From c188dbbcdf82f19bb6013af8dab487234951e4f7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Sep 2026 17:32:20 +0000 Subject: [PATCH 1/2] Initial plan From 64aea95d8b560712259d4ae2b72329638e746202 Mon Sep 17 00:00:00 2001 From: SanthoshShetty Date: Fri, 4 Sep 2026 22:35:59 +0530 Subject: [PATCH 2/2] Added Transport parameters extension validation in openssl (#6225) Validate peer transport parameters during client handshake completion in the OpenSSL QUIC TLS path before accepting the connection. This preserves the required RFC behavior for QUIC transport parameter handling and ensures the peer transport parameter callback is only invoked after successful validation. https://microsoft.visualstudio.com/OS/_workitems/edit/62258561/ Co-authored-by: Santhosha-bk <112488621+Santhosha-bk@users.noreply.github.com> --- src/generated/linux/tls_openssl.c.clog.h | 18 +++++++++++++++ .../linux/tls_openssl.c.clog.h.lttng.h | 19 +++++++++++++++ src/platform/tls_openssl.c | 23 +++++++++++++++++++ 3 files changed, 60 insertions(+) diff --git a/src/generated/linux/tls_openssl.c.clog.h b/src/generated/linux/tls_openssl.c.clog.h index c630102b5e..e01bae4518 100644 --- a/src/generated/linux/tls_openssl.c.clog.h +++ b/src/generated/linux/tls_openssl.c.clog.h @@ -153,6 +153,24 @@ tracepoint(CLOG_TLS_OPENSSL_C, OpenSslNoMatchingAlpn , arg1);\ +/*---------------------------------------------------------- +// Decoder Ring for OpenSslMissingTransportParameters +// [conn][%p] No transport parameters received +// QuicTraceLogConnError( + OpenSslMissingTransportParameters, + TlsContext->Connection, + "No transport parameters received"); +// arg1 = arg1 = TlsContext->Connection = arg1 +----------------------------------------------------------*/ +#ifndef _clog_3_ARGS_TRACE_OpenSslMissingTransportParameters +#define _clog_3_ARGS_TRACE_OpenSslMissingTransportParameters(uniqueId, arg1, encoded_arg_string)\ +tracepoint(CLOG_TLS_OPENSSL_C, OpenSslMissingTransportParameters , arg1);\ + +#endif + + + + /*---------------------------------------------------------- // Decoder Ring for OpenSslHandshakeDataStart // [conn][%p] Writing Handshake data starts at %u diff --git a/src/generated/linux/tls_openssl.c.clog.h.lttng.h b/src/generated/linux/tls_openssl.c.clog.h.lttng.h index a259121e02..9bc29b6cfa 100644 --- a/src/generated/linux/tls_openssl.c.clog.h.lttng.h +++ b/src/generated/linux/tls_openssl.c.clog.h.lttng.h @@ -139,6 +139,25 @@ TRACEPOINT_EVENT(CLOG_TLS_OPENSSL_C, OpenSslNoMatchingAlpn, +/*---------------------------------------------------------- +// Decoder Ring for OpenSslMissingTransportParameters +// [conn][%p] No transport parameters received +// QuicTraceLogConnError( + OpenSslMissingTransportParameters, + TlsContext->Connection, + "No transport parameters received"); +// arg1 = arg1 = TlsContext->Connection = arg1 +----------------------------------------------------------*/ +TRACEPOINT_EVENT(CLOG_TLS_OPENSSL_C, OpenSslMissingTransportParameters, + TP_ARGS( + const void *, arg1), + TP_FIELDS( + ctf_integer_hex(uint64_t, arg1, (uint64_t)arg1) + ) +) + + + /*---------------------------------------------------------- // Decoder Ring for OpenSslHandshakeDataStart // [conn][%p] Writing Handshake data starts at %u diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index aa16e50d83..73945f7eb0 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -747,6 +747,15 @@ static int QuicTlsGotTp(SSL *S, const unsigned char *Params, UNREFERENCED_PARAMETER(Arg); + if (ParamsLen == 0 || Params == NULL) { + return 0; + } + + if (AData->PeerTp != NULL) { + return AData->PeerTpLen == ParamsLen && + memcmp(AData->PeerTp, Params, ParamsLen) == 0; + } + AData->PeerTp = CXPLAT_ALLOC_NONPAGED(ParamsLen, QUIC_POOL_TLS_TRANSPARAMS); if (AData->PeerTp == NULL) { @@ -3317,6 +3326,20 @@ CxPlatTlsProcessData( TlsContext->ResultFlags |= CXPLAT_TLS_RESULT_ERROR; goto Exit; } + + // + // By this point, OpenSSL should have called QuicTlsGotTp, which stores + // a non-NULL PeerTp and sets PeerTPReceived. Fail the handshake if the + // required transport parameters were not processed. + // + if (!TlsContext->PeerTPReceived) { + QuicTraceLogConnError( + OpenSslMissingTransportParameters, + TlsContext->Connection, + "No transport parameters received"); + TlsContext->ResultFlags |= CXPLAT_TLS_RESULT_ERROR; + goto Exit; + } } else if ((TlsContext->SecConfig->Flags & QUIC_CREDENTIAL_FLAG_INDICATE_CERTIFICATE_RECEIVED) && !TlsContext->PeerCertReceived) { QUIC_STATUS ValidationResult =