[openssl/openssl] 6452b5: DTLS 1.3 SSL Listener Demo

  Branch: refs/heads/feature/dtls-1.3
  Home:   https://github.com/openssl/openssl
  Commit: 6452b56a4c6056321b314fc6e781b1c362774356
      https://github.com/openssl/openssl/commit/6452b56a4c6056321b314fc6e781b1c362774356
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M demos/build.info
    M demos/dtlsecho/main.c
    A demos/dtlslistenerecho/README.md
    A demos/dtlslistenerecho/build.info
    A demos/dtlslistenerecho/cert.pem
    A demos/dtlslistenerecho/key.pem
    A demos/dtlslistenerecho/main.c
    M doc/man7/ossl-guide-dtlsv13.pod

  Log Message:
  -----------
  DTLS 1.3 SSL Listener Demo

Demo utilizing the SSL Listener for DTLS. It runs in multiple
threads that will echo what a client sends.

Currently up to 10 clients can make a connection. A client can
close the connection by sending kill. If a client sends
killall the server will close all the connections and free
up all the resources being used.

Fixes: openssl/project#1957
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:50:36 2026
Merged-from: https://github.com/openssl/openssl/pull/31983


  Commit: 5784d1d39de9a4697e65226d6df11c8ee32d81c9
      https://github.com/openssl/openssl/commit/5784d1d39de9a4697e65226d6df11c8ee32d81c9
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M demos/dtlslistenerecho/README.md
    M demos/dtlslistenerecho/main.c
    M doc/man7/ossl-guide-dtlsv13.pod

  Log Message:
  -----------
  DTLS 1.3 Set the listener demo to non-blocking mode

A DTLS listener, and the connections it accepts, now default to
blocking mode. The dtlslistenerecho demo drives the listener and its
connections with SSL_poll() and uses SSL_ACCEPT_CONNECTION_NO_BLOCK,
so call SSL_set_blocking_mode() on the listener to put it back into
non-blocking mode. The accepted connections inherit that mode.

Also update the DTLS 1.3 guide (ossl-guide-dtlsv13) to mention
SSL_set_blocking_mode() and SSL_get_blocking_mode() for DTLS
listeners and to note that a listener is blocking by default.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:50:38 2026
Merged-from: https://github.com/openssl/openssl/pull/31983


  Commit: 1c3e81c7d1c19529ad36b40ff5198eaf234b5da5
      https://github.com/openssl/openssl/commit/1c3e81c7d1c19529ad36b40ff5198eaf234b5da5
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M CHANGES.md
    M demos/dtlslistenerecho/main.c
    M doc/man3/DTLSv1_listen.pod
    M doc/man3/SSL_new_listener.pod
    M doc/man7/ossl-guide-dtlsv13.pod
    M include/openssl/ssl.h.in
    M ssl/d1_lib.c
    M test/dtlsssllistenertest.c
    M util/other.syms

  Log Message:
  -----------
  DTLS SSL Listener default address validation

Replace SSL_LISTENER_FLAG_REQUIRE_HVR and SSL_LISTENER_FLAG_REQUIRE_HRR
with a single SSL_LISTENER_FLAG_ADDRESS_VALIDATION, and make address
validation the default. A DTLS listener now validates (HVR for DTLS
1.0/1.2, HRR cookie for DTLS 1.3) unless SSL_LISTENER_FLAG_NO_VALIDATE
is set. If both NO_VALIDATE and ADDRESS_VALIDATION are given, the
listener fails safe and validates.

Update the tests, the dtlslistenerecho demo, util/other.syms and the
listener documentation to match.

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:50:39 2026
Merged-from: https://github.com/openssl/openssl/pull/31983


  Commit: 1d98dee49550d6b6c6b61548afbd5f3ae2fd9a91
      https://github.com/openssl/openssl/commit/1d98dee49550d6b6c6b61548afbd5f3ae2fd9a91
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M test/build.info
    M test/dtlsssllistenertest.c
    M test/dtlstest.c
    M test/recipes/80-test_dtls_ccs_reorder.t
    M test/recipes/80-test_dtlsv1listen.t
    M test/ssl-tests/18-dtls-renegotiate.cnf.in
    M test/ssl_ctx_test.c

  Log Message:
  -----------
  DTLS 1.3 CI nightly NO DTLS 1.2 Failures Fix

dtlsv1listentest uses DTLSv1_listen(), a DTLS 1.2-only API that crashes
when DTLS 1.2 is disabled. Guard the test in build.info under
!$disabled{dtls1_2} and add a matching recipe skip so the test is neither
compiled nor run when DTLS 1.2 is unavailable.

The dtls_ccs_reorder test file is specific to DTLS 1.0/1.2 CCS reordering,
which does not apply to DTLS 1.3. The recipe only skipped when all DTLS was
disabled, so when both DTLS 1.0 and 1.2 were disabled while DTLS 1.3
remained, the test still ran. Add a recipe skip for when both DTLS 1.0 and
DTLS 1.2 are disabled, matching the build.info condition.

ssl_ctx_test had two test table entries that set DTLS1_2_VERSION as a max
protocol version and expected success. When DTLS 1.2 is disabled that
version is not valid for any protocol, so SSL_CTX_set_max_proto_version()
returns 0. Guard both entries with #ifndef OPENSSL_NO_DTLS1_2.

dtlstest contained a dead #ifdef OPENSSL_NO_DTLS1_2 block inside
test_listen(), which is itself wrapped in #ifndef OPENSSL_NO_DTLS1_2.
The inner ifdef could never be true; remove it.

Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:55:38 2026
Merged-from: https://github.com/openssl/openssl/pull/32340


  Commit: e4021192c6f5d05fcd25b7801003007d804cef4e
      https://github.com/openssl/openssl/commit/e4021192c6f5d05fcd25b7801003007d804cef4e
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M ssl/d1_lib.c
    M ssl/ssl_ciph.c
    M ssl/ssl_local.h
    M test/cipher_overhead_test.c
    M test/dtls_mtu_test.c
    M test/recipes/80-test_dtls_mtu.t

  Log Message:
  -----------
  DTLS 1.3 Fix DTLS_get_data_mtu() and extend MTU test to cover DTLS 1.3

DTLS_get_data_mtu() included the explicit IV overhead from
ssl_cipher_get_overhead() for AES-GCM and CCM ciphers, but DTLS 1.3 uses
implicit IVs so no IV bytes appear on the wire. Fix by subtracting
EVP_GCM_TLS_EXPLICIT_IV_LEN or EVP_CCM_TLS_EXPLICIT_IV_LEN.

Restructure the MTU test to pin DTLS 1.2 in the PSK cipher loop (previously
DTLS 1.3 was silently negotiated instead) and add a DTLS 1.3 loop using
certificate-based auth. Guard TLS_CHACHA20_POLY1305_SHA256 with both
OPENSSL_NO_CHACHA and OPENSSL_NO_POLY1305.

Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:55:39 2026
Merged-from: https://github.com/openssl/openssl/pull/32340


  Commit: 5b6b44ede33239ce677255f749397a2597e42e9b
      https://github.com/openssl/openssl/commit/5b6b44ede33239ce677255f749397a2597e42e9b
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M .github/workflows/run-checker-daily.yml
    M ssl/statem/statem_lib.c
    M test/dtlsssllistenertest.c
    M test/dtlstest.c
    M test/ssl_ctx_test.c

  Log Message:
  -----------
  DTLS 1.3 Fix no-dtls1_3 build configuration CI failures

Guard the DTLS1_3_VERSION entry in dtls_version_table with
OPENSSL_NO_DTLS1_3 (NULL fallback), matching the pattern used by
tls_version_table for TLS1_3. Add a min_version clamp for DTLS1_3 in
ssl_check_allowed_versions() to fix SSL_CTX_set_min_proto_version()
incorrectly returning failure under no-dtls1_3, caused by DTLS inverted
wire-number ordering making the range check fire after max was clamped to
DTLS1_2. Guard _dtls13 test functions and their ADD_TEST calls in
dtlstest.c. Guard DTLS 1.3-only helpers and tests in
dtlsssllistenertest.c, and move SSL_poll tests outside the DTLS 1.3
guard so they run for any DTLS version. Add no-dtls1_3 to the daily CI
checker matrix.

Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:55:41 2026
Merged-from: https://github.com/openssl/openssl/pull/32340


  Commit: 9253df0b37905a1e1c357e10feba4ac37deb10a2
      https://github.com/openssl/openssl/commit/9253df0b37905a1e1c357e10feba4ac37deb10a2
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-20 (Thu, 20 Aug 2026)

  Changed paths:
    M util/perl/TLSProxy/Proxy.pm

  Log Message:
  -----------
  DTLS 1.3 Fix TLSProxy DTLS retransmission in valgrind CI

Valgrind slows execution down, causing DTLS retransmission timers to fire
during otherwise normal handshakes. The client retransmits its ClientHello
before the server responds, and TLSProxy recorded the duplicate into
message_list unconditionally. This shifted every subsequent message index
by one, breaking three DTLS 1.3 subtests:

70-test_tls13alerts.t: alert_filter corrupted message_list[1] expecting
the ServerHello, but found the retransmitted ClientHello instead. The
real ServerHello passed through uncorrupted, the handshake succeeded,
and Message->fail() returned false.

70-test_tls13messages.t / 70-test_tls13kexmodes.t: checkhandshake.pm
walks message_list sequentially comparing each .mt to an expected
sequence. The extra ClientHello at position 0 shifted all five
subsequent checks.

Fix by deduplicating message_list in DTLS mode using (sender, msgseq) as
the key. Retransmitted DTLS handshake messages always carry the same
message sequence number as the original, so duplicates are naturally
discarded. HelloRetryRequest is unaffected becasue the retried ClientHello
gets an incremented msgseq. The seen_msgseq hash is reset by clearClient
so there is no state leakage between subtests.

Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Merge-date: Thu Aug 20 09:55:42 2026
Merged-from: https://github.com/openssl/openssl/pull/32340


Compare: https://github.com/openssl/openssl/compare/f5a16d6908fd...9253df0b3790

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/feature/dtls-1.3/f5a16d-9253df%40github.com.