[openssl/openssl] 08e775: QUIC server: limit number of pending QUIC channels...

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 08e7756c3900bcfd77a720e7b74e27d6e4ed01a9
      https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M doc/man3/SSL_get_value_uint.pod
    M include/internal/quic_port.h
    M include/openssl/ssl.h.in
    M ssl/quic/quic_impl.c
    M ssl/quic/quic_port.c
    M ssl/quic/quic_port_local.h
    M util/other.syms

  Log Message:
  -----------
  QUIC server: limit number of pending QUIC channels/connections

Currently, there is no limit for pending QUIC connections.  The port
default packet handler creates channel for every valid initial packet
which does belong to existing channel (a.k.a. connection).  The newly
created channel is inserted to list of pending channels where it waits
to be accepted by local application by call
to SSL_accept_connection(3ossl).

This change introduces a limit for pending connection.  The pending
queue is limited to 256 pending connections.  Applications may change
the limit by calling SSL_set_feature_request_uint(3ossl)
on SSL server listener object with configurable value
SSL_VALUE_QUIC_MAX_PENDING_CONNS.

Fixes: CVE-2026-14456

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 9416706d408bb84deb7cee4647bff3045d2dc7ba)
(cherry picked from commit 4084152e040329ca0194c4c1750b9b46d00a5b6b)


  Commit: 2417e4ffdd09417cab6db8fab0b7bbadf4d185a7
      https://github.com/openssl/openssl/commit/2417e4ffdd09417cab6db8fab0b7bbadf4d185a7
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M test/helpers/quictestlib.c
    M test/helpers/quictestlib.h

  Log Message:
  -----------
  test/quictestlib.c: add functions to create QUIC objects on dgram bio

Add the following helper functions:
  * create_quic_ctx_pair() - creates pair of SSL_CTX (server, client).
  * create_quic_conn_objects() - creates pair of SSL objects, client
    and listener.  They both are 'connected' by BIO_dgram_pair.
  * create_quic_client() - creates SSL QUIC client object bound to BIO
    object provided by caller.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:27 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit f20e51341d3134bed58e6bb18475b80bfd5712ce)
(cherry picked from commit 50c55eed777b1f9041256399f9cc6b3cc0c91f23)


  Commit: b05a190fe598cc1deb6d6e314ab8d1c4dd2d4436
      https://github.com/openssl/openssl/commit/b05a190fe598cc1deb6d6e314ab8d1c4dd2d4436
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M include/internal/quic_ssl.h
    M ssl/quic/quic_impl.c
    M test/quicapitest.c

  Log Message:
  -----------
  test/quicapitest.c: add test for pending connections limit enforcement

This is a regression test for CVE-2026-14456.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Wed Aug 12 15:00:30 2026
(Merged from https://github.com/openssl/openssl/pull/32052)

(cherry picked from commit 0461a5636deca9af034db70ff017ad1138836c8c)
(cherry picked from commit d446963b2622ee371df76971e5e2ddc7289839c4)


Compare: https://github.com/openssl/openssl/compare/2dacccc943b4...b05a190fe598

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/2daccc-b05a19%40github.com.