aboutsummaryrefslogtreecommitdiffstats
path: root/include/internal
Commit message (Collapse)AuthorAgeFilesLines
* Fix SSL_poll() multi-reactor cleanup deadlockMounir IDRASSI5 days3-21/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_poll() cleaned up QUIC reactor wait registrations in item-array order. Leaving a reactor can block while its notifier is signalled, so two callers spanning the same reactors could each wait on one reactor while still registered on another. The translation abort path has the same ordering problem. Split QUIC leave into two phases: deregister from every QUIC reactor, then wait for any notification cycles still pending. For QUIC-only poll sets this removes every waiter registration before any notifier wait. DTLS listener cleanup is unchanged. Guard the QUIC drain call for no-quic builds. Phase 2 also prevents an immediate re-registration from keeping the notifier signalled. Capture notify_generation during deregistration so a wait is bounded to the observed cycle. Apply the same generation bound to the combined single-reactor leave operation. Exercise real SSL_poll cleanup on two reactors in both the post-poll and translation-abort paths, including repeated items sharing a reactor. Check that a delayed phase-2 waiter completes while a later notification cycle remains signalled. Fixes #32130 Assisted-by: OpenCode:GLM-5.2 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Codex:gpt-6-astra Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Tue Oct 20 12:29:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32137
* DTLS listener: bound the demux free listMounir IDRASSI11 days1-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | The demux free list caches released URXEs so a receive burst can be served without allocating, but nothing bounds it: a transient flood raising the per-connection receive queues also raises the free list's retained high-water mark for the remaining lifetime of the listener. Add a per-demux limit, ossl_dgram_demux_set_max_free_urxe(), enforced in ossl_dgram_demux_release_urxe(): a URXE released while the free list is at its limit is freed instead of cached, so the bound is strict and no later trim pass is needed. Freeing there honours the documented contract that no reference may be made to a URXE or its buffer after it is released, and no release caller touches the entry afterwards. The DTLS listener sets the limit to DEMUX_MAX_FREE_URXE, two receive batches, so one full batch can always be cached; QUIC keeps the default unbounded behaviour. Resolves: https://github.com/openssl/openssl/issues/33173 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Oct 14 10:54:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33197
* DTLS listener: bound the per-connection receive queueMounir IDRASSI11 days1-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DTLS listener queues datagrams from a known peer into a per-connection list (DTLS_RX::urxe_pending) with no limit on count or bytes. A reachable peer that completes the ordinary cookie exchange can grow one parked connection's queue without bound as long as the application keeps the shared demux pumped, moving datagrams into userspace past the bound the kernel socket buffer would otherwise provide. Cap the queue at OSSL_DTLS_RX_DEFAULT_MAX_QUEUED (128) datagrams per connection - a datagram count, not a byte cap. Every queued URXE holds a buffer of at least the listener's maximum datagram size whatever the datagram's length, so a full queue costs about 295 KB per connection at the default 2000-byte size, roughly one default kernel socket receive buffer; across a full 256-connection listener budget that is about 75 MB. The queue is consumed FIFO, so on overflow the oldest datagram is evicted rather than the newest: a DTLS flight can span several datagrams, and under overload keeping the newest biases the queue toward the flight the peer just sent instead of stale fragments of an older one. The evicted URXE is unhooked under rx->mutex and released to the demux after dropping it, so demux->mutex is never taken while rx->mutex is held. References: https://github.com/openssl/openssl/issues/33173 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Oct 14 10:54:54 2026 Merged-from: https://github.com/openssl/openssl/pull/33197
* Change all files with OpenSSL License to ASL 2.0 LicenseTomas Mraz2026-10-051-1/+2
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Oct 5 09:34:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33070
* Build the qlog filename with asprintfBob Beck2026-10-021-14/+0
| | | | | | | | | | | | | | | Replaces the length arithmetic and per-byte snprintf hex loop. id_len is asserted against QUIC_MAX_CONN_ID_LEN, which the wire parser already enforces. ossl_determine_dirsep was awkwardly a char, with only one caller being this function - remove it from internal/common.h and make it a static returning a string. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Oct 2 07:18:25 2026 Merged-from: https://github.com/openssl/openssl/pull/31550
* Provide ossl_asprintf() and friends.Bob Beck2026-10-021-0/+36
| | | | | | | | | | From BoringSSL Fixes: https://github.com/openssl/project/issues/1914 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Oct 2 07:18:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31550
* DTLS 1.3: Retain the previous read epoch to recover from lost ACKsRyan Hooper2026-10-021-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After processing the client's Finished or a peer KeyUpdate, the read record layer advanced to the new epoch and the old one was freed immediately. If the ACK we sent for that message was lost, the peer's retransmission arrived at the now-discarded epoch: it could not be authenticated, so no replacement ACK was ever produced and the peer exhausted its retransmission budget. RFC9147 section 5.8.1 requires the finished peer to ACK retransmissions of the other side's final flight, and section 8 requires receive keys from before a KeyUpdate to be retained until decryption with the new keys succeeds. Retain exactly one prior read epoch's record layer instead of freeing it, add a record-layer dispatch hook so the DTLS method can take ownership of it, and authenticate a record at that epoch with its own retained keys and replay window when the current epoch's epoch-bits check would otherwise just drop it. This isn't limited to replacing lost ACKs: a previous *application* epoch (from KeyUpdate recovery) can also legitimately supply application data that arrives reordered relative to the epoch change. Successful authentication with the retained keys doesn't by itself prove a record is a retransmission, so let it reach the handshake layer instead of deciding that here: the DTLS 1.2-only Finished special case (retransmit our own flight) is skipped for DTLS 1.3, and the existing out-of-sequence duplicate-ACK path is widened from post-handshake epochs only to include the epoch a Finished is sent at -- the sequence and epoch checks in that path are what actually decide whether a retained-epoch record can be acknowledged. Fixes: #32891 Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 06:36:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32963
* Fix coding style violation: do not use variable length arraysNicky Mouha2026-09-291-8/+5
| | | | | | | | | Signed-off-by: Nicky Mouha <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:40:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32967
* Enforce final size for streams.Alexandr Nedvedicky2026-09-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | When FIN stream frame is received at particular offset, then the FIN's offset must be the largest offset kept in stream reassembly buffer. Receiving stream frame with offset larger than FIN frame must be reported as protocol violation and connection must be closed. In order to report protocol violation error the stream reassembly module must have a reference to QUIC_CHANNEL object where particular stream belongs to. The refernce to channel is part of QUIC_RSTREAM_QPARAM structure. This change makes stream quality parameter mandatory. Co-authored-by: Jakub Zelenka <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* Limit packet buffer overhead to ~64kB per stream.Alexandr Nedvedicky2026-09-263-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is currently no limit on how many bytes of packet buffers each stream can hold in memory. To monitor and limit the size of packet buffers used by stream the change accounts so called stream chunk overhead which is a delta between actual datagram size of packet delivering the particular stream chunk and chunk itself. As soon as the chunk overhead exceeds ~64kB for all stream chunks kept in receive buffer, the newly received chunks will be moved from packet buffer to stream buffer. The packet buffer overhead limit is held in newly introduced structure QUIC_RSTREAM_QPARAM (RX stream quality parameter). If new additional quality parameters are added, then those should be part of QUIC_RSTREAM_QPARAM structure. this changeset introduces QUIC_RSTREAM_QPARAM the the rsqp (reead stream quality parameter) enables channel to control quality of RX stream. quality currently means the packet buffer overhead. more parameters may be added later. Fixes: CVE-2026-54873 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:32 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* New implementation of stream reassembly for QUIC.Alexandr Nedvedicky2026-09-263-178/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new implementation makes clear distinction between stream chunk and stream range. The strem chunk is defined by its `start` and `end` offset with respect to offset 0 (the start of the stream). The `start` < `end`. The lenght of the stream chunk is `end - start`. The stream chunks are delivered as QUIC stream frames. The stream range is list of stream chunks which together create one continuous range of stream. The range is also deined by `start` and `end` offset. The ranges are kept in R/B tree. The chunks which are arriving in order are kept in list which forms one node of R/B tree. If newly arriving stream chunk can not be inserted to existing stream range for example because chunk.start > range.end (there is a gap between existing range and new chunk), then the new range is created and inserted to R/B tree. If the newly arriving chunk closes the gap between two existing ranges, the ranges are merged to single tree node. The join proces uses list join operation with O(1) complexity to make the new continuous range of stream chunks. In a nutshell: stream reassembly process is R/B tree look up/insert with tail/head insertion to list. There is also a preparatory work that will allow us to deal with memory hog issue. Currently the QUIC stack keeps all stream frame data on packet buffers until data is moved to application. On hone hand, this saves one copy opration between on the other hand it may cause receiver to hold lot more memory than currently needed. Consider situation where QUIC stack needs to hold reference to whole packet buffer, just because of sinle 1byte stream chunk. The 1byte stream chunk (at let's say offset 10) can not be moved to application yet, because QUIC stack is waiting for data at offset 0 - 9. Such buffer might be waiting in reassembly queue for a long time holding a reference to whole packet. To mitigate this we need to allow the QUIC stack to move data from packet buffers to stream buffers. The logic which decides when data should be moved from packet buffers is missing in this change. Here we just bring the code that supports improved buffer handling. The data for short stream frames/chunks (16B) are kept inside the stream chunk structure itself (this is referred as direct storage, or dstorage). The code coalesces data from adjacent stream frames into dstorage until it fill up. Once dstorage is full the new stream chunk is allocated and added to range. Larger stream chunks (size > 16B) get buffer from the heap. It is then linked to stream buffer. This commit just brings the quic_strm_reas.c in. It is not currently hooked to build. Fixes: CVE-2026-42772 Co-authored-by: Tomáš Mráz <[email protected]> Co-authored-by: Jakub Zelenka <[email protected]> Co-authored-by: Mounir IDRASSI <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Sat Sep 26 11:35:31 2026 Merged-from: https://github.com/openssl/openssl/pull/32038
* Re-format code after TypenameMacros and ForEachMacros additionsEugene Syromiatnikov2026-09-242-67/+67
| | | | | | | | | | | | | | | Re-formatting was done using the following command: for i in `git grep -l 'OSSL_LIST\|PRIORITY_QUEUE_OF\|SPARSE_ARRAY_OF' \ -- '*.c' '*.h' '*.c.in' '*.h.in'`; do \ clang-format-21 --style=file:.clang-format -i "$i"; \ done Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 24 09:01:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32304
* ML-KEM-512 hybrid TLS KEMsViktor Dukhovni2026-09-231-0/+2
| | | | | | | | | | Per the new codepoints assigned by IANA for draft-rosomakho-tls-ecdhe-mlkem512-00. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Mon Sep 21 11:52:03 2026 (Merged from https://github.com/openssl/openssl/pull/32670)
* DTLS: preserve outstanding flights after incomplete ACKsMounir IDRASSI2026-09-211-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not finish reading after a DTLS 1.3 ACK while sent records remain unacknowledged. Finishing reading stops the retransmit timer and clears the entire sent queue, even for an empty or partial ACK. Restore the preceding handshake state when ACK processing continues. This preserves application-data handling and allows the expected post-handshake authentication response to follow an incomplete ACK. Limit the ACK epoch restriction to the initial handshake. Subsequent sending and receiving epochs can differ, and the old restriction produced empty ACKs for repeated unilateral KeyUpdates. Those exchanges previously depended on the receive-side coverage bug to complete. Exercise empty, nonmatching, partial and duplicate ACKs on both peers, followed by application data and complete acknowledgement. Correct two existing KeyUpdate tests which relied on unrelated ACKs clearing the sent queue. The regression fails on the parent. All 15 selected DTLS and SSL recipes pass with --strict-warnings, including the default and FIPS SSL API runs. Fixes openssl#32853 Assisted-by: Codex:gpt-6-astra Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Merge-date: Mon Sep 21 09:48:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32854
* refcount: declare Windows CRYPTO_REF_COUNT as volatile longNikola Pajkovsky2026-09-211-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | _InterlockedExchangeAdd() is prototyped as LONG _InterlockedExchangeAdd(volatile LONG *, LONG) but CRYPTO_REF_COUNT held a volatile int. The MSVC branch passed &refcnt->val straight in, which does not compile: refcount.h(189): note: 'LONG _InterlockedExchangeAdd(volatile LONG *,LONG)': cannot convert argument 1 from 'volatile int *' to 'volatile LONG *' refcount.h(189): note: Types pointed to are unrelated Declare val as volatile long in both the __ICL/_WIN32 and the _MSC_VER variants and drop the cast, so the object type matches what the intrinsic operates on. Fixes: https://github.com/openssl/openssl/issues/21080 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Merge-date: Mon Sep 21 09:35:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32754
* rand: prevent recursive seed source constructionshin41412026-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Strict on-demand seed source construction can re-enter itself when the configured RAND requests entropy or a nonce through provider upcalls. This recursively constructs the same seed source until the process exhausts its stack. Track active construction by logical execution so true recursion fails with a RAND error while independent ASYNC jobs on the same thread and library context can proceed. Keep the guard active during provider lookup, context creation, and instantiation. Add regression coverage for clean strict failure, independent and paused ASYNC jobs, non-strict error propagation, and no-err builds. Fixes #32683 Assisted-by: Codex:gpt-5 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Sep 16 14:15:40 2026 Merged-from: https://github.com/openssl/openssl/pull/32685
* Dont have dgram_pairs track bios, track bio_dgram_pair_st insteadNeil Horman2026-09-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @ifanzki reported an asan issue with the quic_radix_test in: https://github.com/openssl/openssl/issues/32420 And we've tried fixing it a few different ways, with varying amounts of success This commit represents an alternative approach which I think is more general to the bio_dgram_pair bio type. The problem: We have a race condition as reported above in which freeing one side of a BIO dgram pair results in a use after free The root cause: BIO_new_bio_dgram_pair creates 2 dgram BIOS, each with a reference count of one (which is sensible, as each bio has a single owner). However, after creating the bios, it calls BIO_make_bio_pair(), which links the two together. Under the covers in the bio_dgram_pair implementation, each bio stores the pointer of its peer bio _without_ taking an additional reference on the bio. This means that, once the first bio is freed, the second bio may be doing subsequent io, which requires dereferencing of the peer bio , which is already release, leading to the use after free case observed. Nominally this isn't an issue, as most code that uses BIO_dgram_pairs are single threaded, and freeing of the component bios only occurs after any i/o is already terminated, avoiding the observed UAF. However, the QUIC radix test exercises the thread assisted mode of the quic stack, and in so doing passes each half of a bio dgram pair to a separate thread. The fix: Nominally we could resolve this by increasing the reference count on each of the peer bios, and dropping that ref count when each is freed, so that only the last to free actually deallocates both instances, but this creates a chicken and egg issue. Since the the stored reference to each bio lives in the dgram pair implementation, upping the refcount of the bios prevents either bio from ever reaching the implementation free code (dgram_pair_free) So instead I'm proposing the following in this commit: 1) Instead of having the internal bio data track the peer bio, instead have the internal data track a shared bio_dgram_peer_st structure which is reference counted 2) When creating a pair, the pair only uses the data (ring buffers, locks, etc), from the shared data, as its guaranteed to live until the last owner of the pair either frees itself BIO_free, or destroys the pair vi BIO_dgram_destroy_pair 3) If either side of the pair disconnects via the calls in (3), the shared data state is updated to reflect that, and the remaining peer triggers on that to get BROKEN_PIPE return codes Also added tests from @bukka, as they provide more coverage than the test I had in mind. Fixes #32420 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Fri Sep 11 20:50:58 2026 (Merged from https://github.com/openssl/openssl/pull/32498)
* ossl_store_register_loader_int(): refactor by extracting the macro ↵Dr. David von Oheimb2026-09-101-0/+8
| | | | | | | | | | OSSL_SKIP_SCHEME() Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 10 13:32:55 2026 (Merged from https://github.com/openssl/openssl/pull/27507)
* Copyright year updatesopenssl-machine2026-09-0940-40/+40
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* ktls_send_ctrl_message(): Fix parameter name from 'lengthi' to 'length'ohhyunjun2026-09-071-1/+1
| | | | | | | | | | | | | | | | | | | In include/internal/ktls.h, the variable/parameter lengthi is used in Kernel TLS (KTLS) helper declarations and macros, whereas all related functions across the codebase consistently use length. This naming inconsistency triggers static analysis warnings (including potential CWE-467 flags regarding parameter/pointer evaluation in macro expansions) and creates confusion during maintenance. The identifier lengthi appears to be an unintended typo introduced during the original KTLS interface definition. CLA: trivial Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Mon Sep 7 18:42:31 2026 Merged-from: https://github.com/openssl/openssl/pull/32568
* Add metadata support to EVP_SKEY objectsDmitry Belyavskiy2026-09-051-0/+9
| | | | | | | | | Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Sat Sep 5 17:06:55 2026 (Merged from https://github.com/openssl/openssl/pull/32644)
* quic: collect rejected incoming streams and return their stream creditJakub Zelenka2026-09-011-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | A stream rejected by the incoming stream policy is never placed on the accept queue, so it is never retired for the purposes of MAX_STREAMS RXFC and the peer is never granted credit for another stream. After the initial limit of 100 streams has been reached, the peer cannot open any further stream for the lifetime of the connection. Such a stream is also never garbage collected. Rejecting a stream resets its send part, which frees the send stream, and the acknowledgement handler skips a chunk whose send stream is already gone before it confirms the STOP_SENDING and RESET_STREAM frames. The stream therefore never records that its STOP_SENDING was acknowledged, never becomes ready for garbage collection and remains in the stream map until the connection is torn down. Confirm both frames even when the send stream has already been freed, and retire the stream for MAX_STREAMS RXFC when it is rejected. The two changes belong together: returning the stream credit on its own would replace a leak bounded by the stream limit with an unbounded one. Assisted-by: Claude:claude-fable-5 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:30:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32557
* QUIC: complete SSL_listen_ex() hierarchy adoptionMounir IDRASSI2026-09-012-1/+4
| | | | | | | | | | | | | | | | | | | | | Treat domain flags as a property of the QUIC object hierarchy so explicitly configured domains remain effective for listeners, accepted connections and their streams. Keep the queued channel in place until TLS attachment is committed, configure deferred qlog state before the channel runs, install the listener message callbacks, and reset the adopted shell to accepted-connection mode, blocking and event-handling defaults. Extend the public API regression to cover explicit-domain ancestry, differing context flags and modes, callback identity, stream inheritance, and listener lifetime. Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Tue Sep 1 14:19:18 2026 Merged-from: https://github.com/openssl/openssl/pull/32491
* QUIC: fix deferred SSL_listen_ex() connection adoptionMounir IDRASSI2026-09-012-2/+5
| | | | | | | | | | | | | | | | | | | | | SSL_listen_ex() could attach a deferred incoming channel without binding its QUIC TLS layer or fully adopting the caller-provided connection into the listener hierarchy. The resulting connection could not complete its handshake and retained stale port and ownership state. Keep deferred channels idle until TLS is attached, bind the handshake layer during peeloff, reparent the connection, and drain unpeeled deferred channels during listener teardown. Make the regression test require handshake completion and stream I/O. Fixes #32490 Assisted-by: Pi:Kimi-k3 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Merge-date: Tue Sep 1 14:19:16 2026 Merged-from: https://github.com/openssl/openssl/pull/32491
* Generate the error headers and tables at build timeBob Beck2026-09-012-89/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* rand: add seed_strict option enforcing the configured seed sourceJakub Zelenka2026-09-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a provider requests seeding material via the get_user_entropy or get_user_nonce core callbacks before the primary DRBG was created, the request silently falls back to the operating system entropy sources, because the seed source EVP_RAND_CTX only comes into existence as a side effect of creating the primary DRBG. Whether a configured seed source is used therefore depends on operation order: for example with the FIPS provider, genrsa happened to use the configured source while ecparam -genkey did not. This fallback is acceptable for most setups, but not when the seed source selection is meant to be a guarantee, for example for compliance reasons. Add a seed_strict option to the [random] configuration section which makes the callbacks instantiate the seed source on demand and turns an unusable seed source into an error rather than a silent fallback. The option is off by default with two exceptions: selecting the JITTER seed source, at runtime or at build time via -DOPENSSL_DEFAULT_SEED_SRC, seeds strictly unless the option disables it, and enable-fips-jitter builds always seed strictly. The boolean value parsing is shared with the provider section by factoring the existing parser out into ossl_conf_parse_bool(). A build time default property query can now be set with -DOPENSSL_DEFAULT_SEED_PROPQ. Add a regression test covering the on-demand creation and the no fallback behaviour on the strict provider seeding path, a test for the default non-strict fallback behaviour including the JITTER strictness default, and [random] seed configuration coverage in the rand config test recipe. Fixes #25941 Assisted-by: Claude:claude-fable-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 12:07:39 2026 Merged-from: https://github.com/openssl/openssl/pull/31939
* crypto: remove unused multiprime parameter helperPauli2026-09-011-5/+1
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* Don't strncpy() counted ASN1_STRING data in ossl_sk_ASN1_UTF8STRING2text()Bob Beck2026-08-271-0/+15
| | | | | | | | | | | | | | | | | | | | | The element data is counted, not a C string, so strncpy() was wrong two ways: an empty element yields strncpy(p, NULL, 0), which is undefined, and a value containing an embedded NUL was truncated and zero padded instead of copied verbatim. Use memcpy() bounded by the element length, skipping empty elements. The separator copy becomes a plain memcpy() as well, dropping the "+ 1 to silence gcc" strncpy() hack. The computed buffer length and terminator are unchanged. Note in the documentation that using utf8 values in C strings is a footgun if they contain NUL bytes internally Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:44 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Add a build target for MSVC 2013Bob Beck2026-08-262-4/+14
| | | | | | | | | | | | | | | Apparently it is desired to keep this on life support. So we add a build target for this non-C99 platform, and provide internal versions of snprintf and vsnprintf for use only on this platform that match the C99 semantics. This allows us to use C99 semantics normally elsewhere. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:04 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* DTLS 1.3 SSL Listener CAP pending connectionsRyan Hooper2026-08-251-0/+2
| | | | | | | | | | | | | | | | To prevent resource exhaustion we have to cap the number of pending connections. The default is 256 pending connections but there are APIs to configure the max number of pending connections. Fixes: openssl/project#1983 Fixes: openssl/project#2035 Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> MergeDate: Tue Aug 11 14:50:11 2026 (Merged from https://github.com/openssl/openssl/pull/31980)
* DTLS 1.3 Limit DTLSv1_listen to DTLS1.2 and add SSL Listener for DTLSRyan Hooper2026-08-258-61/+442
| | | | | | | | | | | | | | | | | | | DTLSv1_listen will not support DTLSv1.3. Instead its max version is DTLSv1.2 Adding DTLS SSL Listener that utilizes a similar DEMUX approach as QUIC and passes traffic through the URXE structure. This will establish full connection and an application can ask for a ready SSL connection. The DTLS SSL listener also supports HVR and HRR cookie validation. Fixes: openssl/project#1946 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Mon Jul 6 09:29:09 2026 (Merged from https://github.com/openssl/openssl/pull/31137)
* DTLS 1.3 Interop Issue with NSS using ChaCha20Ryan Hooper2026-08-251-1/+0
| | | | | | | | | | | | | | | When using ChaCha20 for DTLS1.3 the encrypted sequence number was never being decrypted properly. Instead it was always a larger number. Updated the dlts_crypt_sequence_number to match the RFC. Fixes: openssl/project#1929 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Apr 30 09:55:50 2026 (Merged from https://github.com/openssl/openssl/pull/30807)
* DTLS 1.3 Update Epoch to a 64 bit counter and don't allow wrappingRyan Hooper2026-08-251-3/+3
| | | | | | | | | | | | | | | This is based off a prior PR that was closed. The epoch was updated for a 64 bit counter. A 16 bit epoch is kept when we read the epoch from the wire in store it in the record layer. Fixes: openssl/project#1796 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Thu Mar 19 17:30:18 2026 (Merged from https://github.com/openssl/openssl/pull/30394)
* DTLS1.3 omits the Client sending the end of early data record.Ryan Hooper2026-08-251-0/+5
| | | | | | | | | | | | | Updated the state machine to not send the end of early data record. Also updated the dtls get more records to handle the scenario when in Epoch 1 we receive the client's Finish message in Epoch 2. Fixes: openssl/project#1701 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29449)
* Fixing comment out tests for DTLS1.3 in sslapitestRyan Hooper2026-08-251-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | Several tests where commented out for the behavior of DTLS1.3 is different then TLS1.3. The main difference is around the ACK message. This means some tests needed to be massaged to for the peer to ACK to a certain message. This PR does not remove all TODO's for DTLS1.3. Currently there are two TODOs. One around padding for messages less than 16 bytes and one for authentication and integrity only messages. Also this PR still has a lot of memory leaks. Looking into it it has to deal with how new record layers are allocated for new epochs. Because record layers are also stored in a list of messages sent in case they need to be resent it wasn't a simple fix. I feel like the memory leaks should be tackled in a separate PR. Fixes: https://github.com/openssl/project/issues/1667 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29067)
* Adds DTLS 1.3 ACK message functionalityFrederik Wedel-Heinen2026-08-253-1/+38
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25119)
* DTLS 1.3 record number encryptionFrederik Wedel-Heinen2026-08-251-0/+3
| | | | | | Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23511)
* Place start of ClientHello correctly when calculating binder for DTLS 1.3Frederik Wedel-Heinen2026-08-252-0/+16
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24426)
* Avoid double free of qrx in port_default_packet_handler()Alexandr Nedvedicky2026-08-241-2/+9
| | | | | | | | | | | | | | | | | | | | port_default_packet_handler() may perform double free of qrx when channel creation fails. The port_default_packet_handler() transfers ownership of qrx to channel/connection via call to port_bind_channel(). The port_bind_channel() however may release the qrx when channel can not be bound. The error is then detected in port_default_packet_handler() which then agains releases qrx for the second time. The fix is to add a reference counter to QRX object so transfer of ownership between port_default_packet_handler() and QUIC_CHANNEL can be handled safely. Fixes CVE-2026-18798 Reviewed-by: Igor Ustinov <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Mon Aug 24 15:46:13 2026
* Don't store ACK-only frames in TX history for QUIC.Neil Horman2026-08-241-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When QUIC sends an ACK-only frame, there is no expectation that the peer will ack that ack (i.e. it is itself not ack-eliciting). However, our implementation stores these frames in the TX history regardless. In and of itself thats ok, but if a malicious client establishes a connection, and then drives the connection such that ack-only frames are forced from the peer (i.e. by sending numerous ping frames), and then withholding any subseqent acks for ack-eliciting data, like legitimate data, said malicious client can force inappropriate memory growth on the server, leading to potential DOS attacks. Don't store any ACK-only frames in the TX history to address this. Record it in our TX history so that the send window moves forward appropriately, but for ack-only frames, immediately remove it, since we don't expect to get an ack for them anyway. Initially authored by Opal Wright <[email protected]> The initial proposal had some shortcommings in which the highest pn acked value was not accounted for which I have fixed with the assistance of Claude Assisted-by: Anthopic Sonnet 5 Fixes CVE-2026-63075 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Mon Aug 24 12:07:51 2026
* test/quicapitest.c: add test for pending connections limit enforcementAlexandr Nedvedicky2026-08-121-0/+1
| | | | | | | | | | This is a regression test for CVE-2026-14456. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Wed Aug 12 15:00:30 2026 (Merged from https://github.com/openssl/openssl/pull/32052)
* QUIC server: limit number of pending QUIC channels/connectionsAlexandr Nedvedicky2026-08-121-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Currently, there is no limit for pending QUIC connections. The port default packet handler creates channel for every valid initial packet which does belong to existing channel (a.k.a. connection). The newly created channel is inserted to list of pending channels where it waits to be accepted by local application by call to SSL_accept_connection(3ossl). This change introduces a limit for pending connection. The pending queue is limited to 256 pending connections. Applications may change the limit by calling SSL_set_feature_request_uint(3ossl) on SSL server listener object with configurable value SSL_VALUE_QUIC_MAX_PENDING_CONNS. Fixes: CVE-2026-14456 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Wed Aug 12 15:00:25 2026 (Merged from https://github.com/openssl/openssl/pull/32052)
* Add a red-black tree implementationAlexandr Nedvedicky2026-08-111-0/+265
| | | | | | | | | | | | | | | | | | | | | | | | | The code comes from David Gwynne <[email protected]>. The same implmentation can be found in OpenBSD. Several minor adjustments have been done to include the code into OpenSSL: * the prefix has been changed to OSSL_RBT_, * the support augment is removed, * _RBT_CHECK()/_RBT_POISON() got removed too, * _RB_REMOVE() resets link pointer to NULL in debug build, The documentation is based on tree(3) from OpenBSD, originally authored by Niels Provos <[email protected]>. Co-Authoerd-by: David Gwynne <[email protected]> Co-Authored-by: Niels Provos <[email protected]> Co-Authored-by: Andrew Dinh <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Aug 11 19:15:59 2026 (Merged from https://github.com/openssl/openssl/pull/32033)
* Add ossl_list_TYPE_join(head, tail) functionAlexandr Nedvedicky2026-08-061-0/+29
| | | | | | | | | | | The function appends list tail to list head. List tail becomes empty after the function returns. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Aug 6 11:57:39 2026 (Merged from https://github.com/openssl/openssl/pull/32031)
* quic: use @-style Doxygen tags in ossl_quic_srtm_remove doc commentNikola Pajkovsky2026-08-031-6/+6
| | | | | | | | | | | | | | | Convert the doc comment for ossl_quic_srtm_remove() from backslash-style Doxygen tags (\brief, \param, \return) to the @-style equivalents (@brief, @param, @returns), matching the STYLE.md convention. Complements: 63afe639141f "quic: report SRTM entry match status via an output argument" Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Aug 3 12:03:18 2026 (Merged from https://github.com/openssl/openssl/pull/32037)
* Remove remaining atoi()/atol() callsMounir IDRASSI2026-07-291-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the remaining direct atoi()/atol() uses across apps, libcrypto, libssl, providers, demos and tests, and route the replacements through checked helpers instead of open-coding the conversion at each call site: - apps use the existing opt_int()/opt_long()/opt_int_arg() parsers; - libcrypto and provider code use the new internal ossl_strtol()/ ossl_strtoint() helpers, a checked (and, for ossl_strtoint(), narrowing) signed counterpart to the public OPENSSL_strtoul(); - libssl, demos and tests use OPENSSL_strtoul(); the test code shares a single test_strtoint() helper rather than repeating the bound check and cast per file; - unsigned values use OPENSSL_strtoul(), with call-site-specific range checks before narrowing where the destination type requires it. Reject conversion failures and narrow through the helpers rather than acting on garbage, and preserve the signed RSA-PSS saltlen sentinels while rejecting invalid numeric strings. Add regression coverage for the invalid RSA-PSS saltlen string path. Fixes #8216 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 29 17:02:18 2026 (Merged from https://github.com/openssl/openssl/pull/31731)
* quic: report SRTM entry match status via an output argumentNikola Pajkovsky2026-07-211-4/+16
| | | | | | | | | | | | | | | | | | | | | | Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value could not be usefully checked because 0 was overloaded to mean both "no matching entry" and a genuine internal failure (alloc_failed or an lhash consistency error). Give the return value a single meaning (1 on success, 0 on internal error) and report whether a matching entry was found through a new uint8_t *match output argument, which may be NULL if the caller does not need it. Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jul 21 09:24:45 2026 (Merged from https://github.com/openssl/openssl/pull/31974)
* Make sure we always check return of CRYPTO_UP_REF which can fail.Frederik Wedel-Heinen2026-07-201-14/+16
| | | | | | | Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)
* ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integrationMarcel Cornu2026-07-131-0/+71
| | | | | | | | | | | | | | | | | | | | | | Changes: - Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported. - Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl). - Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules. - Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable. Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending on the build and CPU capabilities. - Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc, included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined. Co-authored-by: Tomasz Kantecki <[email protected]> Signed-off-by: Marcel Cornu <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Mon Jul 13 15:55:54 2026 (Merged from https://github.com/openssl/openssl/pull/31090)
* Fix typosDimitri Papadopoulos2026-07-084-4/+4
| | | | | | | | | | | | | | | | Found by typos[1]. [1] https://github.com/crate-ci/typos CLA: trivial Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:46:01 2026 (Merged from https://github.com/openssl/openssl/pull/31858)
generated by cgit (git 2.51.2) at 2026-10-25 15:08:58 +0100