98 Commits

Author	SHA1	Message	Date
Gustaf Neumann	beec4e146a	Add SSL_get_peer_addr() function to query peer address for QUIC ... This change introduces a new public API symbol: SSL_get_peer_addr(). The change is QUIC-only, there are no changes for TLS connections - API: add peer address query for QUIC connections * Internal: declare/implement ossl_quic_get_peer_addr(SSL*, BIO_ADDR*) * Public: declare/implement SSL_get_peer_addr(SSL*, BIO_ADDR*) Rationale: - Allow applications to retrieve the remote UDP tuple for QUIC sessions (e.g., logging, access control, diagnostics) Provided documentation and test cases for SSL_get_peer_addr(). Set peer via channel API on new-conn. - In ch_on_new_conn_common(), BIO_ADDR_copy(&ch->cur_peer_addr, peer) was replaced with ossl_quic_channel_set_peer_addr(ch, peer) so addressed_mode is enabled at connection bring-up. Dropped redundant peer detection in create_qc_from_incoming_conn() The peer address is now propagated in ch_on_new_conn_common() via ossl_quic_channel_set_peer_addr(), so the channel is already in "addressed" mode. This also avoids querying the (unconnected) server UDP BIO, reduces duplication, and simplifies the accept path. All regression tests pass. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28690)	2025-10-04 10:21:38 +02:00
Ryan Hooper	f2a41c74ae	Updated SSL Trace to display the name for all MLKEM-based groups ... Make SSL Trace to display the name of the MLKEM512, MLKEM768, MLKEM1024 and SecP384r1MLKEM1024 groups. Fixes #28476 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28499)	2025-09-18 17:27:29 +02:00
Norbert Pocs	605eda60ae	quicapitest: Check if we can handle HRR ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28115)	2025-08-07 13:16:25 -04:00
Matt Caswell	ac6178c3f1	Fix some conversion from size_t to const int errors ... When #27806 was merged these fixes were missed Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27960)	2025-07-03 15:41:01 +01:00
Andrew Dinh	e8d6e0460b	Extend create_accept_stream test ... - Create more options for creating server-initiated - Check that correct stream is accepted with SSL_get_stream_type Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27883)	2025-07-02 20:55:24 -04:00
Andrew Dinh	20c3988bcd	Add test for SSL_accept_stream ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27883)	2025-07-02 20:55:24 -04:00
Tomas Mraz	a3af1c036c	test: Silence warnings on Win64 builds ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27806)	2025-07-02 17:26:26 +02:00
Matt Caswell	fbb2a20732	Add a test for SSL_set_verify with QUIC ... Check that we get the correct SSL object passed to the callback. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27838)	2025-06-17 16:12:39 -04:00
Matt Caswell	b637fbe781	Add a test for calling SSL_accept() on a listener ... We expect this scenario to fail Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27351)	2025-04-24 20:10:44 +02:00
Matt Caswell	44af96b9c5	Add a test for calling SSL_accept() on an accepted connection ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27283)	2025-04-14 08:52:29 +01:00
Samson S. Kolge	ba46275556	Fix code style in quicapitest.c ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27264)	2025-04-05 09:06:24 -04:00
Samson S. Kolge	5341e271d9	Fix SSL_new() with QUIC_server_method and improve formatting (Fixes #27255) ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27264)	2025-04-05 09:06:24 -04:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Neil Horman	192f096afd	Convert test_bio_ssl to use fake time ... The test_bio_ssl test in quicapitest is failing on windows. Something about the timing there is causing wide variance in how long it takes to establish a handshake (between 130-6500 iterations). Convert it to use fake time to make it run consistently. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26801)	2025-02-25 15:34:24 +01:00
Tomas Mraz	b665a13ac0	compare_with_file(): ? at EOL matches any number of characters ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26801)	2025-02-25 15:34:23 +01:00
Andrew Dinh	8d69f4005b	Use OPENSSL_strdup instead of strdup ... Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643038 Also NULL check for the allocation. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26843)	2025-02-21 11:21:48 +01:00
Tomas Mraz	9d8b18c74e	test/quicapitest.c: Fix build with no-ssl-trace ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26810)	2025-02-20 10:48:54 +01:00
Frederik Wedel-Heinen	00fbc96988	Adds missing checks of return from XXX_up_ref(). ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)	2025-02-18 16:32:59 +01:00
Neil Horman	ebc52f1f02	Add test to confirm new token functionality ... Basically just create two clients and two servers, ensuring that both clients use the same ctx (to share the token cache). Connect the first client and server so that the cache gets populated with a new token, tracing the ssl connection Connect the second client and server, again tracing the connection with the same bio Then sift through the trace, looking for the new token frame in the first connection, matching it with the token used in the second connection. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Alexandr Nedvedicky	0b15147a37	Implement SSL_new_from_listener() ... SSL_new_from_listner() creates QUIC connection object (QCSO) from listener. Caller can use the object retuned from SSL_new_from_listener() to connect to remote QUIC server. The QCSO created here shares engine/port with listener. the change is covered by `test_ssl_new_from_listener()` in test/quicapitest.c Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26138)	2025-02-17 11:27:33 -05:00
Neil Horman	35f1917f2d	Include RETRY_CID transport parameter when handling retried connection ... After sending a retry frame from a server, the subsequent server hello record must include the RETRY_SCID transport parameter, as per RFC 9000: https://datatracker.ietf.org/doc/html/rfc9000#section-7.3 Implement the encoding of said retry_source_connection_id transport param, and fix up tests to address the impact of that change. Test changes amount to: 1) quicapitest needs to have its tparam test augmented such that it doesn't inject the retry_scid on its own, as the quic stack does it for the test now 2) quicapitest needs to have the ssl_trace test adjusted so the expected record values are reflected. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25890)	2025-02-17 11:27:33 -05:00
Matt Caswell	034fa85ced	Add a test for early ticking ... Ensure that we don't inadvertently start the connection if we call SSL_handle_events(), or SSL_get_event_timeout() early. This adds a test for #25054, which was originally fixed by #25069 to ensure we haven't broken anything by the changes in the previous commit. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25452)	2025-02-17 11:27:33 -05:00
Hugo Landau	62f91f2f25	QUIC: Add basic domain flags test ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Matt Caswell	a0fc1ff348	Teach SSL_trace() about ML-DSA ... Ensure the ML-DSA based sigalgs are recognised by SSL_trace() Also ensure the test_ssl_trace test passes correctly. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26654)	2025-02-14 10:46:04 +01:00
Ingo Franzki	0e93f64723	test/quicapitest.c: Increase timeout of test_fin_only_blocking to 40ms ... Running this test on heavily loaded systems may cause the SSL_read_ex() to take more than 20ms, due to concurrent workload. Increase the timeout to 40ms to allow a little bit more time. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26693)	2025-02-11 13:04:03 -05:00
Matt Caswell	b10cfd93fd	Add a test for setting TLSv1.2 ciphersuites on a QUIC object ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25886)	2024-11-08 14:36:17 +01:00
Matt Caswell	e54526413d	Add a test for the new_session_cb from a QUIC object ... Setting a new_session_cb should work for a QUIC object just as it does with a normal TLS object. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25874)	2024-11-07 12:05:34 +01:00
Rajeev Ranjan	b6a5e80167	Add support for integrity-only cipher suites for TLS v1.3 ... - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)	2024-05-14 15:39:15 +02:00
Tomas Mraz	0977eac565	Adjust tests that were depending on X25519 and X448 in fips ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24099)	2024-04-19 10:32:27 +02:00
Richard Levitte	b646179229	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes (cherry picked from commit 0ce7d1f355) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24034)	2024-04-09 13:43:26 +02:00
Tomas Mraz	b7de38e84c	Add a test using the bandwidth limit filter ... Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23588)	2024-03-15 10:19:19 +01:00
Hugo Landau	4b4b9c9eb3	QUIC: Uniform changes for QUIC error code definitions rename ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23598)	2024-03-07 23:48:49 +00:00
Hugo Landau	28c7f52612	QUIC: Test that SSL_ctrl, SSL_set_mode are routed correctly on QSSOs ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23581)	2024-02-16 16:15:38 +01:00
Hugo Landau	12c0d72c4a	Fix SSL_export_keying_material for QUIC ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23567) (cherry picked from commit 498d4e4c4f)	2024-02-14 18:14:52 +01:00
Tomas Mraz	3150dbe7cb	tparam_on_enc_ext(): Remove dead code in cleanup ... Fixes Coverity 1548382 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22606)	2023-11-06 07:50:08 +00:00
Hugo Landau	8cb4a47dbb	QUIC: Test missing/malformed/duplicate/etc. transport parameters ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22523)	2023-11-02 14:22:12 +01:00
Hugo Landau	82b7a0eee9	QUIC TLS: Ensure QUIC_TLS is ticked between each processed RX packet ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)	2023-10-25 11:14:23 +01:00
Tomas Mraz	3860ef2ae6	QUIC: Test connection with large client and server cert chains ... Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)	2023-10-25 11:14:23 +01:00
Tomas Mraz	7757f5ef73	QUIC: Add handling of SSL_get_shutdown() ... Return SSL_SENT_SHUTDOWN and SSL_RECEIVED_SHUTDOWN with semantics similar to TLS connections. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22408)	2023-10-20 16:29:28 +01:00
Tomas Mraz	6dfc57f8a9	Add testing of bitflips in packet headers ... A new type of noise is introduced in the noisy dgram bio filter. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22267)	2023-10-06 10:24:58 +02:00
Matt Caswell	21d2041da0	Back off on generating noise in the event of a PING frame ... If either endpoint issues a PING frame while we are introducing noise into the communication then there is a danger that the connection itself will fail. We detect the PING and then back off on generating noise for a short while. It should be sufficient to just ensure that the next datagram does not get dropped for each endpoint. Fixes #22199 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22243)	2023-10-04 10:51:51 +11:00
Tomas Mraz	d2751ee393	quicapitest: Enable test_ssl_trace with enable-zlib ... To improve Coverage mapping in Coveralls make it possible to run test_ssl_trace() with enable-zlib Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22222)	2023-10-03 17:23:58 +02:00
Tomas Mraz	9f6eb62221	Test client certificate authentication with QUIC ... Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22207)	2023-09-29 11:29:19 +02:00
Matt Caswell	0a2369fd44	Ensure client to server datagrams are noisy too ... So far we've only applied noise to the server to client datagrams. Do the same thing the other way around. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	8d8c0a901e	Add the ability to do client side tracing in quictestlib.c ... We add a new flag QTEST_FLAG_CLIENT_TRACE to get debug tracing output if required. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	b1584a85d0	Extend the noisy dgram test so that packets are also affected by noise ... Where multiple packets are in a single datagram we split them so that all packets can be affected by the noise Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	5d3933eef0	Use fake time rather than real time in the noisy dgram test ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	d3a8daca58	Use test_random() to introduce better noise into the noisy dgram BIO ... We drop some datagrams, and we delay some datagrams. We can also duplicate some datagrams. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	19d79bb2ba	Extend the nosiy datagram test to send more data ... We send several messages between client and server, and server and client, and also create a new stream. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00
Matt Caswell	43b94c7fe4	Create a noisy dgram test ... Create a noisy dgram test that can drop/duplicate/reorder UDP packets and ensure that the QUIC connection is tolerant of this. At this stage we just create the outline of the test. Adding in the noise will come in future commits. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22157)	2023-09-22 13:56:43 +01:00