, whether or not anything had arrived for it, and each such call pumped the demux with another recvmmsg(). SSL_poll() ticks the listener once per item, so 256 one-byte datagrams from distinct source ports, which fill the pending table for 30 s, made every SSL_poll() over N connections cost (N + 1) * 256 futile SSL_accept() calls. Record whether the last drive left a pending connection waiting for its peer, and skip it until a datagram is queued for it or its retransmission timer expires. Driving one connection pumps the demux, which can queue a datagram for a connection the tick skipped or has already driven while emptying the socket the caller then waits on. Drive again when that happens, up to DTLS_LISTENER_MAX_DRIVE_PASSES times, and do not let a wait on the listener or on its connections sleep while such input remains. Discovered by Anthropic's OSS Scanner (finding ANT-2026-EFVK6J4Z). Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Saša Nedvědický Reviewed-by: Ryan Hooper Reviewed-by: Mounir Idrassi Merge-date: Thu Oct 22 14:38:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33265

DTLS listener: free a pending connection that fails after HVR

2026-10-22T14:52:20Z

dtls_listener_conn_needs_retry() reported a DTLS 1.2 connection as waiting for its second ClientHello whenever its handshake state was DTLS_ST_SW_HELLO_VERIFY_REQUEST, even if the connection had since entered the error state, e.g. on receiving a fatal alert from the peer. The listener then kept it in its pending table, and called SSL_accept() on it every tick, until the pending timeout expired instead of freeing it as a failed connection. Check ossl_statem_in_error() as the DTLS 1.3 HRR case already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Saša Nedvědický Reviewed-by: Ryan Hooper Reviewed-by: Mounir Idrassi Merge-date: Thu Oct 22 14:38:07 2026 Merged-from: https://github.com/openssl/openssl/pull/33265

DTLS 1.3: Fix WANT_READ while awaiting ServerHello

2026-10-22T06:08:29Z

After HelloRetryRequest, buffering records from a later epoch can request a retry without reading the BIO. Supply missing read-retry flags so SSL_get_error() reports SSL_ERROR_WANT_READ rather than SSL_ERROR_SYSCALL. Preserve existing retry conditions and handle listener connections without a read BIO. Add regression tests for delayed ServerHello delivery and permanent loss followed by timeout-driven retransmission. Check WANT_READ and an empty error queue after every retry, then verify handshake completion and bidirectional application data. Fixes: #33241 Assisted-by: Claude Code:claude-sonnet-5-5 Assisted-by: OpenCode:github-copilot/gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Mounir Idrassi Merge-date: Thu Oct 22 06:08:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33268

Fix wrong alignment in tho allocator used in quic_stream test.

2026-10-21T17:09:29Z

Wrong alignment observed on Solaris Sparc 10 (bus error). THO_ALLOC_HDR has size 20 and memory for structures gets allocated at addresses directly following a THO_ALLOC_HDR. Backport needed for the 4.1 branch. Fixes https://github.com/openssl/openssl/issues/33187 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Merge-date: Wed Oct 21 17:10:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33204