[openssl/openssl] db5b98: Migrate QUIC_TSERVER script 13 and script 14 to radix

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: db5b9853692acc99d07626c2e23e54cae2ef4faa
      https://github.com/openssl/openssl/commit/db5b9853692acc99d07626c2e23e54cae2ef4faa
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Migrate QUIC_TSERVER script 13 and script 14 to radix

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:19:57 2026
(Merged from https://github.com/openssl/openssl/pull/31945)


  Commit: 458bfef110dc0f1d2bbe4eb93840f32c51b9d50d
      https://github.com/openssl/openssl/commit/458bfef110dc0f1d2bbe4eb93840f32c51b9d50d
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M Configurations/unix-Makefile.tmpl

  Log Message:
  -----------
  Fix clean target find/-prune precedence bug

The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.

Assisted-by: Claude:claude-sonnet-5
Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster"

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)


  Commit: b27fe1419c2a043eb34d18cdc9469a093f9892c9
      https://github.com/openssl/openssl/commit/b27fe1419c2a043eb34d18cdc9469a093f9892c9
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Port script_15 to radix test framework

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:44 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: e528888bc069f216620ea9d7062c673c18bafdcc
      https://github.com/openssl/openssl/commit/e528888bc069f216620ea9d7062c673c18bafdcc
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Port script_16 to radix test framework

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:46 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: 9b94348003b2412187b22e3ee2201d16816e44fb
      https://github.com/openssl/openssl/commit/9b94348003b2412187b22e3ee2201d16816e44fb
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_ops.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Port script_17 to radix test framework

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:48 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: 7c6adaee6b15eed7eb44bb0c08411dc165940bdb
      https://github.com/openssl/openssl/commit/7c6adaee6b15eed7eb44bb0c08411dc165940bdb
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Port script_18 to radix test framework

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:49 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: 08d3dd81b2e4ca23afbd3dc0520ae3b499107dc5
      https://github.com/openssl/openssl/commit/08d3dd81b2e4ca23afbd3dc0520ae3b499107dc5
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/quic_multistream_test.c
    M test/radix/quic_ops.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Port script_19 to radix test framework

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:51 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: fcba83dc4d2a50581466eadd1598e1dd9c0cea03
      https://github.com/openssl/openssl/commit/fcba83dc4d2a50581466eadd1598e1dd9c0cea03
  Author: Andrew Dinh <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M test/radix/quic_bindings.c
    M test/radix/quic_ops.c

  Log Message:
  -----------
  Wire radix QUIC test framework clock to simulated time

script_17/18/19 (key update tests) rely on OP_SKIP_TIME to advance
simulated time so that TXKU cooldown/RTT-gated behaviour can be
exercised deterministically, but the framework never actually plumbed
that simulated clock into the QUIC channels under test -- OP_SKIP_TIME
only affected the terp's own bookkeeping, so real key updates only
ever occurred by chance regardless of how much time was "skipped".

Fix this by:

- Calling ossl_quic_set_override_now_cb() in hf_new_ssl() so each QUIC
  channel actually uses the framework's simulated clock, matching what
  the older quictestlib.c harness already did via fake_now_cb().
- Activating the server-side connection object in hf_accept_conn() so
  it gets ticked (SSL_handle_events()) like every other object, driving
  its internal key-update/timer processing forward.

Two correctness issues had to be addressed to make this clock
plumbing safe and deterministic:

- The clock handed to QUIC channels must be purely virtual (a fixed
  base time plus an explicit slip that only advances via
  radix_skip_time()/OP_SKIP_TIME), not real wall-clock time, or
  protocol-timing-sensitive assertions become flaky depending on how
  long real cryptographic work takes on a given machine (e.g. much
  slower on ASAN+UBSAN debug builds), occasionally triggering a
  spurious second TXKU before the first is confirmed. radix_process is
  a single static struct reused across every script in the suite, so
  time_slip must be reset in RADIX_PROCESS_init() -- otherwise a
  script would inherit the previous script's accumulated slip and see
  time jump forward all at once for a brand new connection. The
  virtual clock also needs a small, fixed per-tick advance
  (do_per_op(), mirroring the old harness's qtest_add_time(1) in its
  own connect-wait loop), since QUIC's internal timers need to
  observe time actually passing to make progress during a busy-wait
  such as hf_connect_wait spinning on SSL_connect().
- time_slip needs its own dedicated mutex (time_m) rather than being
  protected by the existing global mutex (gm): get_time() is now
  called by libssl/QUIC's internals (e.g. from within the reactor tick
  while holding QUIC's own locks), whereas gm is held by test code
  across calls into libssl (e.g. hf_clear() holds gm while calling
  SSL_free()). Sharing gm would take gm and QUIC's internal lock in
  opposite orders across those two paths, risking a real deadlock
  (confirmed via a ThreadSanitizer lock-order-inversion report).
- The terp's own script-execution watchdog (max_execution_time) needs
  its own now_cb (terp_now) based on real wall-clock time, so that
  OP_SKIP_TIME doesn't eat into its execution budget, and so it can
  still catch a genuinely stuck script independent of the virtual
  protocol clock. Some scripts also legitimately need a larger budget
  than the terp default on slow or heavily instrumented CI machines.

Assisted-by: Claude:claude-sonnet-5

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Tue Jul 21 09:22:53 2026
(Merged from https://github.com/openssl/openssl/pull/31889)


  Commit: 63afe639141faf49a62611808651b2b80030c64b
      https://github.com/openssl/openssl/commit/63afe639141faf49a62611808651b2b80030c64b
  Author: Nikola Pajkovsky <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M fuzz/quic-srtm.c
    M include/internal/quic_srtm.h
    M ssl/quic/quic_channel.c
    M ssl/quic/quic_srtm.c
    M test/quic_srtm_test.c

  Log Message:
  -----------
  quic: report SRTM entry match status via an output argument

Coverity (CID 1696969, CHECKED_RETURN) flagged the ignored return value of
ossl_quic_srtm_remove() in ch_enqueue_retire_conn_id(). The return value
could not be usefully checked because 0 was overloaded to mean both "no
matching entry" and a genuine internal failure (alloc_failed or an
lhash consistency error).

Give the return value a single meaning (1 on success, 0 on internal
error) and report whether a matching entry was found through a new
uint8_t *match output argument, which may be NULL if the caller does not
need it.

Resolved: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1696969
Signed-off-by: Nikola Pajkovsky <[email protected]>

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Jul 21 09:24:45 2026
(Merged from https://github.com/openssl/openssl/pull/31974)


Compare: https://github.com/openssl/openssl/compare/a44ba221abc6...63afe639141f

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/a44ba2-63afe6%40github.com.