Skip to content

Comments

create SSL_listen_ex api#27397

Closed
nhorman wants to merge 19 commits intoopenssl:masterfrom
nhorman:quic-listen
Closed

create SSL_listen_ex api#27397
nhorman wants to merge 19 commits intoopenssl:masterfrom
nhorman:quic-listen

Conversation

@nhorman
Copy link
Contributor

@nhorman nhorman commented Apr 15, 2025

Rough draft of SSL_listen_ex api

Allows for the creation of a 'blank' SSL object using OSSL_QUIC_method(), which can be passed to SSL_listen_ex to allow for quic to poll for inbound connections in a fashion simmilar to DTLS.

Very rough draft, still needs documentation, but it has a rudimentary test in place, which seems to work

Checklist
  • documentation is added or updated
  • tests are added or updated

@nhorman nhorman self-assigned this Apr 15, 2025
@nhorman nhorman moved this to In Progress in Development Board Apr 15, 2025
@nhorman nhorman marked this pull request as draft April 15, 2025 16:24
@nhorman nhorman added the style: waived exempted from style checks label Apr 17, 2025
@vavroch2010 vavroch2010 moved this from In Progress to Blocked in Development Board Apr 17, 2025
@github-actions github-actions bot added the severity: ABI change This pull request contains ABI changes label Apr 17, 2025
@Splediferous
Copy link

Unable to assist at the moment. Functions need to be exported before I can test.

@nhorman
Copy link
Contributor Author

nhorman commented Apr 19, 2025

Not sure what you mean. Commits pushed a few days ago exported the SSL_Llistwn_ex function

@Splediferous
Copy link

Not sure what you mean. Commits pushed a few days ago exported the SSL_Llistwn_ex function

The OSSL_QUIC_method isn't exported. I need that to use the SSL_Listen_ex.

@nhorman
Copy link
Contributor Author

nhorman commented Apr 20, 2025

yes it is, see commit c3ea941:

diff --git a/util/libssl.num b/util/libssl.num
index 797df2b2f3..6b2451d99f 100644
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -606,3 +606,5 @@ SSL_CTX_set_domain_flags                ?   3_5_0   EXIST::FUNCTION:
 SSL_CTX_get_domain_flags                ?      3_5_0   EXIST::FUNCTION:
 SSL_get_domain_flags                    ?      3_5_0   EXIST::FUNCTION:
 SSL_CTX_set_new_pending_conn_cb         ?      3_5_0   EXIST::FUNCTION:
+OSSL_QUIC_method                        ?      3_6_0   EXIST::FUNCTION:QUIC
+SSL_listen_ex                           ?      3_6_0   EXIST::FUNCTION:

@Splediferous
Copy link

Sorry for the late response - Easter holidays.
Will get back to this next week.

@Splediferous
Copy link

Splediferous commented May 3, 2025

Hmmm. I don't see the export. Am I on the right branch?
Binary reports:
image

Exports:
image

@mattcaswell
Copy link
Member

@nhorman - what is the current status of this PR?

@nhorman
Copy link
Contributor Author

nhorman commented Jun 18, 2025

@mattcaswell apologies, this fell off my radar. Need to look at it again, but my last recollection was that the test I wrote for it passed, but definitely needs some cleanup/further testing. It should be enough for @Splediferous to experiment with however.

@Splediferous
In regards to your question, I can't tell from the data you provided, but looking at your output, I think you're not looking far enough into the export list. OSSL_QUIC_method's export ordinal is somewhere in the low 600 range.

If I build it on linux, I see the symbol as being exported:

objdump -t ./libssl.so | grep OSSL_QUIC_method
0000000000104ec0 l     O .data.rel.ro	00000000000000f8              OSSL_QUIC_method_data.3
0000000000058360 g     F .text	0000000000000008              OSSL_QUIC_method

@nhorman nhorman linked an issue Oct 5, 2025 that may be closed by this pull request
@nhorman
Copy link
Contributor Author

nhorman commented Oct 5, 2025

I built this on windows, and the export is there:

Screenshot 2025-10-05 140402

@Splediferous
Copy link

I'm still not seeing it.
OpenSSL_version() reports "OpenSSL 3.6.0 1 Oct 2025". Neither 32 nor 64 bit show the entry.
image
I've attached the binary which was built from the zip source for 3.6.0 using msys64
libssl-3.zip

@nhorman
Copy link
Contributor Author

nhorman commented Oct 6, 2025

whats the head commit of the tree you're building this library from?

@Splediferous
Copy link

I don't use Git.
I download the zip file from the OpenSSL downloads page "https://openssl-library.org/source/"
Currently it is openssl-3.6.0.tar.gz

@nhorman
Copy link
Contributor Author

nhorman commented Oct 6, 2025

But...The changes we're testing aren't in the release. They're only in the draft PR I gave you. They need to be tested prior to putting them in a release, thats why you were provided with the PR.

@Splediferous
Copy link

I think we've had a communications problem.
It seems it was assumed I used Git, which I don't (we use SVN) and when I said I couldn't find the export (I built from your dev repository) #27397 (comment) you said you could see it .
I had no idea I was a gate and that the feature would only be implemented after my action, so thought it would be in 3.6.
I've been eagerly awaiting the 3.6 release. When it didn't appear in the alpha I asked about it a couple of times:

I asked about it in #27250 (comment) and didn't get a response.
I asked about it in #27250 (reply in thread) and was told there is no method and one must choose client or server. (#27250 (reply in thread))

When the final 3.6 was released I thought it had been overlooked and created a feature request.

Where can I download the source to test? Can you link a repository where I can download a zip or tar package?

Sorry for the confusion :(

@nhorman
Copy link
Contributor Author

nhorman commented Oct 6, 2025

I'm not sure I see the problem with using git, despite what you use with your normal development.

But if its just not feasible to use git to clone this pr, then you can use githubs direct url feature to get an archive of the source branch to build from:

curl -L -o ./openssl.tar.gz https://github.com/nhorman/openssl/archive/quic-listen.tar.gz

@Splediferous
Copy link

Splediferous commented Oct 7, 2025

I guess you don't have an IT department then.

The souce you linked does, indeed, have the export.
image

I will test and let you know the outcome by 20/10/2025 at the latest.

@nhorman
Copy link
Contributor Author

nhorman commented Oct 7, 2025

your it department wont let you install git? Thats......wow. I'm sorry to hear that.

@Splediferous
Copy link

I have successfully created a client connection with a modified Listener example from the demo folder.
On windows we need to intialise WSAStartup before the socket() call will work so I' had to modify the listener example to include this and build it separately. I did try to upload it as an attachment (server.c) but the web interface refused to accept a c or zip file extension even though it states it should.

Anyhoo.

I've also successfully created both a client and server connection using the OSSL_QUIC_method().
In the server software I usually work with the SSL session rather than a CTX but SSL_new_listener_from() failed with the error A0001A5: LISTENER USE ONLY. I had to retrieve the CTX from the SSL object and then use the SSL_new_listener() which seemed to work as advertised.
I'm not sure why we should need two functions as other functions seem to be able to be able to transparently differentiate between a CTX and a SSL object but it is what it is.

I'll be integrating the new changes to use the default QUIC channel this week with a view to working with multiple channels at a later date. Is there an ETA for including OSSL_QUIC_method() in the main branch?

@nhorman
Copy link
Contributor Author

nhorman commented Oct 19, 2025

@mattcaswell it sounds like @Splediferous has confirmed this draft pr is working for them. Obviously I need to rebase, and finish the docs on this. Do you have any early comments on what else may need to be included here before I take this out of draft for official review?

Copy link
Member

@mattcaswell mattcaswell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've not reviewed this in detail, but the obvious missing thing here is documentation.

I'm also a bit confused by the test (see comment below)

@openssl-machine
Copy link
Collaborator

This pull request is ready to merge

@nhorman
Copy link
Contributor Author

nhorman commented Dec 5, 2025

merged, thank you!

@nhorman nhorman closed this Dec 5, 2025
@github-project-automation github-project-automation bot moved this from Waiting Merge to Done in Development Board Dec 5, 2025
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
The flag defaults to 0 (unknown), and gets set to
1 (using SSL_accept_ex), or -1 (using SSL_accpet_connection)

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Based on the value of the using_peeloff flag, we need to choose if we're
going to create a user_ssl when creating a new channel

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Changes for SSL_listen_ex squashed creation of qlog objects even when
configured.

Fix that up so qlog objects are created regardless of weather we use
SSL_accept_connection or SSL_listen_ex

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
folow the using_peeloff get/set routines to just a set routine that
fails if the set is for a mode that doesn't match the current mode

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
Various review fixups to clarify meaning of variables and fix unwinding
of operations should we encounter errors in some operations.

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from #27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
The flag defaults to 0 (unknown), and gets set to
1 (using SSL_accept_ex), or -1 (using SSL_accpet_connection)

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Based on the value of the using_peeloff flag, we need to choose if we're
going to create a user_ssl when creating a new channel

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Changes for SSL_listen_ex squashed creation of qlog objects even when
configured.

Fix that up so qlog objects are created regardless of weather we use
SSL_accept_connection or SSL_listen_ex

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
folow the using_peeloff get/set routines to just a set routine that
fails if the set is for a mode that doesn't match the current mode

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
Various review fixups to clarify meaning of variables and fix unwinding
of operations should we encounter errors in some operations.

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#27397)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: master Applies to master branch severity: ABI change This pull request contains ABI changes style: waived exempted from style checks tests: present The PR has suitable tests present triaged: feature The issue/pr requests/adds a feature

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

OSSL_QUIC_method. Please Implement.

6 participants