[openssl/openssl] 408415: QUIC server: limit number of pending QUIC channels...

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 4084152e040329ca0194c4c1750b9b46d00a5b6b
      https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M doc/man3/SSL_get_value_uint.pod
    M include/internal/quic_port.h
    M include/openssl/ssl.h.in
    M ssl/quic/quic_impl.c
    M ssl/quic/quic_port.c
    M ssl/quic/quic_port_local.h
    M util/other.syms

  Log Message:
  -----------
  QUIC server: limit number of pending QUIC channels/connections

Currently, there is no limit for pending QUIC connections.  The port
default packet handler creates channel for every valid initial packet
which does belong to existing channel (a.k.a. connection).  The newly
created channel is inserted to list of pending channels where it waits
to be accepted by local application by call
to SSL_accept_connection(3ossl).

This change introduces a limit for pending connection.  The pending
queue is limited to 256 pending connections.  Applications may change
the limit by calling SSL_set_feature_request_uint(3ossl)
on SSL server listener object with configurable value
SSL_VALUE_QUIC_MAX_PENDING_CONNS.

Fixes: CVE-2026-14456

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 9416706d408bb84deb7cee4647bff3045d2dc7ba)


  Commit: 50c55eed777b1f9041256399f9cc6b3cc0c91f23
      https://github.com/openssl/openssl/commit/50c55eed777b1f9041256399f9cc6b3cc0c91f23
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M test/helpers/quictestlib.c
    M test/helpers/quictestlib.h

  Log Message:
  -----------
  test/quictestlib.c: add functions to create QUIC objects on dgram bio

Add the following helper functions:
  * create_quic_ctx_pair() - creates pair of SSL_CTX (server, client).
  * create_quic_conn_objects() - creates pair of SSL objects, client
    and listener.  They both are 'connected' by BIO_dgram_pair.
  * create_quic_client() - creates SSL QUIC client object bound to BIO
    object provided by caller.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit f20e51341d3134bed58e6bb18475b80bfd5712ce)


  Commit: d446963b2622ee371df76971e5e2ddc7289839c4
      https://github.com/openssl/openssl/commit/d446963b2622ee371df76971e5e2ddc7289839c4
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M include/internal/quic_ssl.h
    M ssl/quic/quic_impl.c
    M test/quicapitest.c

  Log Message:
  -----------
  test/quicapitest.c: add test for pending connections limit enforcement

This is a regression test for CVE-2026-14456.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:30 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 0461a5636deca9af034db70ff017ad1138836c8c)


Compare: https://github.com/openssl/openssl/compare/88725073f8e7...d446963b2622

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/887250-d44696%40github.com.