openssl icon indicating copy to clipboard operation
openssl copied to clipboard
verified publisher icon openssl

ktls: harden Linux recv path

Open MegaManSec opened this issue 3 months ago • 4 comments

  • zero the 5 prepended TLS header bytes before recvmsg to avoid stale header bytes when no TLS_GET_RECORD_TYPE cmsg is delivered

  • require MSG_EOR and reject MSG_CTRUNC to avoid treating partial records as complete

  • drop subtraction of EVP_GCM_TLS_TAG_LEN from msg_iov.iov_len (kernel already strips the tag). Restores full plaintext capacity and matches the FreeBSD path

MegaManSec avatar Oct 11 '25 06:10 MegaManSec

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

openssl-machine avatar Nov 14 '25 00:11 openssl-machine

ping @MegaManSec there are comments.

t8m avatar Nov 14 '25 08:11 t8m

I don't see the fix FreeBSD unaligned write promised by the title?

Fixed (by removing it from the title and description). Originally I was going to submit this PR with https://github.com/openssl/openssl/pull/28860 combined, but decided to de-couple, but forgot to update the actual PR.

MegaManSec avatar Dec 05 '25 05:12 MegaManSec

This pull request is ready to merge

openssl-machine avatar Dec 06 '25 11:12 openssl-machine

Squashed, applied clang-reformat and merged to the master branch. Thank you for your contribution.

t8m avatar Dec 11 '25 11:12 t8m