[openssl/openssl] 941670: QUIC server: limit number of pending QUIC channels...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 9416706d408bb84deb7cee4647bff3045d2dc7ba
      https://github.com/openssl/openssl/commit/9416706d408bb84deb7cee4647bff3045d2dc7ba
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M doc/man3/SSL_get_value_uint.pod
    M include/internal/quic_port.h
    M include/openssl/ssl.h.in
    M ssl/quic/quic_impl.c
    M ssl/quic/quic_port.c
    M ssl/quic/quic_port_local.h
    M util/other.syms

  Log Message:
  -----------
  QUIC server: limit number of pending QUIC channels/connections

Currently, there is no limit for pending QUIC connections.  The port
default packet handler creates channel for every valid initial packet
which does belong to existing channel (a.k.a. connection).  The newly
created channel is inserted to list of pending channels where it waits
to be accepted by local application by call
to SSL_accept_connection(3ossl).

This change introduces a limit for pending connection.  The pending
queue is limited to 256 pending connections.  Applications may change
the limit by calling SSL_set_feature_request_uint(3ossl)
on SSL server listener object with configurable value
SSL_VALUE_QUIC_MAX_PENDING_CONNS.

Fixes: CVE-2026-14456

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/32052)


  Commit: f20e51341d3134bed58e6bb18475b80bfd5712ce
      https://github.com/openssl/openssl/commit/f20e51341d3134bed58e6bb18475b80bfd5712ce
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M test/helpers/quictestlib.c
    M test/helpers/quictestlib.h

  Log Message:
  -----------
  test/quictestlib.c: add functions to create QUIC objects on dgram bio

Add the following helper functions:
  * create_quic_ctx_pair() - creates pair of SSL_CTX (server, client).
  * create_quic_conn_objects() - creates pair of SSL objects, client
    and listener.  They both are 'connected' by BIO_dgram_pair.
  * create_quic_client() - creates SSL QUIC client object bound to BIO
    object provided by caller.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/32052)


  Commit: 0461a5636deca9af034db70ff017ad1138836c8c
      https://github.com/openssl/openssl/commit/0461a5636deca9af034db70ff017ad1138836c8c
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M include/internal/quic_ssl.h
    M ssl/quic/quic_impl.c
    M test/quicapitest.c

  Log Message:
  -----------
  test/quicapitest.c: add test for pending connections limit enforcement

This is a regression test for CVE-2026-14456.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:30 2026
(Merged from https://github.com/openssl/openssl/pull/32052)


Compare: https://github.com/openssl/openssl/compare/2c9a078b6030...0461a5636dec

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/2c9a07-0461a5%40github.com.