[openssl/openssl] f2f146: QUIC server: limit number of pending QUIC channels...

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: f2f1465f2d2e5c61dfeac4d20fd093797d821139
      https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M doc/man3/SSL_get_value_uint.pod
    M include/internal/quic_port.h
    M include/openssl/ssl.h.in
    M ssl/quic/quic_impl.c
    M ssl/quic/quic_port.c
    M ssl/quic/quic_port_local.h
    M util/other.syms

  Log Message:
  -----------
  QUIC server: limit number of pending QUIC channels/connections

Currently, there is no limit for pending QUIC connections.  The port
default packet handler creates channel for every valid initial packet
which does belong to existing channel (a.k.a. connection).  The newly
created channel is inserted to list of pending channels where it waits
to be accepted by local application by call
to SSL_accept_connection(3ossl).

This change introduces a limit for pending connection.  The pending
queue is limited to 256 pending connections.  Applications may change
the limit by calling SSL_set_feature_request_uint(3ossl)
on SSL server listener object with configurable value
SSL_VALUE_QUIC_MAX_PENDING_CONNS.

Fixes: CVE-2026-14456

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 9416706d408bb84deb7cee4647bff3045d2dc7ba)


  Commit: f4ac5042fb6d1f5411e0a6ac8df0f235ac1e7d68
      https://github.com/openssl/openssl/commit/f4ac5042fb6d1f5411e0a6ac8df0f235ac1e7d68
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M test/helpers/quictestlib.c
    M test/helpers/quictestlib.h

  Log Message:
  -----------
  test/quictestlib.c: add functions to create QUIC objects on dgram bio

Add the following helper functions:
  * create_quic_ctx_pair() - creates pair of SSL_CTX (server, client).
  * create_quic_conn_objects() - creates pair of SSL objects, client
    and listener.  They both are 'connected' by BIO_dgram_pair.
  * create_quic_client() - creates SSL QUIC client object bound to BIO
    object provided by caller.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit f20e51341d3134bed58e6bb18475b80bfd5712ce)


  Commit: e437c849dd869113471ee95ba871f57c955ec497
      https://github.com/openssl/openssl/commit/e437c849dd869113471ee95ba871f57c955ec497
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M include/internal/quic_ssl.h
    M ssl/quic/quic_impl.c
    M test/quicapitest.c

  Log Message:
  -----------
  test/quicapitest.c: add test for pending connections limit enforcement

This is a regression test for CVE-2026-14456.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:30 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 0461a5636deca9af034db70ff017ad1138836c8c)


Compare: https://github.com/openssl/openssl/compare/36224b7f6552...e437c849dd86

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/36224b-e437c8%40github.com.