| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Comments added by AI-assisted commits over the last three months
often narrate the change rather than describe the code: the
behaviour being replaced, the alternative not taken, or the bug the
test was written for. STYLE.md now says that a comment states what
the code does and the constraint it satisfies, and that the
reasoning behind a change does not belong in one.
Reword those comments to that standard.
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Merge-date: Fri Oct 2 08:06:12 2026
Merged-from: https://github.com/openssl/openssl/pull/32779
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Keep listener drive guards and the RX queue alias in SSL_CONNECTION so
concurrent listener threads do not access resettable DTLS state during
SSL_clear(). Check stable state before d1 and clear the RX alias before
freeing its queue.
Add focused multithreaded coverage for both SSL_clear() paths and run
the race tests in ThreadSanitizer CI.
Incorporates changes from #32962.
Fixes #32948
Fixes #32949
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Ryan Hooper <[email protected]>
Merge-date: Tue Sep 29 16:24:45 2026
Merged-from: https://github.com/openssl/openssl/pull/32964
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
setup_tests() read its two positional arguments without first calling
test_skip_common_options(), so the option cursor was never advanced from
the test's point of view and test_get_argument(0) returned the option
itself. Passing -test or -iter therefore left the certificate path set to
the literal string "-test", and the run failed on that:
error:80000002:system library:file_ctrl:No such file or directory:
...:calling fopen(-test, r)
The option was not being ignored: the framework parses it in
process_shared_options() and the selected sub-test really does run. Only
the positional arguments were shifted, which is what made the failure
look unrelated to the option.
Also declare the usage string, so -help describes the two arguments the
test needs rather than showing none.
Assisted-by: Claude Code:claude-opus-5
Reviewed-by: Ryan Hooper <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Merge-date: Mon Aug 17 08:36:26 2026
Merged-from: https://github.com/openssl/openssl/pull/32331
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A connection created by a DTLS listener has no BIO of its own. The
listener owns the socket and demultiplexes datagrams into a per
connection queue, so there is nothing for a read to block in, and every
read on an empty queue reported WANT_READ however the connection was
configured. SSL_set_blocking_mode() therefore had no effect on reads.
Wait in the record layer instead, where a blocking BIO would have. When
rlayer_dtls_get_urxe_packet() finds the queue empty and the connection is
in blocking mode, ossl_dtls_conn_wait_for_datagram() waits for one to
arrive. The state machine above is untouched, so SSL_read(), SSL_peek(),
SSL_do_handshake() and SSL_accept() all become blocking together, which
is what an application moving from a plain DTLS object expects.
The wait loops, because the socket is shared: a wakeup may be for a
datagram belonging to a different connection, in which case our queue is
still empty and there is nothing to return. It also handles events after
each wakeup, since while a thread is in here nothing else services the
connection, and the retransmission timer has to keep running - the poll
translation folds the event timeout into the deadline so the wait ends in
time for it.
Existing tests drive both ends of a connection from a single thread,
which cannot work if the server side blocks, so create_dtls_listener() in
dtlsssllistenertest.c now turns blocking mode off for its callers, with
create_dtls_listener_unconfigured() for the one test which has to observe
the default. test_dtls_multithread opts out for the same reason.
The new test_dtls_blocking_read has the client stay silent for a while
after its handshake, so the server thread is already parked in
SSL_read_ex() when the write finally comes. Its second iteration
handshakes in non-blocking mode and switches to blocking only for the
read, which pins the read path on its own: in the first iteration the
handshake is what fails without this change, and the read is never
reached.
Assisted-by: Claude Code:claude-opus-5
Reviewed-by: Ryan Hooper <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Merge-date: Mon Aug 17 08:29:57 2026
Merged-from: https://github.com/openssl/openssl/pull/32324
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSL_accept_connection() looped calling ossl_dtls_tick() with nothing in
between, so it only avoided spinning if the application supplied a
blocking network BIO and each tick slept inside BIO_recvmmsg().
A listener cannot require that. It demultiplexes one socket to many
connections and ossl_dgram_demux_pump() holds the demux lock across the
receive, so a thread blocked in accept stalls reads on every established
connection until a datagram for any peer arrives. QUIC takes the
opposite approach, keeping the socket non-blocking and waiting for
readiness instead.
Do the same: set the listener's network BIO non-blocking and wait
between ticks via ossl_dtls_block_until_ready(), which reuses
SSL_poll()'s blocking machinery. It reads nothing out, so the caller
re-tests its own condition and waits again if the wakeup was not for it.
Assisted-by: Claude Code:claude-opus-5
Reviewed-by: Ryan Hooper <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Merge-date: Mon Aug 17 08:29:51 2026
Merged-from: https://github.com/openssl/openssl/pull/32324
|
|
|
DTLSv1_listen will not support DTLSv1.3. Instead its max version is
DTLSv1.2
Adding DTLS SSL Listener that utilizes a similar DEMUX approach as
QUIC and passes traffic through the URXE structure.
This will establish full connection and an application can ask for
a ready SSL connection. The DTLS SSL listener also supports HVR
and HRR cookie validation.
Fixes: openssl/project#1946
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Mon Jul 6 09:29:09 2026
(Merged from https://github.com/openssl/openssl/pull/31137)
|
