Skip to content

Fix the default I/O context of TLS objects and SSL_set_rfd/wfd on DTLS #11956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Frauschi wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fix the default I/O context of TLS objects and SSL_set_rfd/wfd on DTLS #11956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1771229
Use rfd/wfd as the default IO context for non-DTLS SSLs
Frauschi Oct 30, 2026
bbc6c36
Route SSL_set_rfd and SSL_set_wfd through the fd setters
Frauschi Oct 30, 2026
7c8123c
Address review feedback
Frauschi Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9419,25 +9419,27 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
if (wc_InitRwLock(&ssl->buffers.dtlsCtx.peerLock) != 0)
return BAD_MUTEX_E;
#endif
#ifdef HAVE_NETX
ssl->IOCB_ReadCtx = &ssl->nxCtx; /* default NetX IO ctx, same for read */
ssl->IOCB_WriteCtx = &ssl->nxCtx; /* and write */
#else
ssl->IOCB_ReadCtx = &ssl->buffers.dtlsCtx; /* prevent invalid pointer access if not */
ssl->IOCB_WriteCtx = &ssl->buffers.dtlsCtx; /* correctly set */
#endif
#else
#endif /* WOLFSSL_DTLS */

#ifdef HAVE_NETX
ssl->IOCB_ReadCtx = &ssl->nxCtx; /* default NetX IO ctx, same for read */
ssl->IOCB_WriteCtx = &ssl->nxCtx; /* and write */
#elif defined (WOLFSSL_GNRC)
ssl->IOCB_ReadCtx = ssl->gnrcCtx;
ssl->IOCB_WriteCtx = ssl->gnrcCtx;
#elif defined(WOLFSSL_DTLS)
if (ctx->method->version.major == DTLS_MAJOR) {
ssl->IOCB_ReadCtx = &ssl->buffers.dtlsCtx;

@SparkiDev SparkiDev Nov 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aren't these the same as above?

#elif defined(WOLFSSL_DTLS)
...
#else
....
#endif

@Frauschi Frauschi Nov 6, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Flattened into the #elif chain. The DTLS branch still has to check the method, since giving TLS objects dtlsCtx here is what made an unset-fd TLS object do its I/O on fd 0.

ssl->IOCB_WriteCtx = &ssl->buffers.dtlsCtx;
}
else {
ssl->IOCB_ReadCtx = &ssl->rfd;
ssl->IOCB_WriteCtx = &ssl->wfd;
}
#else
ssl->IOCB_ReadCtx = &ssl->rfd; /* prevent invalid pointer access if not */
ssl->IOCB_WriteCtx = &ssl->wfd; /* correctly set */
#endif
#endif /* WOLFSSL_DTLS */


#ifndef WOLFSSL_AEAD_ONLY
Expand Down
23 changes: 2 additions & 21 deletions src/ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4734,33 +4734,14 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
int wolfSSL_set_rfd(WOLFSSL* ssl, int rfd)
{
WOLFSSL_ENTER("wolfSSL_set_rfd");
ssl->rfd = rfd; /* not used directly to allow IO callbacks */

ssl->IOCB_ReadCtx = &ssl->rfd;

#ifdef WOLFSSL_DTLS
if (ssl->options.dtls) {
ssl->IOCB_ReadCtx = &ssl->buffers.dtlsCtx;
ssl->buffers.dtlsCtx.rfd = rfd;
#ifdef USE_WOLFSSL_IO
ssl->buffers.dtlsCtx.rfdIsDGram =
(byte)(wolfIO_SockIsDGram(rfd) != 0);
#endif
}
#endif

return WOLFSSL_SUCCESS;
return wolfSSL_set_read_fd(ssl, rfd);
}


int wolfSSL_set_wfd(WOLFSSL* ssl, int wfd)
{
WOLFSSL_ENTER("wolfSSL_set_wfd");
ssl->wfd = wfd; /* not used directly to allow IO callbacks */

ssl->IOCB_WriteCtx = &ssl->wfd;

return WOLFSSL_SUCCESS;
return wolfSSL_set_write_fd(ssl, wfd);
}
#endif /* OPENSSL_EXTRA */

Expand Down
38 changes: 38 additions & 0 deletions tests/api/test_dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16431,3 +16431,41 @@ int test_dtls_max_fragment_write(void)
#endif
return EXPECT_RESULT();
}

int test_dtls_set_rfd_wfd(void)
{
EXPECT_DECLS;
#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_DTLS) && \
!defined(NO_WOLFSSL_CLIENT) && defined(USE_WOLFSSL_IO) && \
(defined(__unix__) || defined(__APPLE__))
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;
int sv[2] = { -1, -1 };
byte buf[1];

ExpectIntEQ(socketpair(AF_UNIX, SOCK_DGRAM, 0, sv), 0);
ExpectIntEQ(fcntl(sv[0], F_SETFL, O_NONBLOCK), 0);
ExpectIntEQ(fcntl(sv[1], F_SETFL, O_NONBLOCK), 0);
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfDTLS_client_method()));
ExpectNotNull(ssl = wolfSSL_new(ctx));
ExpectIntEQ(wolfSSL_set_rfd(ssl, sv[0]), WOLFSSL_SUCCESS);
ExpectIntEQ(wolfSSL_set_wfd(ssl, sv[0]), WOLFSSL_SUCCESS);
ExpectPtrEq(wolfSSL_GetIOReadCtx(ssl), &ssl->buffers.dtlsCtx);
ExpectPtrEq(wolfSSL_GetIOWriteCtx(ssl), &ssl->buffers.dtlsCtx);
ExpectIntEQ(ssl->buffers.dtlsCtx.rfd, sv[0]);
ExpectIntEQ(ssl->buffers.dtlsCtx.wfd, sv[0]);
wolfSSL_dtls_set_using_nonblock(ssl, 1);
ExpectIntEQ(wolfSSL_connect(ssl), WOLFSSL_FATAL_ERROR);
ExpectIntEQ(wolfSSL_get_error(ssl, WOLFSSL_FATAL_ERROR),
WOLFSSL_ERROR_WANT_READ);
ExpectIntEQ(recv(sv[1], buf, sizeof(buf), MSG_PEEK), 1);

wolfSSL_free(ssl);
wolfSSL_CTX_free(ctx);
if (sv[0] >= 0)
close(sv[0]);
if (sv[1] >= 0)
close(sv[1]);
#endif
return EXPECT_RESULT();
}
4 changes: 3 additions & 1 deletion tests/api/test_dtls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,7 @@ int test_dtls13_hrr_cookie_state_guard(void);
int test_dtls12_cookie_secret_generate_fail(void);
int test_dtls13_hrr_cookie_secret_generate_fail(void);
int test_dtls_max_fragment_write(void);
int test_dtls_set_rfd_wfd(void);
int test_wolfSSL_dtls_export(void);
int test_wolfSSL_dtls_import_dh_key_sz(void);
int test_wolfSSL_dtls_export_peers(void);
Expand Down Expand Up @@ -400,5 +401,6 @@ int test_dtls_no_cookie_ch_pause(WOLFSSL* ssl, void* ctx);
TEST_DECL_GROUP("dtls", test_dtls13_hrr_cookie_secret_secondary_disabled), \
TEST_DECL_GROUP("dtls", test_dtls12_cookie_secret_generate_fail), \
TEST_DECL_GROUP("dtls", test_dtls13_hrr_cookie_secret_generate_fail), \
TEST_DECL_GROUP("dtls", test_dtls_max_fragment_write)
TEST_DECL_GROUP("dtls", test_dtls_max_fragment_write), \
TEST_DECL_GROUP("dtls", test_dtls_set_rfd_wfd)
#endif /* TESTS_API_DTLS_H */
70 changes: 70 additions & 0 deletions tests/api/test_tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9010,3 +9010,73 @@ int test_tls_hmac_inner_cid_decision_coverage(void)
#endif /* WOLFSSL_DTLS */
return EXPECT_RESULT();
} /* END test_tls_hmac_inner_cid_decision_coverage */

int test_tls_unset_fd_no_stdin_io(void)
{
EXPECT_DECLS;
#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS) && \
defined(USE_WOLFSSL_IO) && (defined(__unix__) || defined(__APPLE__)) && \
!defined(WOLFSSL_LEANPSK)
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;
int sv[2] = { -1, -1 };
int wr[2] = { -1, -1 };
int savedStdin = -1;
byte buf[1] = { 0 };

/* Put a socket on fd 0 so that any I/O on it is visible. */
ExpectIntEQ(socketpair(AF_UNIX, SOCK_STREAM, 0, sv), 0);
ExpectIntEQ(socketpair(AF_UNIX, SOCK_STREAM, 0, wr), 0);
ExpectIntEQ(fcntl(sv[0], F_SETFL, O_NONBLOCK), 0);
ExpectIntEQ(fcntl(sv[1], F_SETFL, O_NONBLOCK), 0);
ExpectIntEQ(fcntl(wr[0], F_SETFL, O_NONBLOCK), 0);
ExpectIntGE(savedStdin = dup(0), 0);
ExpectIntEQ(dup2(sv[0], 0), 0);
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));

ExpectNotNull(ssl = wolfSSL_new(ctx));
ExpectPtrEq(wolfSSL_GetIOReadCtx(ssl), &ssl->rfd);
ExpectPtrEq(wolfSSL_GetIOWriteCtx(ssl), &ssl->wfd);
ExpectIntEQ(wolfSSL_connect(ssl), WOLFSSL_FATAL_ERROR);
ExpectIntEQ(wolfSSL_get_error(ssl, WOLFSSL_FATAL_ERROR),
WC_NO_ERR_TRACE(SOCKET_ERROR_E));
ExpectIntEQ(recv(sv[1], buf, sizeof(buf), 0), -1);
wolfSSL_free(ssl);
ssl = NULL;

ExpectIntEQ(send(sv[1], buf, sizeof(buf), 0), 1);
ExpectNotNull(ssl = wolfSSL_new(ctx));
ExpectIntEQ(wolfSSL_set_write_fd(ssl, wr[0]), WOLFSSL_SUCCESS);
ExpectIntEQ(wolfSSL_connect(ssl), WOLFSSL_FATAL_ERROR);
ExpectIntEQ(wolfSSL_get_error(ssl, WOLFSSL_FATAL_ERROR),
WC_NO_ERR_TRACE(SOCKET_ERROR_E));
ExpectIntEQ(recv(sv[0], buf, sizeof(buf), MSG_PEEK), 1);
wolfSSL_free(ssl);
ssl = NULL;
wolfSSL_CTX_free(ctx);
ctx = NULL;

#ifdef WOLFSSL_DTLS
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfDTLS_client_method()));
ExpectNotNull(ssl = wolfSSL_new(ctx));
ExpectPtrEq(wolfSSL_GetIOReadCtx(ssl), &ssl->buffers.dtlsCtx);
ExpectPtrEq(wolfSSL_GetIOWriteCtx(ssl), &ssl->buffers.dtlsCtx);
#endif

if (savedStdin >= 0) {
(void)dup2(savedStdin, 0);
close(savedStdin);
}
if (sv[0] >= 0)
close(sv[0]);
if (sv[1] >= 0)
close(sv[1]);
if (wr[0] >= 0)
close(wr[0]);
if (wr[1] >= 0)
close(wr[1]);
wolfSSL_free(ssl);
wolfSSL_CTX_free(ctx);
#endif
return EXPECT_RESULT();
}
4 changes: 3 additions & 1 deletion tests/api/test_tls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ int test_wolfSSL_get_shared_ciphers(void);
int test_tls12_aesgcm_record_nonce_unique(void);
int test_tls_param_flags_crl_check(void);
int test_tls_hmac_inner_cid_decision_coverage(void);
int test_tls_unset_fd_no_stdin_io(void);

#define TEST_TLS_DECLS \
TEST_DECL_GROUP("tls", test_utils_memio_move_message), \
Expand Down Expand Up @@ -250,6 +251,7 @@ int test_tls_hmac_inner_cid_decision_coverage(void);
TEST_DECL_GROUP("tls", test_chain_verify_cb_stapling), \
TEST_DECL_GROUP("tls", test_internal_SetSSL_CTX_DecisionCoverage), \
TEST_DECL_GROUP("tls", test_internal_CheckVersion_DecisionCoverage), \
TEST_DECL_GROUP("tls", test_tls_hmac_inner_cid_decision_coverage)
TEST_DECL_GROUP("tls", test_tls_hmac_inner_cid_decision_coverage), \
TEST_DECL_GROUP("tls", test_tls_unset_fd_no_stdin_io)

#endif /* TESTS_API_TEST_TLS_H */
Loading