[openssl/openssl] 854365: Adds initial dtls 1.3 structs and definitions
"'Matt Caswell' via openssl-commits" <[email protected]> Mon, 13 Jul 2026 07:26:42 -0700
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/feature/dtls-1.3/[email protected]> |
Branch: refs/heads/feature/dtls-1.3
Home: https://github.com/openssl/openssl
Commit: 854365f1535613ff615c3e11318e88082b1e28d2
https://github.com/openssl/openssl/commit/854365f1535613ff615c3e11318e88082b1e28d2
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M include/openssl/prov_ssl.h
M include/openssl/ssl.h.in
M ssl/d1_lib.c
M ssl/methods.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/ssl_local.h
Log Message:
-----------
Adds initial dtls 1.3 structs and definitions
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22259)
Commit: 9221ab82434fe087fbd522b6561ee7b38c67c08a
https://github.com/openssl/openssl/commit/9221ab82434fe087fbd522b6561ee7b38c67c08a
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/methods.c
Log Message:
-----------
Remove compile guards for dtls1.3 method implementations
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22259)
Commit: 9853ee3f5bfe16ed3e2c85b3767df68f3ed05916
https://github.com/openssl/openssl/commit/9853ee3f5bfe16ed3e2c85b3767df68f3ed05916
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M apps/include/opt.h
M apps/lib/s_cb.c
M apps/s_client.c
M apps/s_server.c
Log Message:
-----------
Integrate dtls1.3 in s_client and s_server
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22260)
Commit: c19d376e9e1bd2cb65a2508e36e57fb6466619b5
https://github.com/openssl/openssl/commit/c19d376e9e1bd2cb65a2508e36e57fb6466619b5
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M doc/man1/openssl-s_client.pod.in
M doc/man1/openssl-s_server.pod.in
M doc/man1/openssl.pod
M doc/perlvars.pm
Log Message:
-----------
Adds DTLS 1.3 functionality to s_client and s_server documentation.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22260)
Commit: 496fb31b30397b8eafc8e518028c01f11cb8d20f
https://github.com/openssl/openssl/commit/496fb31b30397b8eafc8e518028c01f11cb8d20f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M apps/s_client.c
Log Message:
-----------
Print session ticket for dtls 1.3 as well.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22260)
Commit: 520ae53abb4d1bc7ead87aa81d3f53edcb295509
https://github.com/openssl/openssl/commit/520ae53abb4d1bc7ead87aa81d3f53edcb295509
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/statem/extensions.c
M ssl/statem/extensions_clnt.c
M ssl/statem/extensions_srvr.c
Log Message:
-----------
Support TLS1.3 extensions with DTLS1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22261)
Commit: 98d70aa03d1b05cd59d7bf44214a83b2e570f351
https://github.com/openssl/openssl/commit/98d70aa03d1b05cd59d7bf44214a83b2e570f351
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/tls13_enc.c
Log Message:
-----------
Use dtls1.3 cryptographic label prefix as dictated by RFC 9147 section 5.9
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22416)
Commit: 2d122135b80ab5a766414768463ae030551e6363
https://github.com/openssl/openssl/commit/2d122135b80ab5a766414768463ae030551e6363
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/tls13_enc.c
Log Message:
-----------
Determine which label prefix to use based on if the connection is dtls
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22416)
Commit: bedd295028e14966056940cbc4d76cd903b2d565
https://github.com/openssl/openssl/commit/bedd295028e14966056940cbc4d76cd903b2d565
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/ssl_conf.c
M ssl/t1_trce.c
M test/helpers/ssl_test_ctx.c
M test/ssl_old_test.c
Log Message:
-----------
Adds DTLS1.3 to ssl protocol to text structs
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22273)
Commit: 4afa9d7df924a0e4541584e3320b5e9a531a9ad0
https://github.com/openssl/openssl/commit/4afa9d7df924a0e4541584e3320b5e9a531a9ad0
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/ssl_lib.c
Log Message:
-----------
Add dtls1.3 to ssl_protocol_to_string()
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22273)
Commit: d4045cde3ec23aede7fd61541be2b2d023685c33
https://github.com/openssl/openssl/commit/d4045cde3ec23aede7fd61541be2b2d023685c33
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M ssl/ssl_conf.c
Log Message:
-----------
Fix protocol list for cmd_Protocol()
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22273)
Commit: 5d455cb0ea95e4995313ef58ac2ac1c846c335a0
https://github.com/openssl/openssl/commit/5d455cb0ea95e4995313ef58ac2ac1c846c335a0
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
M ssl/statem/statem_srvr.c
Log Message:
-----------
Update tls state machine logic to support dtls1.3 alongside tls1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22366)
Updated the logic in ssl_cipher_list_to_bytes to take account of the changes
from PR#24161
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24226)
Commit: 74ddf8750c87be6ce0bd33ed15b9550a90093c80
https://github.com/openssl/openssl/commit/74ddf8750c87be6ce0bd33ed15b9550a90093c80
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_clnt.c
M ssl/statem/statem_srvr.c
Log Message:
-----------
Fix sending session ids in DTLS-1.3
DTLS 1.3 session id must not be sent by client unless
it has a cached id. And DTLS 1.3 servers must not echo
a session id from a client.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22366)
Commit: ed22fe2e2e3d35cd22af28c07fab8e96b141542e
https://github.com/openssl/openssl/commit/ed22fe2e2e3d35cd22af28c07fab8e96b141542e
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_local.h
M ssl/statem/extensions_srvr.c
M ssl/statem/statem.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
M ssl/statem/statem_srvr.c
Log Message:
-----------
Do DTLS13 and TLS13 connection version check in one macro
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22366)
Commit: ad883293a84e7a7372ec4b47a2844ee7172f2b63
https://github.com/openssl/openssl/commit/ad883293a84e7a7372ec4b47a2844ee7172f2b63
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_srvr.c
Log Message:
-----------
Fix wrong dtls 1 and 1.2 version check
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22366)
Commit: 511da9e0dde614a49333a60c7731825861b3173f
https://github.com/openssl/openssl/commit/511da9e0dde614a49333a60c7731825861b3173f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M providers/common/capabilities.c
M ssl/s3_lib.c
M ssl/statem/extensions.c
M ssl/statem/extensions_clnt.c
M ssl/statem/extensions_srvr.c
M ssl/t1_lib.c
Log Message:
-----------
Support TLS 1.3 kexs and groups with DTLS 1.3
SSL_CONNECTION_IS_VERSION13 macro is used where appropriate.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22364)
Commit: ec644a5336c7a177ee9fad01a8b8dd7052089fe3
https://github.com/openssl/openssl/commit/ec644a5336c7a177ee9fad01a8b8dd7052089fe3
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M util/perl/TLSProxy/Record.pm
M util/perl/TLSProxy/ServerHello.pm
Log Message:
-----------
Adds dtls 1.3 support in TLS::Proxy
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23375)
Commit: 163ce9b0085b51721fb77ee0c4a6cd3436b86dff
https://github.com/openssl/openssl/commit/163ce9b0085b51721fb77ee0c4a6cd3436b86dff
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M apps/include/s_apps.h
Log Message:
-----------
Don't allow renegotiation for DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22362)
Commit: 2082eebe4479ee7791bf09e016aa5bc73e6ab29d
https://github.com/openssl/openssl/commit/2082eebe4479ee7791bf09e016aa5bc73e6ab29d
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_d1.c
Log Message:
-----------
Make dtls1.3 changes to dtls1_read_bytes and do_dtls1_write which matches ssl3_read_bytes and ssl3_write_bytes
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22360)
Commit: 2ca7fd314380c8d358091a70615a885e2c656b65
https://github.com/openssl/openssl/commit/2ca7fd314380c8d358091a70615a885e2c656b65
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
Log Message:
-----------
Adds some more changes dtls specific functions to make them more in sync with their tls counterparts.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22360)
Commit: bd825be6730205fa85ea428971da1ba345891ba7
https://github.com/openssl/openssl/commit/bd825be6730205fa85ea428971da1ba345891ba7
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_dtls.c
Log Message:
-----------
Make similar changes to dtls1_do_write() for dtls1.3 as in ssl3_do_write() for tls1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22360)
Commit: f7033cff1d6aeb657d9b71a421a6f6343362d20a
https://github.com/openssl/openssl/commit/f7033cff1d6aeb657d9b71a421a6f6343362d20a
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_d1.c
Log Message:
-----------
Handle alerts similarly in dtls1_read_bytes() as done in ssl3_read_bytes()
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22360)
Commit: f01ff102550d3bfe95ac4f43107147c812097023
https://github.com/openssl/openssl/commit/f01ff102550d3bfe95ac4f43107147c812097023
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/t1_lib.c
Log Message:
-----------
Support TLS1.3 sigalg logic in DTLS1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22380)
Commit: 412f392cba5373ab6863278e3e0433b3720e0c35
https://github.com/openssl/openssl/commit/412f392cba5373ab6863278e3e0433b3720e0c35
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_dtls.c
Log Message:
-----------
Removes an mtu assertion that fails
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22401)
Commit: 2e8114b87551a34113451f85761d16e007233ee6
https://github.com/openssl/openssl/commit/2e8114b87551a34113451f85761d16e007233ee6
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_sess.c
M ssl/t1_lib.c
M ssl/t1_trce.c
Log Message:
-----------
Update session id and ticket logic for dtls13
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22936)
Commit: 2dc161d7aadc9d6e1fb91bf40e9a7ef8f59fbb00
https://github.com/openssl/openssl/commit/2dc161d7aadc9d6e1fb91bf40e9a7ef8f59fbb00
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_txt.c
Log Message:
-----------
Fix session print for dtls1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22936)
Commit: 010d6d38330170ad8bcb743d2716751be8b16484
https://github.com/openssl/openssl/commit/010d6d38330170ad8bcb743d2716751be8b16484
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/tls_common.c
M ssl/record/methods/tlsany_meth.c
Log Message:
-----------
tls_post_encryption_processing_default() and tls_validate_record_header()
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22376)
Commit: 469960f9622e6f89ffc700591234990c4a240905
https://github.com/openssl/openssl/commit/469960f9622e6f89ffc700591234990c4a240905
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_lib.c
Log Message:
-----------
Fix ssl_lib functions for dtls 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22378)
Commit: b9f21f67b5b07a44fb86409677b5a78034acc675
https://github.com/openssl/openssl/commit/b9f21f67b5b07a44fb86409677b5a78034acc675
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/s3_lib.c
M ssl/statem/statem_lib.c
Log Message:
-----------
Sanity tests of inputs to ssl_version_cmp
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24293)
Commit: 6710b6d3e6e8321bce8d4c65eec31c42b55002eb
https://github.com/openssl/openssl/commit/6710b6d3e6e8321bce8d4c65eec31c42b55002eb
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_lib.c
M ssl/t1_lib.c
Log Message:
-----------
Fix sanity tests for ssl_version_cmp for dtls 1.3 branch
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24293)
Commit: df70ee292eb7eed3ea9403d07384e3497db0f4ab
https://github.com/openssl/openssl/commit/df70ee292eb7eed3ea9403d07384e3497db0f4ab
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/openssl/dtls1.h
M ssl/ssl_local.h
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
Log Message:
-----------
Update dtls max version
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: 0c893a575d5fdab00bd45f47cd2b62a0523add17
https://github.com/openssl/openssl/commit/0c893a575d5fdab00bd45f47cd2b62a0523add17
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_clnt.c
Log Message:
-----------
Remove obsolete TODO and guards for post handshake authentication in DTLS 1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: fd4a2fc63bf2d8af5e2d135b7b7086280572d835
https://github.com/openssl/openssl/commit/fd4a2fc63bf2d8af5e2d135b7b7086280572d835
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_lib.c
M test/ssl_ctx_test.c
Log Message:
-----------
Update DTLS version tests
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: b2f421747fa280930dfeb38ee3b1d050dcee88e3
https://github.com/openssl/openssl/commit/b2f421747fa280930dfeb38ee3b1d050dcee88e3
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_lib.c
Log Message:
-----------
Fix version check to avoid unsupported protocol error in ssl_choose_server_version()
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: 49da541aadc43c2026c550dd0cf999371d8e43e9
https://github.com/openssl/openssl/commit/49da541aadc43c2026c550dd0cf999371d8e43e9
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/extensions_clnt.c
Log Message:
-----------
Fix renegotiation check that was added in https://github.com/openssl/openssl/pull/24161
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: eb014ac33232110dddc3b923fa29c0dacd7f3913
https://github.com/openssl/openssl/commit/eb014ac33232110dddc3b923fa29c0dacd7f3913
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M fuzz/dtlsclient.c
M test/dtls_mtu_test.c
M test/dtlstest.c
M test/ssl-tests/29-dtls-sctp-label-bug.cnf
M test/ssl-tests/29-dtls-sctp-label-bug.cnf.in
Log Message:
-----------
Run some failing tests with DTLS1.2
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: e90df3d3a363065ff9d8f666652509abdf14f7dc
https://github.com/openssl/openssl/commit/e90df3d3a363065ff9d8f666652509abdf14f7dc
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/ssl-tests/07-dtls-protocol-version.cnf
M test/ssl-tests/11-dtls_resumption.cnf
M test/ssl-tests/protocol_version.pm
Log Message:
-----------
Fix test_ssl_new tests
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: 260ee1354b1483a84a92fa66e587a2a656243365
https://github.com/openssl/openssl/commit/260ee1354b1483a84a92fa66e587a2a656243365
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/extensions.c
M ssl/statem/extensions_clnt.c
M ssl/statem/extensions_srvr.c
Log Message:
-----------
Check that both tls1.3 and dtls1.3 is disabled before removing code from compilation path.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: 326c4beba27bd831934ed0d3d89db546ec872a36
https://github.com/openssl/openssl/commit/326c4beba27bd831934ed0d3d89db546ec872a36
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_local.h
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
M ssl/statem/statem_srvr.c
Log Message:
-----------
Disable middlebox for dtls
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: 42204c54c412a937d20eb06a0b3458da22985e21
https://github.com/openssl/openssl/commit/42204c54c412a937d20eb06a0b3458da22985e21
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/tls13_enc.c
M test/tls13secretstest.c
Log Message:
-----------
Clear old messages from queues in order to avoid leaks of record layer objects.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22275)
Commit: f6744790429e87a143aa78afc43b8c3063e14321
https://github.com/openssl/openssl/commit/f6744790429e87a143aa78afc43b8c3063e14321
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/t1_trce.c
Log Message:
-----------
Correct traces for certificates in dtls13
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22935)
Commit: c1051ce631400b41d83ff44f47a26bb89e753a55
https://github.com/openssl/openssl/commit/c1051ce631400b41d83ff44f47a26bb89e753a55
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/man1/openssl-s_client.pod.in
M doc/man3/SSL_CIPHER_get_name.pod
M doc/man3/SSL_CONF_cmd.pod
M doc/man3/SSL_CTX_set0_CA_list.pod
M doc/man3/SSL_CTX_set1_sigalgs.pod
M doc/man3/SSL_CTX_set_min_proto_version.pod
M doc/man3/SSL_CTX_set_num_tickets.pod
M doc/man3/SSL_CTX_set_options.pod
M doc/man3/SSL_check_chain.pod
M doc/man3/SSL_export_keying_material.pod
M doc/man3/SSL_get_shared_sigalgs.pod
M doc/man3/SSL_get_version.pod
Log Message:
-----------
Update documentation for DTLS1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22363)
Commit: 1820258603937fe24c71bfceb7beece19c8c4e59
https://github.com/openssl/openssl/commit/1820258603937fe24c71bfceb7beece19c8c4e59
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/man3/SSL_CONF_cmd.pod
Log Message:
-----------
Updates SSL_CONF_cmd.pod to be explicit when features are for both TLS and DTLS
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22363)
Commit: 3ab35eddc2d13d03924c9489cb6097896832e05f
https://github.com/openssl/openssl/commit/3ab35eddc2d13d03924c9489cb6097896832e05f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/ssl_local.h
Log Message:
-----------
Fix description of version field of ssl connection struct
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22937)
Commit: 888d060b7f23080bca81281258285a2f398a64e1
https://github.com/openssl/openssl/commit/888d060b7f23080bca81281258285a2f398a64e1
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_srvr.c
Log Message:
-----------
Continue processing cookieless client hellos for dtls1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/22400)
Commit: 65234c7668e905b0ca94d58bed75d1a3e361be7b
https://github.com/openssl/openssl/commit/65234c7668e905b0ca94d58bed75d1a3e361be7b
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/ssl-tests/02-protocol-version.cnf
M test/ssl-tests/07-dtls-protocol-version.cnf
M test/ssl-tests/10-resumption.cnf
M test/ssl-tests/protocol_version.pm
Log Message:
-----------
Adds DTLSv1.3 to protocol_version.pm for additional protocol version tests.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23242)
Commit: 8a6b2cb1acfd37c91dd80cfc9dc1d45a1e4da507
https://github.com/openssl/openssl/commit/8a6b2cb1acfd37c91dd80cfc9dc1d45a1e4da507
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/dtlstest.c
M test/sslapitest.c
Log Message:
-----------
Run test_cookie() test with DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24425)
Commit: 26fbcb1ca660a40ce9c0b625531ebab55cc86cb2
https://github.com/openssl/openssl/commit/26fbcb1ca660a40ce9c0b625531ebab55cc86cb2
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
A doc/designs/dtlsv1_3/dtlsv1_3-main.md
Log Message:
-----------
Add design document for DTLS 1.3 implementation
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23041)
Commit: 69f99f199cbe3f3ad820e92f80d153e6dfbbb007
https://github.com/openssl/openssl/commit/69f99f199cbe3f3ad820e92f80d153e6dfbbb007
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M apps/s_client.c
M apps/s_server.c
M ssl/record/methods/tls_common.c
M ssl/ssl_cert.c
M ssl/ssl_ciph.c
M ssl/ssl_lib.c
M ssl/ssl_local.h
M ssl/statem/extensions.c
M ssl/statem/extensions_clnt.c
M ssl/statem/extensions_srvr.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
M ssl/t1_lib.c
M test/sslapitest.c
Log Message:
-----------
Refactor code and fix a couple of missing DTLSv1.3 checks.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24345)
Commit: a64518b1da47dab09e746933ee48d18238cd3a27
https://github.com/openssl/openssl/commit/a64518b1da47dab09e746933ee48d18238cd3a27
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
M ssl/statem/statem_dtls.c
Log Message:
-----------
Re-enable mtu assertion which previously failed for DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24524)
Commit: fe8e5070d94570fbca2c2cbd296c74c2de57a473
https://github.com/openssl/openssl/commit/fe8e5070d94570fbca2c2cbd296c74c2de57a473
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M crypto/packet.c
M include/internal/common.h
M include/internal/packet.h
M ssl/statem/extensions.c
M ssl/statem/extensions_clnt.c
M ssl/statem/statem_dtls.c
M ssl/statem/statem_lib.c
M test/dtls_mtu_test.c
M test/ssl-tests/29-dtls-sctp-label-bug.cnf.in
Log Message:
-----------
Place start of ClientHello correctly when calculating binder for DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24426)
Commit: 5d277d3564a6825d7a9b96474b85bd33a5e4b6a1
https://github.com/openssl/openssl/commit/5d277d3564a6825d7a9b96474b85bd33a5e4b6a1
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_dtls.c
Log Message:
-----------
Use WPACKET in dtls1_do_write()
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24426)
Commit: a583b5a98f256d9ec8a8a21e948faed721f0fe2a
https://github.com/openssl/openssl/commit/a583b5a98f256d9ec8a8a21e948faed721f0fe2a
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M fuzz/dtlsclient.c
M ssl/d1_lib.c
M ssl/ssl_local.h
M ssl/statem/extensions_clnt.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_lib.c
M test/dtlstest.c
Log Message:
-----------
Fix an assertion failure which happens when a DTLS 1.3 client receives a HelloVerifyRequest.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24509)
Commit: 415cd3ec8939c449093e52c3289a98bd37fc3843
https://github.com/openssl/openssl/commit/415cd3ec8939c449093e52c3289a98bd37fc3843
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M Configure
M test/recipes/70-test_tls13alerts.t
M util/perl/TLSProxy/Message.pm
M util/perl/TLSProxy/Proxy.pm
M util/perl/TLSProxy/Record.pm
M util/perl/TLSProxy/ServerKeyExchange.pm
Log Message:
-----------
Run 70-test_tls13alerts.t with dtls
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 91851431d12c5277f9e55d0a849fc5035abf092e
https://github.com/openssl/openssl/commit/91851431d12c5277f9e55d0a849fc5035abf092e
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13cookie.t
Log Message:
-----------
Run 70-test_tls13cookie.t with dtls
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 0cd35e53963705bda73bee2808bfe6ef47ae5822
https://github.com/openssl/openssl/commit/0cd35e53963705bda73bee2808bfe6ef47ae5822
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13hrr.t
Log Message:
-----------
Run 70-test_tls13hrr.t with dtls
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 468038a6a34f823d186c289e7e314f82362254b9
https://github.com/openssl/openssl/commit/468038a6a34f823d186c289e7e314f82362254b9
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13psk.t
Log Message:
-----------
Add support for running 70-test_tls13psk.t with dtls
Has to be currently disabled because it fails.
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 31fcef86fce8d5c4c4ba8666d502396d1b6b45e2
https://github.com/openssl/openssl/commit/31fcef86fce8d5c4c4ba8666d502396d1b6b45e2
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13messages.t
Log Message:
-----------
Run 70-test_tls13messages.t with dtls
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: b1dda4661e2784abbb31b414ca8c2bba3e46f38b
https://github.com/openssl/openssl/commit/b1dda4661e2784abbb31b414ca8c2bba3e46f38b
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13kexmodes.t
Log Message:
-----------
Run 70-test_tls13kexmodes.t with dtls
It is currently unsupported because of missing support in TLSProxy.
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 468c7cf7ada469ff0cf33a909073f7cc91bd8e02
https://github.com/openssl/openssl/commit/468c7cf7ada469ff0cf33a909073f7cc91bd8e02
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13alerts.t
M test/recipes/70-test_tls13certcomp.t
M test/recipes/70-test_tls13cookie.t
M test/recipes/70-test_tls13hrr.t
M test/recipes/70-test_tls13psk.t
Log Message:
-----------
Run 70-test_tls13certcomp.t with dtls
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24525)
Commit: 5fc4fe46f14522fb28f649260a00a9dc959d21b5
https://github.com/openssl/openssl/commit/5fc4fe46f14522fb28f649260a00a9dc959d21b5
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_clnt.c
M ssl/statem/statem_srvr.c
M test/dtls_mtu_test.c
Log Message:
-----------
Fix SCTP todo
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24605)
Commit: 8741365f97e9c4d8ac787bb874414645d90c551a
https://github.com/openssl/openssl/commit/8741365f97e9c4d8ac787bb874414645d90c551a
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/d1_lib.c
M ssl/record/rec_layer_d1.c
M ssl/ssl_local.h
M ssl/statem/statem_dtls.c
M util/indent.pro
Log Message:
-----------
Refactor handshake msg header parsing etc.
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/24607)
Commit: 81bcd8c68c2798059a7c8a7c3d3a462c2446b52f
https://github.com/openssl/openssl/commit/81bcd8c68c2798059a7c8a7c3d3a462c2446b52f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/designs/dtlsv1_3/dtlsv1_3-main.md
M ssl/record/rec_layer_d1.c
M ssl/tls13_enc.c
A test/recipes/70-test_dtls13epoch.t
M test/recipes/70-test_tls13alerts.t
M test/tls13secretstest.c
Log Message:
-----------
Update epochs when changing key and cipher state for dtls 1.3
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23229)
Commit: 727e6811ef85a5b6a288580a06a0b92ef5a01ee2
https://github.com/openssl/openssl/commit/727e6811ef85a5b6a288580a06a0b92ef5a01ee2
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/s3_lib.c
M ssl/ssl_local.h
M ssl/statem/statem_lib.c
M ssl/statem/statem_srvr.c
M test/recipes/70-test_tls13downgrade.t
M util/perl/TLSProxy/Certificate.pm
M util/perl/TLSProxy/CertificateRequest.pm
M util/perl/TLSProxy/CertificateVerify.pm
M util/perl/TLSProxy/ClientHello.pm
M util/perl/TLSProxy/EncryptedExtensions.pm
M util/perl/TLSProxy/HelloVerifyRequest.pm
M util/perl/TLSProxy/Message.pm
M util/perl/TLSProxy/NewSessionTicket.pm
M util/perl/TLSProxy/ServerHello.pm
M util/perl/TLSProxy/ServerKeyExchange.pm
Log Message:
-----------
Support dtls 1.3 downgrade mechanism
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23320)
Commit: d92f44d50c025b9786363a5bff9f771ea0208dfa
https://github.com/openssl/openssl/commit/d92f44d50c025b9786363a5bff9f771ea0208dfa
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/internal/recordmethod.h
M include/openssl/dtls1.h
M ssl/d1_lib.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls1_meth.c
M ssl/record/methods/tls_common.c
M ssl/record/methods/tlsany_meth.c
M ssl/record/rec_layer_s3.c
M ssl/record/record.h
M ssl/s3_lib.c
M ssl/ssl_ciph.c
M ssl/ssl_local.h
M ssl/ssl_txt.c
M ssl/statem/statem_clnt.c
M ssl/t1_enc.c
M ssl/tls13_enc.c
M test/tls13encryptiontest.c
M test/tls13secretstest.c
Log Message:
-----------
DTLS 1.3 record number encryption
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/23511)
Commit: 61b924e3c2264d3014595b1d8d131afc5401ae9d
https://github.com/openssl/openssl/commit/61b924e3c2264d3014595b1d8d131afc5401ae9d
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/designs/dtlsv1_3/dtlsv1_3-main.md
M ssl/ech/ech_internal.c
M ssl/s3_enc.c
M ssl/ssl_local.h
M ssl/statem/extensions_srvr.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_dtls.c
M ssl/statem/statem_lib.c
M ssl/statem/statem_local.h
Log Message:
-----------
Fix DTLS 1.3 handshake transcript hash
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26035)
Commit: 3339eb9250fdc4f75258e1e869190d1406863bd6
https://github.com/openssl/openssl/commit/3339eb9250fdc4f75258e1e869190d1406863bd6
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/pqueue.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/ssl_local.h
Log Message:
-----------
Avoid mallocing unprocessed_rcds and processed_rcds in dtls record layer
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26211)
Commit: cdd1f8563af70d55661bca56bf7eac44ab93a4f6
https://github.com/openssl/openssl/commit/cdd1f8563af70d55661bca56bf7eac44ab93a4f6
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_s3.c
M ssl/statem/statem_clnt.c
Log Message:
-----------
Check result of set_protocol_version() and use the version passed as argument
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26226)
Commit: cf7898574320ced95850d69ac452ad0202494256
https://github.com/openssl/openssl/commit/cf7898574320ced95850d69ac452ad0202494256
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/tls13_enc.c
Log Message:
-----------
Sequence number cipher context is NULL for TLS connections
Fix memory sanitizer report of use of uninitialized variable: be explicit
that sequence number cipher context is NULL for TLS connections when
calling ssl_set_new_record_layer().
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Hugo Landau <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26401)
Commit: 3c3000b9a690cc2c9c21c608469bfda52e187cad
https://github.com/openssl/openssl/commit/3c3000b9a690cc2c9c21c608469bfda52e187cad
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/openssl/prov_ssl.h
M ssl/ech/ech_internal.c
M ssl/record/rec_layer_s3.c
M ssl/s3_enc.c
M ssl/ssl_local.h
M ssl/statem/statem_clnt.c
M ssl/statem/statem_dtls.c
M ssl/statem/statem_lib.c
Log Message:
-----------
This change fixes an issue where a DTLS 1.3 would calculate a wrong transcript hash.
A wrong transcript hash was calculated when the client received a HRR which caused interop failures with WolfSSL. This change also refactors the internal calls to ssl3_finish_mac() that no longer requires the "incl_hdr" argument.
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26465)
Commit: f6f01a8cc6475c1457d9103c401cee415ea70bf7
https://github.com/openssl/openssl/commit/f6f01a8cc6475c1457d9103c401cee415ea70bf7
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/d1_lib.c
M ssl/record/rec_layer_s3.c
M ssl/ssl_local.h
M ssl/statem/statem_dtls.c
Log Message:
-----------
Reduce the number of mallocs in dtls1_new() by allocating message queues together with the d1 struct.
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26150)
Commit: 8b951b189eb55efb646cf288899827ef979b9c7f
https://github.com/openssl/openssl/commit/8b951b189eb55efb646cf288899827ef979b9c7f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_dtls13epoch.t
M test/recipes/70-test_tls13alerts.t
M test/recipes/70-test_tls13certcomp.t
M test/recipes/70-test_tls13hrr.t
M test/recipes/70-test_tls13messages.t
M util/perl/TLSProxy/Message.pm
Log Message:
-----------
TLSProxy: Handle partial messages with DTLS
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26532)
Commit: 2327bc7cf5491ed4b4ef98384b1b0de20af71822
https://github.com/openssl/openssl/commit/2327bc7cf5491ed4b4ef98384b1b0de20af71822
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M util/perl/TLSProxy/Proxy.pm
Log Message:
-----------
Adds a workaround for false negative test results with TLSProxy
The server is not able to shut down correctly
when the client sends an alert in epoch 0 and the
server has sent its Finished message.
As a workaround we accept a bad exit code for a failing
DTLS test run.
Fixes #26915
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26922)
Commit: a4ea6929417b1fbe4acca653ce5173c991a05e5b
https://github.com/openssl/openssl/commit/a4ea6929417b1fbe4acca653ce5173c991a05e5b
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/designs/dtlsv1_3/dtlsv1_3-main.md
M doc/man3/SSL_get_version.pod
M include/openssl/dtls1.h
M ssl/d1_lib.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls1_meth.c
M ssl/record/methods/tls_common.c
M test/helpers/ssltestlib.c
M util/perl/TLSProxy/Record.pm
Log Message:
-----------
Support DTLS 1.3 Unified Headers
Also set correct AAD for DTLS 1.3 message de-/encryption.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/25668)
Commit: ba1ae015d5f32aa22e294fb7042f7155cca41d0e
https://github.com/openssl/openssl/commit/ba1ae015d5f32aa22e294fb7042f7155cca41d0e
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/dtls_mtu_test.c
Log Message:
-----------
test_server_mtu_larger_than_max_fragment_length() should be run for DTLS 1.3
Previously it was forced to run on DTLS 1.2>. But the underlying issue was fixed on master and it works now that the feature branch has been rebased on top of a more recent master.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26574)
Commit: 843c79566a34ed0a656e251bf430643829502f9e
https://github.com/openssl/openssl/commit/843c79566a34ed0a656e251bf430643829502f9e
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/sslapitest.c
M test/tls-provider.c
Log Message:
-----------
Duplicate TLS 1.3 sslapitests for DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/26912)
Commit: dcee4e9fb0a1fb8a57c732dfa9ce93596e67d463
https://github.com/openssl/openssl/commit/dcee4e9fb0a1fb8a57c732dfa9ce93596e67d463
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_lib.c
Log Message:
-----------
Revert changes to ssl_version_cmp() to avoid calling assert on non-sane inputs
The function can be called with arbitrary inputs.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28000)
Commit: 3196194a7e2fb1c95aebf0157d71c751e917e1ea
https://github.com/openssl/openssl/commit/3196194a7e2fb1c95aebf0157d71c751e917e1ea
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M apps/lib/s_cb.c
M doc/designs/dtlsv1_3/dtlsv1_3-main.md
M include/internal/packet.h
M include/internal/recordmethod.h
M include/internal/statem.h
M include/openssl/ssl.h.in
M include/openssl/ssl3.h
M ssl/d1_lib.c
M ssl/pqueue.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls1_meth.c
M ssl/record/methods/tls_common.c
M ssl/record/methods/tls_multib.c
M ssl/record/rec_layer_d1.c
M ssl/record/record.h
M ssl/ssl_local.h
M ssl/ssl_stat.c
M ssl/statem/statem.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_dtls.c
M ssl/statem/statem_local.h
M ssl/statem/statem_srvr.c
M ssl/tls13_enc.c
A test/recipes/70-test_dtls13ack.t
M test/recipes/70-test_sslcbcpadding.t
M test/recipes/70-test_sslrecords.t
M test/recipes/70-test_tls13hrr.t
M test/sslapitest.c
M test/tls13encryptiontest.c
M test/tls13secretstest.c
M util/perl/TLSProxy/Message.pm
M util/perl/TLSProxy/Proxy.pm
M util/perl/TLSProxy/Record.pm
A util/perl/TLSProxy/RecordNumber.pm
Log Message:
-----------
Adds DTLS 1.3 ACK message functionality
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/25119)
Commit: 4a2823eb0a0fd310575173744b984e2970b5aaad
https://github.com/openssl/openssl/commit/4a2823eb0a0fd310575173744b984e2970b5aaad
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/d1_lib.c
M ssl/record/rec_layer_d1.c
M ssl/tls13_enc.c
Log Message:
-----------
Fixes an issue were dropped records sent from server was not retransmitted.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/25119)
Commit: c3a4f37e9472326a76d9e79924f25d67fa6a2459
https://github.com/openssl/openssl/commit/c3a4f37e9472326a76d9e79924f25d67fa6a2459
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/tls_multib.c
Log Message:
-----------
Minor style changes and check sequence for wraparound
We check the TLS sequence number for wraparound elsewhere,
this adds the check to TLS multiblock writes as well.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/25119)
Commit: 6df90dcbfd0ba4638bd123bdb479096940fc7692
https://github.com/openssl/openssl/commit/6df90dcbfd0ba4638bd123bdb479096940fc7692
Author: Tomas Mraz <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_dtls13ack.t
M test/recipes/70-test_dtls13epoch.t
M test/recipes/70-test_sslrecords.t
Log Message:
-----------
Use non-PQC key share for DTLS-1.3 TLSProxy tests
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: 2c0cb0e68b953e84f18334341c4620d1d2872b9f
https://github.com/openssl/openssl/commit/2c0cb0e68b953e84f18334341c4620d1d2872b9f
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M apps/s_client.c
M apps/s_server.c
M ssl/ssl_cert.c
M ssl/statem/statem_clnt.c
Log Message:
-----------
Support OSCP responses for DTLS 1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: 19f0908e6ec7a87540b337b7b028e7f2b166a2ed
https://github.com/openssl/openssl/commit/19f0908e6ec7a87540b337b7b028e7f2b166a2ed
Author: Tomas Mraz <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M providers/common/capabilities.c
Log Message:
-----------
sigalg_constants_list: Add DTLS1_3_VERSION to applicable sigalgs
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: a118ef29398ac5bad066a820cfc660a65c93f9de
https://github.com/openssl/openssl/commit/a118ef29398ac5bad066a820cfc660a65c93f9de
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/extensions_srvr.c
M ssl/statem/statem_lib.c
M ssl/t1_lib.c
M ssl/t1_trce.c
M test/tls-provider.c
M util/perl/TLSProxy/Record.pm
Log Message:
-----------
TLS-1.3 specific sigalgs should be supported in DTLS-1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: d97d807208056f2bca206946bf7ce433ca3cd5ec
https://github.com/openssl/openssl/commit/d97d807208056f2bca206946bf7ce433ca3cd5ec
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_sslrecords.t
M test/recipes/70-test_tls13downgrade.t
M test/recipes/70-test_tls13messages.t
Log Message:
-----------
Fixes of tests for DTLS-1.3
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: 34cbe640506f5036bfa3293989693c1985193a88
https://github.com/openssl/openssl/commit/34cbe640506f5036bfa3293989693c1985193a88
Author: Tomas Mraz <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/dtlstest.c
M test/recipes/70-test_tls13certcomp.t
M test/recipes/70-test_tls13cookie.t
M test/recipes/70-test_tls13downgrade.t
M test/recipes/70-test_tls13hrr.t
M test/recipes/70-test_tls13messages.t
Log Message:
-----------
DTLS1.3: Disable tests that currently fail
With added TODO(DTLSv1.3) comments
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28455)
Commit: a3650107f20121aac67e081141761fbb4394d3ce
https://github.com/openssl/openssl/commit/a3650107f20121aac67e081141761fbb4394d3ce
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/p_ossltest.c
M test/recipes/70-test_dtls13ack.t
Log Message:
-----------
Adds AES-128-ECB to ossltest provider to be able to reenable DTLS 1.3 ACK tests.
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28926)
Commit: 823a9e5e30cfa0f925f3572ff985a6b71ca5a5a5
https://github.com/openssl/openssl/commit/823a9e5e30cfa0f925f3572ff985a6b71ca5a5a5
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/d1_lib.c
M test/dtls_mtu_test.c
Log Message:
-----------
Fixes the DTLS MTU test
When calling DTLS_get_data_mtu the function was not taking
into account the extra byte after the data which contains
the content type.
Fixes: https://github.com/openssl/project/issues/1668
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29081)
Commit: 0358db8141310925ebcf436e91a40c7e704ed5b0
https://github.com/openssl/openssl/commit/0358db8141310925ebcf436e91a40c7e704ed5b0
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/internal/recordmethod.h
M ssl/d1_msg.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls_common.c
M ssl/record/rec_layer_d1.c
M ssl/record/rec_layer_s3.c
M ssl/record/record.h
M ssl/statem/extensions.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_dtls.c
M ssl/statem/statem_srvr.c
M test/helpers/ssltestlib.c
M test/sslapitest.c
Log Message:
-----------
Fixing comment out tests for DTLS1.3 in sslapitest
Several tests where commented out for the behavior of DTLS1.3 is
different then TLS1.3. The main difference is around the ACK
message. This means some tests needed to be massaged to for
the peer to ACK to a certain message.
This PR does not remove all TODO's for DTLS1.3. Currently there
are two TODOs. One around padding for messages less than 16
bytes and one for authentication and integrity only messages.
Also this PR still has a lot of memory leaks. Looking into it
it has to deal with how new record layers are allocated for
new epochs. Because record layers are also stored in a list of
messages sent in case they need to be resent it wasn't a simple
fix. I feel like the memory leaks should be tackled in a
separate PR.
Fixes: https://github.com/openssl/project/issues/1667
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29067)
Commit: da5ee65ec983cbb14305432a0deb798a24be0344
https://github.com/openssl/openssl/commit/da5ee65ec983cbb14305432a0deb798a24be0344
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/openssl/ssl3.h
M ssl/statem/statem_clnt.c
M ssl/tls13_enc.c
M test/recipes/70-test_dtls13ack.t
M test/recipes/70-test_tls13certcomp.t
M util/perl/TLSProxy/Message.pm
M util/perl/TLSProxy/Proxy.pm
M util/perl/TLSProxy/Record.pm
Log Message:
-----------
Updating the DTLS Proxy ACK test to wait for the New Session ACK
Updated the DTLS 1.3 ACK tests that use the proxy to wait until
the ACK for the New Session Ticket is recieved.
Also updated some proxy tests now that the sessionfile can be
used and the DTLS1.3 client will shut down properly. This happens
because the Proxy sends a Close Notify Alert.
Also resolving a DTLS Proxy issue where the Proxy was not
taking into account the second fragment for a record and the
Handshake/Record Header.
Fixes: openssl/project#1669
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29221)
Commit: 3875bb8aa1cd933d8d6badd5e8deb985a0d832bd
https://github.com/openssl/openssl/commit/3875bb8aa1cd933d8d6badd5e8deb985a0d832bd
Author: Frederik Wedel-Heinen <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/dtlstest.c
Log Message:
-----------
Run test cases that were previously skipped for DTLS 1.3.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jan 7 09:11:11 2026
(Merged from https://github.com/openssl/openssl/pull/29501)
Commit: 223c797fb0c2cce60b3e5d979354ebe433ecdbee
https://github.com/openssl/openssl/commit/223c797fb0c2cce60b3e5d979354ebe433ecdbee
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls_common.c
M ssl/ssl_ciph.c
M ssl/tls13_enc.c
M test/sslapitest.c
Log Message:
-----------
Addressing last commented out SSLAPITests for DTLS1.3
The Authentication and Integrity only ciphers and when DTLS1.3
payload padding have been enabled with this change.
The tls13_add_record_padding function was updated to make sure
there is always 16 bytes of encrypted data.
If authentication and integrity only cipher is used the code
was updated to not call Sequence Number encrypt.
Fixes: openssl/project#1700
Fixes: openssl/project#1702
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Thu Jan 8 10:01:39 2026
(Merged from https://github.com/openssl/openssl/pull/29448)
Commit: 0362f640aa8ef6b8320491e75f1e1357d414e85a
https://github.com/openssl/openssl/commit/0362f640aa8ef6b8320491e75f1e1357d414e85a
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/internal/recordmethod.h
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/tls_common.c
M ssl/record/rec_layer_d1.c
M ssl/ssl_local.h
M ssl/statem/statem_clnt.c
M ssl/statem/statem_srvr.c
Log Message:
-----------
DTLS1.3 omits the Client sending the end of early data record.
Updated the state machine to not send the end of early data
record. Also updated the dtls get more records to handle the
scenario when in Epoch 1 we receive the client's Finish
message in Epoch 2.
Fixes: openssl/project#1701
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29449)
Commit: 428b52d21b4687d36385477034b04d8e078d0a06
https://github.com/openssl/openssl/commit/428b52d21b4687d36385477034b04d8e078d0a06
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13kexmodes.t
Log Message:
-----------
Enabling the TLSKexMode tests for DTLS1.3
The KEX Mode tests were disabled. The reason being is with PQ
algorithms DTLS1.3 will fragment the packet. The fragmented
client hello's two fragmented packets will be combined into
something larger than the MTU size. Thus, the server never
read the client hello. The client continuously sent out a new
client hello thus hanging the tests.
Fixes: openssl/project#1789
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29592)
Commit: e7d1bdb88cbdcf3dfbe9ffec8f714d7e00a7f932
https://github.com/openssl/openssl/commit/e7d1bdb88cbdcf3dfbe9ffec8f714d7e00a7f932
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13cookie.t
Log Message:
-----------
DTLS 1.3 Enable Cookie tests
Enabling the DTLS1.3 Cookie tests.
Fixes: openssl/project#1787
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29609)
Commit: 16de8a1469c7bbad559e06270f36ff9bd0fba71c
https://github.com/openssl/openssl/commit/16de8a1469c7bbad559e06270f36ff9bd0fba71c
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13downgrade.t
Log Message:
-----------
DTLS 1.3 Enabling Downgrade tests
Enabling the downgrade tests for DTLS 1.3.
Fixes: openssl/project#1788
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/29610)
Commit: d867aed046f88e1ffa71f99040be1691482dfe8a
https://github.com/openssl/openssl/commit/d867aed046f88e1ffa71f99040be1691482dfe8a
Author: Timothy Copeland <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/extensions_clnt.c
Log Message:
-----------
ssl/statem/extensions_clnt.c: Use proper TLS alert for semantic errs
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jan 21 16:46:28 2026
(Merged from https://github.com/openssl/openssl/pull/29469)
Commit: 896efe879cedc9489cc4f0566bd05c6c096e2c7d
https://github.com/openssl/openssl/commit/896efe879cedc9489cc4f0566bd05c6c096e2c7d
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13psk.t
Log Message:
-----------
The PSK tests were disabled cause of a Proxy issue, but that has
been resolved. They were failing now because of a PQ issue and
the TLS Proxy. In a nutshell the TLS Proxy doesn't handle
repacking correctly for fragmented packets.
Fixes: openssl/project/#1791
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Thu Jan 22 10:08:46 2026
(Merged from https://github.com/openssl/openssl/pull/29606)
Commit: 72cb449e92a2da9ff8e97de2b9a4c682752eef10
https://github.com/openssl/openssl/commit/72cb449e92a2da9ff8e97de2b9a4c682752eef10
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/statem/statem_lib.c
M test/recipes/80-test_ssl_new.t
M test/ssl-tests/29-dtls-sctp-label-bug.cnf
M test/ssl-tests/29-dtls-sctp-label-bug.cnf.in
M test/ssl-tests/protocol_version.pm
M test/ssl_test.c
Log Message:
-----------
Update SCTP support fot DTLS1.3
There is a draft RFC for DTLS1.3 over SCTP. This PR does not
address that draft RFC. Instead what it does is force DTLS
connections over SCTP to downgrade to DTLS1.2.
Fixes: openssl/project#1793
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Tue Mar 3 14:16:12 2026
(Merged from https://github.com/openssl/openssl/pull/30167)
Commit: 765a82117ff0a303d0668bfdef8d1e3cda7c10b8
https://github.com/openssl/openssl/commit/765a82117ff0a303d0668bfdef8d1e3cda7c10b8
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_sslrecords.t
Log Message:
-----------
70-test_sslrecords.t: Fix for the flakiness in the test with DTLS-1.3
A new DTLS test came over in the recent rebase and it
is a flaky test. It was not properly modified to
work with DTLS 1.3.
Fixes: openssl/project#1807
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Mar 4 17:30:29 2026
(Merged from https://github.com/openssl/openssl/pull/29745)
Commit: d98d86371b1926acc05be41765e5543c2a6fc25e
https://github.com/openssl/openssl/commit/d98d86371b1926acc05be41765e5543c2a6fc25e
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M util/perl/TLSProxy/Proxy.pm
Log Message:
-----------
DTLS 1.3 ACK test cleanup
The DTLS1.3 ACK test is flaky. Usually when you run it the client
sends the "test" data before processing the Server's
NewSessionTicket. Though in scenarios when the client process the
NewSessionTicket and send the ACK for it before sending the "test"
data we will end up exiting the test before seeing the second
NewSessionTicket and the corresponding ACK.
I updated the code to check for the two NewSessionTicket ACKs to
wait for two unique NewSessionTicket ACK messages. I believe
what was happening is the one ACK message was being counted
twice thus breaking the test.
Fixes: openssl/project#1806
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Mar 10 18:34:18 2026
(Merged from https://github.com/openssl/openssl/pull/29626)
Commit: 07091557c3143b8bba344c5c3c3a839d97e4b38d
https://github.com/openssl/openssl/commit/07091557c3143b8bba344c5c3c3a839d97e4b38d
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_tls13messages.t
M util/perl/TLSProxy/Message.pm
M util/perl/TLSProxy/Proxy.pm
Log Message:
-----------
Enabling the DTLS 1.3 Message tests
There were a couple of problems with the test. First the Proxy
needed to reOpen the UDP socket after the client closes it.
Without this traffic will not flow through the proxy.
The second issue is around sending the Sever socket an alert
message. Since we are DTLS1.3 closing the socket doesn't
notify the server to close the connection. Thus this is
done by sending an Alert message via the Proxy.
Fixes: openssl/project#1790
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Mon Mar 16 10:59:52 2026
(Merged from https://github.com/openssl/openssl/pull/29961)
Commit: 461f61883d65e5fa440b54f7d2a2f0f12ea26545
https://github.com/openssl/openssl/commit/461f61883d65e5fa440b54f7d2a2f0f12ea26545
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_d1.c
M ssl/record/rec_layer_s3.c
M ssl/s3_lib.c
M ssl/ssl_lib.c
M ssl/statem/statem_clnt.c
M test/recipes/80-test_ssl_new.t
M test/ssl-tests/11-dtls_resumption.cnf
M test/ssl-tests/protocol_version.pm
Log Message:
-----------
DTLS 1.3 Enable Resumption Tests
Enable teh DTLS resumption tests for DTLS1.3.
Fixes: openssl/project#1794
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Mon Mar 16 11:07:16 2026
(Merged from https://github.com/openssl/openssl/pull/30258)
Commit: 6a23b86ec0a19f5223f995f50c89ec2a322d69cf
https://github.com/openssl/openssl/commit/6a23b86ec0a19f5223f995f50c89ec2a322d69cf
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
Log Message:
-----------
DTLS 1.3 remove unecessary TODO
There was a TODO to convert rl->sequence to 64 bit integer.
Though you still needed it in byte format for the encryption
and decryption of the sequence number. Thus you were just moving
the complexity. The TODO has been removed.
Fixes: openssl/project#1784
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Mon Mar 16 11:13:57 2026
(Merged from https://github.com/openssl/openssl/pull/30352)
Commit: f8481c540f51dad21f2fd891c33553846add2407
https://github.com/openssl/openssl/commit/f8481c540f51dad21f2fd891c33553846add2407
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/designs/quic-design/record-layer.md
M include/internal/recordmethod.h
M ssl/d1_lib.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls_common.c
M ssl/record/rec_layer_d1.c
M ssl/record/rec_layer_s3.c
M ssl/record/record.h
M ssl/ssl_local.h
M ssl/t1_enc.c
M ssl/tls13_enc.c
M test/tls13secretstest.c
Log Message:
-----------
DTLS 1.3 Update Epoch to a 64 bit counter and don't allow wrapping
This is based off a prior PR that was closed. The epoch was updated
for a 64 bit counter. A 16 bit epoch is kept when we read the
epoch from the wire in store it in the record layer.
Fixes: openssl/project#1796
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Thu Mar 19 17:30:18 2026
(Merged from https://github.com/openssl/openssl/pull/30394)
Commit: b7870df5ed5a0cd903958c3147f9e0324092c035
https://github.com/openssl/openssl/commit/b7870df5ed5a0cd903958c3147f9e0324092c035
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/d1_lib.c
M ssl/ssl_lib.c
M ssl/ssl_local.h
M util/perl/TLSProxy/Proxy.pm
Log Message:
-----------
DTLS 1.3 remove the last TODO in Proxy.pm and Clean up Double Free
When removing the last todo in proxy it encountered a double free.
The changes are to address that double free.
Fixes: openssl/project#1795
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Apr 8 10:04:10 2026
(Merged from https://github.com/openssl/openssl/pull/30415)
Commit: a41b32be451488a60c6f1faf5c5a1c23951df60e
https://github.com/openssl/openssl/commit/a41b32be451488a60c6f1faf5c5a1c23951df60e
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
Log Message:
-----------
DTLS 1.3 Epoch bits that don't match are from a prior epoch
When receiving a unified header if the epoch lower bytes do
not match we assumed it was from a future epoch. The RFC
says we should assume it is from a prior epoch.
Updating the code to match the RFC. For early data (epoch 1)
we still need to increment the epoch if it is a handshake
message in epoch 2.
Fixes: openssl/project#1912
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Apr 8 10:06:29 2026
(Merged from https://github.com/openssl/openssl/pull/30570)
Commit: 390424a7cc6c6736d3c3ecc6fc4077c240e29882
https://github.com/openssl/openssl/commit/390424a7cc6c6736d3c3ecc6fc4077c240e29882
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M doc/man3/DTLSv1_listen.pod
M ssl/ssl_lib.c
M test/build.info
M test/dtlsv1listentest.c
M test/recipes/80-test_dtlsv1listen.t
M test/sslapitest.c
Log Message:
-----------
DTLS 1.3 Enable SSL_Stateless and enable DTLSv1Listen Tests
Updated SSL_stateless to keep the sequence nunber
for DTLS 1.3. Without this information the client would be
sending Seq numbers that it thinks is correct and the server
will not process it since it is looking for sequence zero.
Update DTLSv1ListenTest.c to test a client that supports DTLS1.2
and DTLS1.3. It will use a Hello Verify Request.
Added a test that will fail when a client that only supports
DTLS1.3 uses DTLSv1_listen. Instead the user should use
SSL_statless.
Fixes: openssl/project#1829
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Thu Apr 16 16:59:25 2026
(Merged from https://github.com/openssl/openssl/pull/30558)
Commit: 841000d1bcafb36a29cda53f0d02b31b6e382478
https://github.com/openssl/openssl/commit/841000d1bcafb36a29cda53f0d02b31b6e382478
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/rec_layer_d1.c
M ssl/ssl_lib.c
M ssl/ssl_local.h
M ssl/statem/statem.c
M ssl/statem/statem_clnt.c
M ssl/statem/statem_srvr.c
M test/dtlstest.c
M test/helpers/ssltestlib.c
M test/helpers/ssltestlib.h
M test/recipes/70-test_tls13alerts.t
M test/recipes/70-test_tls13hrr.t
Log Message:
-----------
Addressing how DTLS 1.3 handles Read Record Layer transitions.
Currently the state machine moves the read record layer to the
next epoch base off of state events. The problem with this is
when either the client or the server sent out a record during
the handshake that causes an alert. If the state machine moved
either the client or server to the next epoch it will not
be able to handle that alert message. This approach delays
moving the read record layer to the next epoch until we
actually receive a record in that epoch. This allows us
to process the alert messages.
Fixes: openssl/project#1786
Fixes: openssl/project#1785
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
MergeDate: Thu Apr 16 17:22:48 2026
(Merged from https://github.com/openssl/openssl/pull/29946)
Commit: d82a66960b43389701e9dd7dd35d02fceb34cd9b
https://github.com/openssl/openssl/commit/d82a66960b43389701e9dd7dd35d02fceb34cd9b
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/methods/dtls_meth.c
Log Message:
-----------
DTLS 1.3 Fixing issue on DTLS Branch
The last two commits didn't have a merge conflict, but they also
didn't play nice together. This PR fixes the tests.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
MergeDate: Mon Apr 27 06:18:02 2026
(Merged from https://github.com/openssl/openssl/pull/30905)
Commit: 46400267f329dff3d0171e2871668fab65c664f7
https://github.com/openssl/openssl/commit/46400267f329dff3d0171e2871668fab65c664f7
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M include/internal/recordmethod.h
M ssl/d1_lib.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls13_meth.c
M ssl/record/methods/tls1_meth.c
M ssl/record/methods/tls_common.c
M ssl/record/methods/tlsany_meth.c
M ssl/record/rec_layer_s3.c
M ssl/record/record.h
M ssl/ssl_ciph.c
M ssl/ssl_local.h
M ssl/ssl_txt.c
M ssl/statem/statem_clnt.c
M ssl/t1_enc.c
M ssl/tls13_enc.c
M test/build.info
A test/dtls13_internal_test.c
A test/recipes/60-test_dtls13_internal.t
M test/tls13encryptiontest.c
M test/tls13secretstest.c
Log Message:
-----------
DTLS 1.3 Interop Issue with NSS using ChaCha20
When using ChaCha20 for DTLS1.3 the encrypted sequence
number was never being decrypted properly. Instead it
was always a larger number.
Updated the dlts_crypt_sequence_number to match the RFC.
Fixes: openssl/project#1929
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Thu Apr 30 09:55:50 2026
(Merged from https://github.com/openssl/openssl/pull/30807)
Commit: 3afd51383c34f1b60afcd9e687448b5920a378a2
https://github.com/openssl/openssl/commit/3afd51383c34f1b60afcd9e687448b5920a378a2
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_d1.c
M test/dtlstest.c
M test/recipes/70-test_tls13alerts.t
Log Message:
-----------
DTLS 1.3 Buffer App Data received before ACK
For DTLS 1.3 App Data may arrive before an expected ack
message. We will now buffer it and process it after we
process the ACK and end in_init.
Fixes: openssl/project#1908
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon May 4 15:18:37 2026
(Merged from https://github.com/openssl/openssl/pull/30998)
Commit: 9a25c5de339ea56631f52d86677fc60a75be572e
https://github.com/openssl/openssl/commit/9a25c5de339ea56631f52d86677fc60a75be572e
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/dtlstest.c
Log Message:
-----------
DTLS 1.3 Fixing No Integrity Ciphers CI
The only integrity Ciphers CI is currently broken for dtlstest
These ciphers are needed so we have an unencrypted sequence
number so we can swap records around.
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon May 4 15:20:46 2026
(Merged from https://github.com/openssl/openssl/pull/31034)
Commit: 20991fcaf45e1be5b134b0bffe092a770d57c839
https://github.com/openssl/openssl/commit/20991fcaf45e1be5b134b0bffe092a770d57c839
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_dtls13ack.t
M test/recipes/70-test_dtls13epoch.t
Log Message:
-----------
DTLS 1.3 Fixing test SKIPs not in code block
Fixing up two tests that are not putting skip's in a SKIP
block. These were identified by a FreeBSD image.
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
MergeDate: Thu May 7 12:27:29 2026
(Merged from https://github.com/openssl/openssl/pull/31089)
Commit: 388991a831ef4f3e40eab11e047ad6810874583d
https://github.com/openssl/openssl/commit/388991a831ef4f3e40eab11e047ad6810874583d
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M .codespellrc
M doc/build.info
M doc/designs/dtlsv1_3/dtlsv1_3-main.md
A doc/man7/ossl-guide-dtlsv13.pod
Log Message:
-----------
Update the DTLS 1.3 documentation to match the final implementation
Added an ossl-guid-dtlsv13 file to describe OpenSSL's DTLSv1.3
implementation.
Fixes: openssl/project#1831
Fixes: openssl/project#1830
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Thu May 21 08:50:49 2026
(Merged from https://github.com/openssl/openssl/pull/31032)
Commit: 00389e492b4a6077d3cc4dc2901d1d0196c20c02
https://github.com/openssl/openssl/commit/00389e492b4a6077d3cc4dc2901d1d0196c20c02
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M .gitignore
M demos/build.info
A demos/dtlsecho/A-SSL-Docs.txt
A demos/dtlsecho/README.md
A demos/dtlsecho/build.info
A demos/dtlsecho/cert.pem
A demos/dtlsecho/key.pem
A demos/dtlsecho/main.c
M ssl/record/rec_layer_d1.c
M ssl/statem/statem.c
M test/dtlstest.c
Log Message:
-----------
DTLS 1.3 Demo and Bug Fix
Added a DTLS 1.3 demo based off of the SSL echo demo. The client
takes input from the user and sends it to the server. The server
echos that input back.
There was a bug if the server retransmitted New Session tickets
cause it didn't receive the ACK for the first set of New Session
tickets. The changes outside of the demo application are to fix
that bug.
Fixes: openssl/project#1943
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed May 27 08:02:57 2026
(Merged from https://github.com/openssl/openssl/pull/31042)
Commit: 3f1719aeeef9cf516837f1ac653fc2af1319da59
https://github.com/openssl/openssl/commit/3f1719aeeef9cf516837f1ac653fc2af1319da59
Author: Ryan Hooper <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M crypto/bio/bf_buff.c
M crypto/bio/bio_sock.c
M crypto/thread/build.info
M doc/man3/BIO_socket_wait.pod
M doc/man3/DTLSv1_listen.pod
M doc/man3/SSL_new_listener.pod
M doc/man3/SSL_set_bio.pod
A include/internal/dgram_conn_lookup.h
A include/internal/dgram_demux.h
A include/internal/dtls_record_rx.h
M include/internal/quic_channel.h
M include/internal/quic_demux.h
M include/internal/quic_predef.h
M include/internal/recordmethod.h
M include/internal/ssl_unwrap.h
M include/openssl/bio.h.in
M include/openssl/ssl.h.in
M ssl/build.info
M ssl/d1_lib.c
A ssl/dgram_demux.c
A ssl/dtls_conn_lookup.c
A ssl/dtls_record_rx.c
M ssl/quic/quic_demux.c
M ssl/quic/quic_tls.c
M ssl/record/methods/dtls_meth.c
M ssl/record/methods/ktls_meth.c
M ssl/record/methods/recmethod_local.h
M ssl/record/methods/tls_common.c
M ssl/record/rec_layer_d1.c
M ssl/record/rec_layer_s3.c
M ssl/record/record.h
M ssl/rio/build.info
M ssl/rio/poll_immediate.c
M ssl/ssl_lib.c
M ssl/ssl_local.h
M ssl/statem/extensions_srvr.c
M ssl/statem/statem_srvr.c
M test/build.info
A test/dtls_multithread_test.c
A test/dtlsssllistenertest.c
M test/dtlsv1listentest.c
A test/recipes/80-test_dtls_multithread.t
A test/recipes/80-test_dtlsssllistener.t
M test/tls13encryptiontest.c
M util/libcrypto.num
M util/libssl.num
M util/other.syms
Log Message:
-----------
DTLS 1.3 Limit DTLSv1_listen to DTLS1.2 and add SSL Listener for DTLS
DTLSv1_listen will not support DTLSv1.3. Instead its max version is
DTLSv1.2
Adding DTLS SSL Listener that utilizes a similar DEMUX approach as
QUIC and passes traffic through the URXE structure.
This will establish full connection and an application can ask for
a ready SSL connection. The DTLS SSL listener also supports HVR
and HRR cookie validation.
Fixes: openssl/project#1946
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Mon Jul 6 09:29:09 2026
(Merged from https://github.com/openssl/openssl/pull/31137)
Commit: 3e2193d6570baa3fbee7a96989920934afefb180
https://github.com/openssl/openssl/commit/3e2193d6570baa3fbee7a96989920934afefb180
Author: Matt Caswell <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M test/recipes/70-test_sslrecords.t
M test/recipes/70-test_tls13cookie.t
M test/recipes/70-test_tls13downgrade.t
M test/recipes/70-test_tls13messages.t
M test/recipes/70-test_tls13psk.t
Log Message:
-----------
Skip failing DTLS 1.3 TLSProxy tests pending investigation
Several DTLS 1.3 test cases driven through TLSProxy currently fail or
hang. To keep the tree buildable and testable while the DTLS 1.3 work
is under review, skip the affected sub-tests (or whole DTLS runs) with
TODO(DTLS1.3) markers. These are to be addressed in a follow-up.
Skipped for DTLS:
- 70-test_tls13psk.t: "Remove sig algs", "Too many PSKs" and
"Bad PSK with no handshake fallback"
- 70-test_tls13cookie.t: the DTLS run
- 70-test_sslrecords.t: "Empty app data in DTLS"
- 70-test_tls13downgrade.t: the DTLS run
- 70-test_tls13messages.t: the DTLS run
Also skipped in 70-test_tls13messages.t: "HelloRequest rejected in
TLSv1.3" and "HelloRequest ignored in (D)TLSv1.2". These fail for TLS
as well as DTLS, so the failure is not proxy-specific and needs
separate investigation.
Assisted-by: Claude Code:claude-opus-4-8
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jul 13 14:24:27 2026
(Merged from https://github.com/openssl/openssl/pull/31896)
Commit: bbbfec348330a420f1353c0e9f0035b4f1fbcbbd
https://github.com/openssl/openssl/commit/bbbfec348330a420f1353c0e9f0035b4f1fbcbbd
Author: Matt Caswell <[email protected]>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M ssl/record/rec_layer_s3.c
Log Message:
-----------
Restore DTLS listener peer-address propagation to new record layers
Listener-created DTLS connections could not complete a handshake: the
peer address was applied to the initial plaintext record layers by
SSL_set1_initial_peer_addr(), but the write record layer recreated when
encryption is enabled started with no peer, so tls_retry_write_records()
fell back from BIO_sendmmsg() to BIO_write() on the shared listener BIO
and the bytes went nowhere.
This adaptation was lost when the branch was rebased: the change was
originally written when the new_record_layer record method callback took
a peer argument, whereas current record layers set the peer via the
separate set1_peer callback. Re-apply the peer to every DTLS record
layer as it is created in ssl_set_new_record_layer(), mirroring the
existing use_urxe handling.
Fixes test_dtlsssllistener and test_dtls_multithread.
Assisted-by: Claude Code:claude-opus-4-8
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jul 13 14:24:18 2026
(Merged from https://github.com/openssl/openssl/pull/31896)
Compare: https://github.com/openssl/openssl/compare/6bf938f23929...bbbfec348330
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/feature/dtls-1.3/6bf938-bbbfec%40github.com.