5277 Commits

Author	SHA1	Message	Date
openssl-machine	486805eb19	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-30 13:03:21 +00:00
Tomas Mraz	224506e7c5	ossl_quic_conn_stream_conclude(): Fixup the quic_unlock() call name ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28651) (cherry picked from commit caf629215f)	2025-09-24 15:11:08 +02:00
Neil Horman	a343b64af4	Close small race condition on error raising in QUIC ... Github issue #28501 reported an odd condition in which a double free was occuring when a given thread was popping entries of its error stack. It was hypothesized that, because a few places in the quic stack save error state to a shared structure (ch->err_state, port->error_state, qtls->error_state), that multiple threads may attempt to mutate the shared structure during error save/restore in parallel. Investigation showed that all paths which led to such mutations were done under lock, so that shouldn't occur. Except for one case, which this PR addresses. In ossl_quic_conn_stream_conclude, we unlock our protecting mutex, prior to calling QUIC_RAISE_NON_NORMAL_ERROR. If that function is called with an reason code of SHUTDOWN, it attempts to restore the channel error state. Given that the lock was released first, this creates a small race condition in which two threads may manipulate the shared error state in the channel struct in parallel. According to the reporter, applying this patch prevents the reported error from occuring again. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28642) (cherry picked from commit 1e70e8080a)	2025-09-24 12:22:09 +02:00
Tomas Mraz	2951dcb41f	tls_common.c: Handle inner content type properly on Big Endian ... When passing the inner content type to msg_callback, the lowest byte of rec->type needs to be passed instead of directly passing the rec->type otherwise the value is incorrect on Big Endian platforms. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28627) (cherry picked from commit 2edf021463)	2025-09-23 16:40:49 +02:00
Nachel72	35d9fd1090	Fix: Check for wrong object. The converted sc should be checked instead of the original s ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/28248) (cherry picked from commit bc28ca499e) (cherry picked from commit 7e8d78d579) (cherry picked from commit 66f7afbb98)	2025-08-22 11:15:19 -04:00
Niels Dossche	bb0ea01938	Fix reallocation failure condition in qtx_resize_txe() ... Returning the same pointer does not mean that the reallocation failed, it would also prevent updating alloc_len down below. This is similar code and a similar change to 043a41ddee. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28317) (cherry picked from commit 220f5be690)	2025-08-22 09:26:43 -04:00
Alexandr Nedvedicky	33e316ab64	- adding a missing file ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit d777deffba)	2025-07-27 05:02:25 -04:00
sashan	8a9896cecd	- fix RFC reference and indentation ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit a43b926fd2)	2025-07-27 05:02:22 -04:00
Sashan	536585286e	Update ssl/quic/quic_ackm.c ... Co-authored-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit b083613476)	2025-07-27 05:02:21 -04:00
Sashan	2b3c9487e7	Update ssl/quic/quic_ackm.c ... Co-authored-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit 4a3c954a0c)	2025-07-27 05:02:20 -04:00
sashan	829fb6be61	ACK manager must avoid infinite probe time when waiting handshake confirmation ... According to RFC 9002, section 6.2.2.1 the client the client must keep PTO (probe time out) armed if it has not seen HANDSHAKE_DONE quic message from server. Not following RFC spec here may cause the QUIC session to stale during TLS handshake. Fixes openssl/project#1266 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023) (cherry picked from commit cdbfacead0)	2025-07-27 05:02:19 -04:00
Alexandr Nedvedicky	07c2097221	QUIC receiver may accidentally ACK packet it fails to process ... we set ok to -1 as we enter ossl_quic_handle_frames(). If we set ok to 0 here we effectively assume successful processing of all frames found in packet. We do this just before we return from function: ``` 1479 1480 /* Now that special cases are out of the way, parse frames */ 1481 if (!PACKET_buf_init(&pkt, qpacket->hdr->data, qpacket->hdr->len) 1482 || !depack_process_frames(ch, &pkt, qpacket, 1483 enc_level, 1484 qpacket->time, 1485 &ackm_data)) 1486 goto end; 1487 1488 ok = 1; 1489 end: 1490 /* 1491 * ASSUMPTION: If this function is called at all, |qpacket| is 1492 * a legitimate packet, even if its contents aren't. 1493 * Therefore, we call ossl_ackm_on_rx_packet() unconditionally, as long as 1494 * |ackm_data| has at least been initialized. 1495 */ 1496 if (ok >= 0) 1497 ossl_ackm_on_rx_packet(ch->ackm, &ackm_data); 1498 1499 return ok > 0; ``` if the call to `depack_process_frames()` at line 1492 fails, because barticualr frame in packet is corrupted/invalid we take a branch to `end:` goto target. In this case we must avoid the call to `ossl_ackm_on_rx_packet()`. Packet with malformed/invalid frame must not be accepted. See RFC 9000 section 13.1: Once the packet has been fully processed, a receiver acknowledges receipt by sending one or more ACK frames containing the packet number of the received packet. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28002) (cherry picked from commit e6c20588ef)	2025-07-10 12:06:34 +02:00
openssl-machine	e9d98629ed	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 12:04:53 +00:00
noctuelles	7bd5c27a8b	fix: msg callback in dtls1_do_write that incorrectly shows message (like a certificate) that spans over multiple fragments. ... Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27811) (cherry picked from commit de5a619aa0)	2025-06-30 11:25:59 +01:00
Matt Caswell	d86a758bf1	Ensure we pass the user SSL object for the SSL_set_verify callback ... When calling the verify callback we need to ensure we supply the user SSL object, and not any internal SSL object. Fixes #27830 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27848) (cherry picked from commit 3695409c4c)	2025-06-19 14:06:57 +01:00
yexiaochuan	cef0c0b348	fix: add parsing check in TLS compress_certificate extension handler ... The tls_parse_compress_certificate function was missing validation for trailing bytes after parsing the algorithm list, violating RFC8446 section 4.2 which requires sending a decode_error alert for unparseable messages. This commit adds a check for remaining bytes in the packet after the while loop and sends SSL_AD_DECODE_ERROR if any trailing bytes are found. Fixes #27717 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27733) (cherry picked from commit 8e787b1028)	2025-06-10 19:40:10 +02:00
Matt Caswell	1e2ed8e224	Fix DTLS handling when receiving a no_renegotiation alert ... no_renegotiation is a warning alert sent from the server when it is not prepared to accept a renegotiation attempt. In TLS we abort the connection when we receive one of these - which is a reasonable response. However, in DTLS we incorrectly ignore this and keep trying to renegotiate. We bring the DTLS handling of a no_renegotiation alert into line with how TLS handles this. In versions prior to 3.2 handling of a warning alert in DTLS was mishandled resulting in a failure of the connection, which ends up being the right thing to do "by accident" in the case of "no_renegotiation". From 3.2 this mishandling was fixed, but exposed this latent bug. Fixes #27419 Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27591) (cherry picked from commit e5feca0659)	2025-06-04 17:29:34 +02:00
Norbert Pocs	8e63e4b42b	s3_lib.c: Use illegal_parameter for failing encapsulation in ml_kem ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27627) (cherry picked from commit e66097fc66)	2025-05-16 11:11:39 +02:00
Norbert Pocs	296525c5a9	s3_lib.c: Handle weak x keys as illegal_parameter alert ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27597) (cherry picked from commit 5da4ea10be)	2025-05-15 10:49:26 +02:00
Matt Caswell	e431af11ff	Stop a TLSv1.3 server emitting an unsolicited PSK extension ... If we attempt to accept a connection on an SSL object, and the application has set an SSL_SESSION on that SSL object then we can mistakenly believe that we are resuming and emit an unsolicited PSK extension back to the client. This can especially happen when using SSL_clear() which leaves any SSL_SESSION associated with the SSL object. See https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352 and https://github.com/openssl/openssl/discussions/24567 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27584) (cherry picked from commit aa8bca2e81)	2025-05-13 14:13:06 +02:00
Matt Caswell	241534d75a	Add a test for app data received too early ... Add a test for app data which was received prior to the Finished is read correctly, and that if we continue to read we get the expected result. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543) (cherry picked from commit af712a5933) (cherry picked from commit dc95aff539)	2025-05-08 14:19:36 -04:00
Matt Caswell	da07ea6712	Ensure we properly release DTLS buffered app data records ... If we read an app data record before we have read the Finished we buffer it. Once we've read it we need to make sure we've properly released it otherwise we will attempt to read it again (and this time there will be no data in it). Fixes #27316 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543) (cherry picked from commit d459d00f97) (cherry picked from commit 448815dd26)	2025-05-08 14:19:34 -04:00
Matt Caswell	00331d8167	Drop empty app data records in DTLS ... App data records with 0 bytes of payload will confuse callers of SSL_read(). This will cause a successful read and return 0 bytes as read. Unfortunately a 0 return from SSL_read() is considered a failure response. A subsequent call to SSL_get_error() will then give the wrong result. Zero length app data records are actually allowed by the spec, but have never been handled correctly by OpenSSL. We already disallow creating such empty app data records. Since the SSL_read() API does not have a good way to handle this type of read, we simply ignore them. Partial fix for #27316 Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27541) (cherry picked from commit a23d5e20f1)	2025-05-07 14:37:07 +02:00
Anton Tieleman	3703a5c499	Test+fix handling "wrong" downgrade signals ... This accounts for cases that can only occur when een non-compliant server sends the wrong downgrade signal. (TLS1.1 signal when negotiating TLS1.2 or TLS1.2 signal when negotiating TLS1.0/TLS1.1). According to the TLS1.3 RFC these cases should be rejected: RFC8446, section 4.1.3: TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are not equal to the second value if the ServerHello indicates TLS 1.1 or below. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27518) (cherry picked from commit 290fd4a0c8)	2025-04-29 19:32:32 +02:00
Andrey Tsygunka	3d371de578	Fix potential NULL pointer dereference in final_maxfragmentlen() ... In the final_maxfragmentlen() function, s->session is checked for NULL after it was dereferenced earlier. So move this NULL check to the top of the function. CLA: trivial Fixes: fa49560451 (Fix handling of max_fragment_length extension for PSK) Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27272) (cherry picked from commit 28de1f5004)	2025-04-14 15:57:53 +01:00
Graham Leggett	69272362bd	ssl/ssl_lib.c: Avoid crash when SSL_CONNECTION is NULL ... Detection for sc == NULL is performed after sc is used. Add the check to the correct place. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27241) (cherry picked from commit 7f6cc862c6)	2025-04-14 15:41:28 +01:00
Benjamin Kaduk	6db6c61131	statem: always save sigalgs during PHA ... We use the same extension-parsing function on server and client for convenience, but while the server might worry about tracking what was previously received and not overwriting it, on the client receiving a request for post-handshake authentication, we always want to use the values from the current extension (and should always have a new session object that we are free to mutate). It is somewhat unclear whether the server also needs the check for a resumed connection; it appears to have been added back in 2015 in commit 062178678f as part of a broad pass to handle extensions on resumption, but without specific documentation of each extension's handling. Fixes: #10370 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24651) (cherry picked from commit ddd99d52d3)	2025-04-01 15:12:03 +02:00
jay9827342	00af1ac1fa	Memory leak fix ktls_meth.c ... The OSSL_RECORD_LAYER needs to be properly freed when return code isnt success. Memory leak fix CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27111) (cherry picked from commit e5e4cf41c7)	2025-03-25 20:23:12 +01:00
Neil Horman	c932099d8f	Change cipher suite alert for 0 length cipher_suites ... From RFC 8446: Note: TLS defines two generic alerts (see Section 6) to use upon failure to parse a message. Peers which receive a message which cannot be parsed according to the syntax (e.g., have a length extending beyond the message boundary or contain an out-of-range length) MUST terminate the connection with a "decode_error" alert. Peers which receive a message which is syntactically correct but semantically invalid (e.g., a DHE share of p - 1, or an invalid enum) MUST terminate the connection with an "illegal_parameter" alert. A zero length cipher suite list I think is considered out of range, and so we should return "decode_error" rather than "illegal_parameter" Fixes #25309 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26781) (cherry picked from commit 2ce46ad8ce)	2025-02-25 16:00:26 -05:00
Alexandr Nedvedicky	b4be505af3	Fix read out of buffer bounds when dealing with BIO_ADDR ... This issue was discoevered while I was testing SSL_new_from_listener() using a newly created unit test. It has turned out the QUIC stack at few places contain pattern as follows: foo(QUIC_WHATEVER *q, BIO_ADDR *a) { q->a = *a; } The problem is that derefencning a that way is risky. If the address `a` comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR). Using BIO_ADDR_copy() is the right thing to do here. Fixes #26241 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26252) (cherry picked from commit 395a83a617)	2025-02-25 15:56:43 +01:00
Tomas Mraz	f2d37f0a2d	add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error ... Fixes #26480 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26511) (cherry picked from commit be5965acad)	2025-02-25 15:51:12 +01:00
Matt Caswell	c84ec04acd	Fix configuring provider certificate algs via config file ... A crash could occur when attempting to configure a certificate via a config file, where the algorithm for the certificate key was added dynamically via a provider. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26663) (cherry picked from commit 9cbaa8763c)	2025-02-11 17:42:13 +00:00
Viktor Dukhovni	771c17ec09	Avoid calling ssl_load_sigalgs in tls1_set_sigalgs_list ... - The signature algorithms are already loaded in SSL_CTX_new() - Calling ssl_load_sigalgs() again is non-productive, and does not look thread safe. - And of course avoiding the call is cheaper. - Also fix broken loop test in ssl_cert_lookup_by_pkey() Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26671) (cherry picked from commit 3252fe646b)	2025-02-12 03:38:32 +11:00
openssl-machine	45e2b27630	Copyright year updates ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-02-11 14:36:52 +00:00
Viktor Dukhovni	b0bbd22a46	Use ERR marks also when verifying server X.509 certs ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (cherry picked from commit 3908f0dda6)	2025-02-11 08:48:50 -05:00
Viktor Dukhovni	798779d434	With SSL_VERIFY_PEER client RPK should abort on X509 error ... While RPK performs X.509 checks correctly, at the SSL layer the SSL_VERIFY_PEER flag was not honoured and connections were allowed to complete even when the server was not verified. The client can of course determine this by calling SSL_get_verify_result(), but some may not know to do this. Added tests to make sure this does not regress. Fixes CVE-2024-12797 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (cherry picked from commit 87ebd203fe)	2025-02-11 08:48:44 -05:00
Tomas Mraz	4b5279de0f	Revert "use-of-uninitialized-value in quic_tserver_test" ... This reverts commit c2979a6f50. This struct member is not present in the 3.2 branch code. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26329)	2025-01-06 21:04:54 +01:00
Bernd Edlinger	c2979a6f50	use-of-uninitialized-value in quic_tserver_test ... Fixes #26277 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26269) (cherry picked from commit 9861be4eef)	2025-01-06 20:51:39 +01:00
cx	5e13f9624f	Reject invalid FFDHE and ECDHE key shares with SSL_AD_ILLEGAL_PARAMETER alert ... This changes the alert according to RFC 8446. Fixes: #25402 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25547) (cherry picked from commit 0f6caf7409)	2025-01-02 14:17:07 +01:00
Neil Horman	4e581b0318	Fix potential use-after-free in REF_PRINT_COUNT ... We use REF_PRINT_COUNT to dump out the value of various reference counters in our code However, we commonly use this macro after an increment or decrement. On increment its fine, but on decrement its not, because the macro dereferences the object holding the counter value, which may be freed by another thread, as we've given up our ref count to it prior to using the macro. The rule is that we can't reference memory for an object once we've released our reference, so lets fix this by altering REF_PRINT_COUNT to accept the value returned by CRYPTO_[UP|DOWN]_REF instead. The eliminates the need to dereference the memory the object points to an allows us to use the call after we release our reference count Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25664) (cherry picked from commit dc10ffc283)	2024-12-10 14:59:14 +01:00
Neil Horman	da69041a1e	Fix SSL_write_[ex|ex2] on blocking quic streams ... When writing to a blocking quic stream, we sometimes get duplicate transmitted data. This occurs when a call to quic_write_blocking has to wait for space to become available in the ring buffer. When we do a wait, the call sets *written to the value returned in args.total_written as filled out by the calls to block_until_pred->quic_write_again. However, the value there is based on the amount we requested, which is only the remaining data that we didn't append in xso_sstream_write. So if we call quic_write_blocking with a buffer of length X, and initially append Y bytes, and write the remainig X-Y bytes via a block_until_pred call, then *written will return with the value X-Y, even though we wrote the full X bytes to the ring buffer. Fix it by recording the initial amount appended into *written, and then add the args.total_written value if we have to wait on more space Fixes openssl/project#924 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26023) (cherry picked from commit 2de7e1d698)	2024-11-21 16:04:27 +01:00
Matt Caswell	34f24d9020	Make sure we use the correct SSL object when making a callback ... When processing a callback within libssl that applies to TLS the original SSL object may have been created for TLS directly, or for QUIC. When making the callback we must make sure that we use the correct SSL object. In the case of QUIC we must not use the internal only SSL object. Fixes #25788 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25932)	2024-11-13 17:35:49 +01:00
Matt Caswell	34b90ec454	Keep hold of a reference to the user SSL in QUIC ... In some cases a QUIC SSL_CONNECTION object needs to get hold of a reference to the original SSL object as created by the user. We should keep a reference to it. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25932)	2024-11-13 17:35:49 +01:00
Neil Horman	f48cf6dfde	Fix SSL_stream_reset for stream objects which have FIN bit set ... When calling SSL_stream_reset on a QUIC stream object that has received all data that is expected to be sent (i.e. when the sender has sent a STREAM frame with the FIN bit set), we encounter the following segfault: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273 273 if (!qss->have_final_size) (gdb) bt 0) 0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273 1) 0x00007ffff7ef65bf in quic_validate_for_write (xso=0x5555555efcb0, err=0x7fffffffd5e0) at ssl/quic/quic_impl.c:2513 2) 0x00007ffff7ef8ae3 in ossl_quic_stream_reset (ssl=0x5555555efcb0, args=0x0, args_len=0) at ssl/quic/quic_impl.c:3657 3) 0x00007ffff7ebdaa6 in SSL_stream_reset (s=0x5555555efcb0, args=0x0, args_len=0) at ssl/ssl_lib.c:7635 4) 0x0000555555557527 in build_request_set ( req_list=0x55555555ebd0 "neil1.txt neil2.txt neil3.txt neil4.txt neil5.txt neil6.txt neil7.txt neil8.txt neil9.txt neil10.txt neil11.txt neil12.txt neil13.txt neil14.txt neil15.txt neil16.txt neil17.txt neil18.txt neil19.txt "..., ssl=0x5555555b6f80) at demos/guide/quic-hq-interop.c:545 5) 0x00005555555587b2 in main (argc=4, argv=0x7fffffffe568) at demos/guide/quic-hq-interop.c:941 This occurs because: 1) When the stream FIN bit is set, the quic stack frees the underlying stream structures immediately within the QUIC stack and 2) when SSL_stream_reset is called, the call stack indicates we call quic_validate_for_write, which attempts to access the xso->stream->sstream QUIC_SSTREAM object, which was already freed in (1) The fix I think is pretty straightforward. On receipt of a STREAM frame with a FIN bit set, the QUIC stack sets the QUIC_STREAM object state to QUIC_SSTREAM_STATE_DATA_RECVD, which means we can use that state to simply assert that the stream is valid for write, which allows it to be reset properly. Fixes #25410 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25910) (cherry picked from commit bbfffbcaf3)	2024-11-13 11:06:07 -05:00
Tomas Mraz	ec9acf1ec6	txp_generate_stream_frames(): Set stream id in header early enough ... Otherwise we will calculate an incorrect header size for higher stream ids and won't fit the frame into the packet. Fixes #25417 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25928) (cherry picked from commit ba6f115ccf)	2024-11-12 16:57:45 +01:00
Matt Caswell	39bcf50932	Don't complain with "no cipher match" for QUIC objects ... Calling the functions SSL_CTX_set_cipher_list() or SSL_set_cipher_list() will return the error "no cipher match" if no TLSv1.2 (or below) ciphers are enabled after calling them. However this is normal behaviour for QUIC objects which do not support TLSv1.2 ciphers. Therefore we should suppress that error in this case. Fixes #25878 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25886) (cherry picked from commit 40237bf97a)	2024-11-08 14:36:48 +01:00
Todd Short	01c3a21c04	Use correct alerts for some cert comp errors ... Fixes #25471 Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25845) (cherry picked from commit a590a7e3bc)	2024-11-04 11:51:12 +01:00
Frederik Wedel-Heinen	854502c8c1	tls_common.c: Align the calculation of maximal alignment value ... In tls_setup_write_buffer() and tls_setup_read_buffer() the calculation is different. Make them the same. Fixes #25746 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25764) (cherry picked from commit fc0e79461f)	2024-10-24 15:26:24 +02:00
Niels Dossche	78ef2bcb0d	Fix memory leaks in ossl_quic_calculate_retry_integrity_tag() ... Fixes #25625 Several error paths return 0 directly instead of going to err to clean up the objects. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25636) (cherry picked from commit e8d963594f)	2024-10-23 15:15:01 +02:00
Niels Dossche	32f06c55aa	Fix memory leak in tls_parse_ctos_psk() ... `sess` is not NULL at this point, and is freed on the success path, but not on the error path. Fix this by going to the `err` label such that `SSL_SESSION_free(sess)` is called. CLA: trivial Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25643) (cherry picked from commit b2474b287f)	2024-10-11 14:54:32 +02:00