Commit f6708d3f43 for openssl.org
commit f6708d3f437d25c2c6855846d71ca235ae6f6b0b
Author: Ryan Hooper <ryanh@openssl.foundation>
Date: Tue Aug 18 12:12:36 2026 -0400
DTLS SSL Listener default address validation
Replace SSL_LISTENER_FLAG_REQUIRE_HVR and SSL_LISTENER_FLAG_REQUIRE_HRR
with a single SSL_LISTENER_FLAG_ADDRESS_VALIDATION, and make address
validation the default. A DTLS listener now validates (HVR for DTLS
1.0/1.2, HRR cookie for DTLS 1.3) unless SSL_LISTENER_FLAG_NO_VALIDATE
is set. If both NO_VALIDATE and ADDRESS_VALIDATION are given, the
listener fails safe and validates.
Update the tests, the dtlslistenerecho demo, util/other.syms and the
listener documentation to match.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Merge-date: Thu Aug 20 09:50:39 2026
Merged-from: https://github.com/openssl/openssl/pull/31983
diff --git a/CHANGES.md b/CHANGES.md
index 51870e0e95..7e04ce4b4b 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -38,8 +38,10 @@ OpenSSL Releases
* Added DTLS support to the SSL listener API. SSL_new_listener() can now
create a DTLS listener that demultiplexes incoming datagrams into per-peer
- connections accepted with SSL_accept_connection(). Refer to the
- SSL_new_listener(3) manpage for details.
+ connections accepted with SSL_accept_connection(). The listener performs
+ address validation (HelloVerifyRequest for DTLS 1.0/1.2, HelloRetryRequest
+ cookie for DTLS 1.3) by default; pass SSL_LISTENER_FLAG_NO_VALIDATE to
+ disable it. Refer to the SSL_new_listener(3) manpage for details.
*Ryan Hooper*
diff --git a/demos/dtlslistenerecho/main.c b/demos/dtlslistenerecho/main.c
index 7d8f9ff310..0569a419b7 100644
--- a/demos/dtlslistenerecho/main.c
+++ b/demos/dtlslistenerecho/main.c
@@ -162,8 +162,11 @@ static int create_dtls_listener(SSL_CTX *ssl_ctx, int port,
goto err;
}
- /* Create the DTLS listener with HVR (DTLS 1.2) and HRR (DTLS 1.3) cookie validation */
- *listener = SSL_new_listener(ssl_ctx, SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR);
+ /*
+ * Create the DTLS listener. By default it will perform HelloVerifyRequest
+ * (HVR) and HelloRetryRequest (HRR).
+ */
+ *listener = SSL_new_listener(ssl_ctx, 0);
if (*listener == NULL) {
fprintf(stderr, "Unable to create DTLS listener\n");
ERR_print_errors_fp(stderr);
diff --git a/doc/man3/DTLSv1_listen.pod b/doc/man3/DTLSv1_listen.pod
index 0ae36ce85f..4dc2d20622 100644
--- a/doc/man3/DTLSv1_listen.pod
+++ b/doc/man3/DTLSv1_listen.pod
@@ -113,9 +113,9 @@ silently downgrade it to a max of DTLSv1.2.
DTLSv1_listen() cannot be used with DTLS 1.3. If the SSL object is configured
for DTLS 1.3 only (i.e., both minimum and maximum protocol versions are set to
-DTLS 1.3), DTLSv1_listen() will fail. For DTLS 1.3 server applications that
-require address validation via HelloRetryRequest (HRR), use
-L<SSL_new_listener(3)> with the B<SSL_LISTENER_FLAG_REQUIRE_HRR> flag instead.
+DTLS 1.3), DTLSv1_listen() will fail. For DTLS 1.3 server applications, use
+L<SSL_new_listener(3)> instead, which performs address validation via
+HelloRetryRequest (HRR) by default.
=head1 RETURN VALUES
diff --git a/doc/man3/SSL_new_listener.pod b/doc/man3/SSL_new_listener.pod
index 6ec9aad8ae..afc2866f88 100644
--- a/doc/man3/SSL_new_listener.pod
+++ b/doc/man3/SSL_new_listener.pod
@@ -8,8 +8,7 @@ SSL_accept_connection, SSL_get_accept_connection_queue_len,
SSL_new_from_listener,
SSL_ACCEPT_CONNECTION_NO_BLOCK,
SSL_LISTENER_FLAG_NO_VALIDATE,
-SSL_LISTENER_FLAG_REQUIRE_HVR,
-SSL_LISTENER_FLAG_REQUIRE_HRR,
+SSL_LISTENER_FLAG_ADDRESS_VALIDATION,
SSL_LISTENER_FLAG_SINGLE_THREAD - SSL object interface for abstracted connection
acceptance
@@ -29,8 +28,7 @@ acceptance
#define SSL_ACCEPT_CONNECTION_NO_BLOCK
#define SSL_LISTENER_FLAG_NO_VALIDATE
- #define SSL_LISTENER_FLAG_REQUIRE_HVR
- #define SSL_LISTENER_FLAG_REQUIRE_HRR
+ #define SSL_LISTENER_FLAG_ADDRESS_VALIDATION
#define SSL_LISTENER_FLAG_SINGLE_THREAD
SSL *SSL_accept_connection(SSL *ssl, uint64_t flags);
@@ -227,31 +225,28 @@ created using L<DTLS_server_method(3)> or L<DTLS_method(3)>. A DTLS listener
provides server-side connection demultiplexing, allowing multiple DTLS clients
to connect to the same UDP socket.
-For DTLS listeners, the following flags control address validation behavior:
+For DTLS listeners, address validation is performed by default: the listener
+sends a HelloVerifyRequest (HVR) with a cookie for DTLS 1.0/1.2 connections and
+a HelloRetryRequest (HRR) with a cookie extension for DTLS 1.3 connections, and
+the client must echo the valid cookie in a subsequent ClientHello before the
+handshake proceeds. This protects against amplification attacks across all
+supported DTLS versions. The following flags adjust this behavior:
=over 4
+=item B<SSL_LISTENER_FLAG_ADDRESS_VALIDATION>
+
+Requests address validation (HVR for DTLS 1.0/1.2, HRR with cookie for
+DTLS 1.3). This is the default.
+
=item B<SSL_LISTENER_FLAG_NO_VALIDATE>
Disables all address validation. The listener will not send HelloVerifyRequest
(for DTLS 1.0/1.2) or HelloRetryRequest with cookie (for DTLS 1.3). This is
-faster but provides no protection against amplification attacks. Not
-recommended for use in untrusted network environments.
-
-=item B<SSL_LISTENER_FLAG_REQUIRE_HVR>
-
-Requires HelloVerifyRequest (HVR) cookie exchange for DTLS 1.0 and DTLS 1.2
-connections. The listener will send an HVR with a cookie, and the client must
-respond with a ClientHello containing the valid cookie before the handshake
-proceeds. This provides protection against amplification attacks for pre-1.3
-DTLS versions.
-
-=item B<SSL_LISTENER_FLAG_REQUIRE_HRR>
-
-Requires HelloRetryRequest (HRR) cookie exchange for DTLS 1.3 connections.
-The listener will send an HRR with a cookie extension, and the client must
-respond with a second ClientHello containing the valid cookie. This provides
-protection against amplification attacks for DTLS 1.3.
+faster but provides no protection against amplification attacks, and is not
+recommended for use in untrusted network environments. If both this flag and
+B<SSL_LISTENER_FLAG_ADDRESS_VALIDATION> are specified, the listener fails safe
+and performs address validation.
=item B<SSL_LISTENER_FLAG_SINGLE_THREAD>
@@ -268,12 +263,8 @@ This flag is only applicable to DTLS listeners.
=back
-Both B<SSL_LISTENER_FLAG_REQUIRE_HVR> and B<SSL_LISTENER_FLAG_REQUIRE_HRR> may
-be specified together to enable address validation for all supported DTLS
-versions.
-
For DTLS listeners, SSL_accept_connection() returns a connection after cookie
-validation is complete (if required) or after receiving the first ClientHello
+validation is complete (the default) or after receiving the first ClientHello
(if B<SSL_LISTENER_FLAG_NO_VALIDATE> is set). The handshake is B<not> complete
at this point. The application must call L<SSL_do_handshake(3)> or
L<SSL_accept(3)> to complete the handshake before sending or receiving
@@ -306,10 +297,11 @@ and can accept multiple connections concurrently.
SSL_CTX_use_certificate_file(ctx, "server.pem", SSL_FILETYPE_PEM);
SSL_CTX_use_PrivateKey_file(ctx, "key.pem", SSL_FILETYPE_PEM);
- /* Create listener with HVR and HRR requirements in single-threaded mode */
- SSL *listener = SSL_new_listener(ctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR
- | SSL_LISTENER_FLAG_SINGLE_THREAD);
+ /*
+ * Create listener in single-threaded mode. Address validation (HVR for
+ * DTLS 1.0/1.2, HRR with cookie for DTLS 1.3) is enabled by default.
+ */
+ SSL *listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD);
/* Set up UDP socket BIO */
BIO *bio = BIO_new_dgram(socket_fd, BIO_NOCLOSE);
@@ -405,8 +397,8 @@ These functions were added in OpenSSL 3.5.
SSL_listen_ex() was added in OpenSSL 4.0.
-DTLS listener support (including B<SSL_LISTENER_FLAG_REQUIRE_HVR>,
-B<SSL_LISTENER_FLAG_REQUIRE_HRR> and B<SSL_LISTENER_FLAG_SINGLE_THREAD>
+DTLS listener support (including the B<SSL_LISTENER_FLAG_ADDRESS_VALIDATION>,
+B<SSL_LISTENER_FLAG_NO_VALIDATE> and B<SSL_LISTENER_FLAG_SINGLE_THREAD>
flags) was added in OpenSSL 4.1.
The DTLS listener tunables B<SSL_VALUE_DTLS_LISTENER_MAX_PENDING_CONNS>,
diff --git a/doc/man7/ossl-guide-dtlsv13.pod b/doc/man7/ossl-guide-dtlsv13.pod
index fc72ceb090..6af8582e97 100644
--- a/doc/man7/ossl-guide-dtlsv13.pod
+++ b/doc/man7/ossl-guide-dtlsv13.pod
@@ -115,9 +115,9 @@ finished sending Early Data.
=head1 HELLO RETRY REQUEST
-For DTLSv1.3 server applications, use L<SSL_new_listener(3)> with the
-B<SSL_LISTENER_FLAG_REQUIRE_HRR> flag to enable HelloRetryRequest cookie validation.
-This provides connection demultiplexing for multiple clients on a single UDP socket.
+For DTLSv1.3 server applications, use L<SSL_new_listener(3)>: HelloRetryRequest
+cookie validation is enabled by default. This provides connection demultiplexing
+for multiple clients on a single UDP socket.
Note that L<DTLSv1_listen(3)> only supports DTLS 1.0/1.2 with HelloVerifyRequest and
cannot be used with DTLSv1.3.
@@ -131,29 +131,24 @@ HelloVerifyRequest, the listener API fully supports DTLSv1.3 with HelloRetryRequ
cookie validation.
Create a DTLS listener using L<SSL_new_listener(3)> with an SSL_CTX configured
-for DTLS. The following flags control listener behavior:
+for DTLS. Address validation is enabled by default. The following flags adjust
+listener behavior:
=over 4
+=item B<SSL_LISTENER_FLAG_ADDRESS_VALIDATION>
+
+Requests address validation by HelloRetryRequest and HelloVerifyRequest. This
+is the default.
+
=item B<SSL_LISTENER_FLAG_NO_VALIDATE>
Disables all address validation. The listener will not send HelloVerifyRequest
(for DTLS 1.0/1.2) or HelloRetryRequest with cookie (for DTLSv1.3). This is
faster but provides no protection against amplification attacks. Not recommended
-for use in untrusted network environments.
-
-=item B<SSL_LISTENER_FLAG_REQUIRE_HVR>
-
-Requires HelloVerifyRequest (HVR) cookie exchange for DTLS 1.0 and DTLS 1.2
-connections. This provides protection against amplification attacks for pre-1.3
-DTLS versions.
-
-=item B<SSL_LISTENER_FLAG_REQUIRE_HRR>
-
-Requires HelloRetryRequest (HRR) cookie exchange for DTLSv1.3 connections. This
-provides protection against amplification attacks for DTLSv1.3. Both
-B<SSL_LISTENER_FLAG_REQUIRE_HVR> and B<SSL_LISTENER_FLAG_REQUIRE_HRR> may be
-specified together to enable address validation for all supported DTLS versions.
+for use in untrusted network environments. If both this flag and
+B<SSL_LISTENER_FLAG_ADDRESS_VALIDATION> are specified, the listener fails safe
+and performs address validation.
=item B<SSL_LISTENER_FLAG_SINGLE_THREAD>
diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index 2012d2daf9..bdf5d201c9 100644
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -2321,9 +2321,8 @@ __owur int SSL_is_connection(SSL *s);
__owur int SSL_is_listener(SSL *ssl);
__owur SSL *SSL_get0_listener(SSL *s);
#define SSL_LISTENER_FLAG_NO_VALIDATE (1UL << 1)
-#define SSL_LISTENER_FLAG_REQUIRE_HVR (1UL << 2)
-#define SSL_LISTENER_FLAG_REQUIRE_HRR (1UL << 3)
-#define SSL_LISTENER_FLAG_SINGLE_THREAD (1UL << 4)
+#define SSL_LISTENER_FLAG_ADDRESS_VALIDATION (1UL << 2)
+#define SSL_LISTENER_FLAG_SINGLE_THREAD (1UL << 3)
__owur SSL *SSL_new_listener(SSL_CTX *ctx, uint64_t flags);
__owur SSL *SSL_new_listener_from(SSL *ssl, uint64_t flags);
__owur SSL *SSL_new_from_listener(SSL *ssl, uint64_t flags);
diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 71b7416519..5ad6b84a06 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -1875,12 +1875,17 @@ SSL *ossl_dtls_new_listener(SSL_CTX *ctx, uint64_t flags)
dl->max_dgram_size = DTLS_LISTENER_DEFAULT_MAX_DGRAM_SIZE;
ossl_dgram_demux_set_mtu(dl->demux, (unsigned int)dl->max_dgram_size);
- /* Handle cookie validation flags */
- if ((flags & SSL_LISTENER_FLAG_NO_VALIDATE) == 0) {
- if (flags & SSL_LISTENER_FLAG_REQUIRE_HVR)
- dl->require_hvr_cookie = 1;
- if (flags & SSL_LISTENER_FLAG_REQUIRE_HRR)
- dl->require_hrr_cookie = 1;
+ /*
+ * Address validation is performed by default: HelloVerifyRequest for
+ * DTLS 1.0/1.2 and a HelloRetryRequest cookie for DTLS 1.3. It can be
+ * requested explicitly with SSL_LISTENER_FLAG_ADDRESS_VALIDATION, or
+ * disabled with SSL_LISTENER_FLAG_NO_VALIDATE. If both are specified we
+ * fail safe and validate: SSL_LISTENER_FLAG_ADDRESS_VALIDATION wins.
+ */
+ if ((flags & SSL_LISTENER_FLAG_NO_VALIDATE) == 0
+ || (flags & SSL_LISTENER_FLAG_ADDRESS_VALIDATION) != 0) {
+ dl->require_hvr_cookie = 1;
+ dl->require_hrr_cookie = 1;
}
dl->have_notifier = 0;
diff --git a/test/dtlsssllistenertest.c b/test/dtlsssllistenertest.c
index a1e6c5ded9..5c913c0a9d 100644
--- a/test/dtlsssllistenertest.c
+++ b/test/dtlsssllistenertest.c
@@ -870,7 +870,7 @@ err:
*
* Flow:
* 1. Create SSL contexts for DTLS 1.3 only
- * 2. Create listener (with REQUIRE_HRR flag) and client using helper
+ * 2. Create listener (address validation is on by default) and client using helper
* 3. Drive connection loop: client SSL_connect() + poll listener for IC event
* 4. SSL_accept_connection() returns server SSL after HRR cookie validation
* 5. Complete handshake with create_ssl_connection()
@@ -903,7 +903,7 @@ static int test_dtls13_connection_with_hrr(void)
/* Create listener and client using memory BIO helper */
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -1187,7 +1187,7 @@ static int test_dtls_mixed_12_hvr_and_13_hrr(void)
* go through HRR cookie validation.
*/
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
@@ -1399,7 +1399,7 @@ static int test_dtls_concurrent_clients_real_sockets(void)
* This ensures address validation for both DTLS 1.2 and 1.3 clients.
*/
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
@@ -1624,7 +1624,7 @@ end:
*
* Flow:
* 1. Create SSL contexts for DTLS 1.2 only
- * 2. Create listener (with REQUIRE_HVR flag) and client using helper
+ * 2. Create listener (address validation is on by default) and client using helper
* 3. Drive connection loop: client SSL_connect() + poll listener for IC event
* 4. SSL_accept_connection() returns server SSL after HVR cookie validation
* 5. Complete handshake with create_ssl_connection()
@@ -1657,7 +1657,7 @@ static int test_dtls12_connection_with_hvr(void)
/* Create listener and client using memory BIO helper */
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2312,7 +2312,7 @@ static int test_ssl_ownership_pending_conn_leak(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2391,7 +2391,7 @@ static int test_ssl_ownership_incoming_conn_leak(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2491,7 +2491,7 @@ static int test_ssl_ownership_three_conn_states(void)
goto end;
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
@@ -2683,7 +2683,7 @@ static int test_ssl_ownership_set_rbio_pending_leak(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2778,7 +2778,7 @@ static int test_ssl_ownership_set_rbio_incoming_leak(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2873,7 +2873,7 @@ static int test_ssl_ownership_accept_free_no_double_free(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -2968,7 +2968,7 @@ static int test_ssl_ownership_multiple_pending_leak(void)
goto end;
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
@@ -3050,7 +3050,7 @@ static int test_ssl_ownership_pending_timeout_cleanup(void)
goto end;
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -3513,8 +3513,14 @@ static int test_dtls_poll_listener_multiple_events(void)
&sctx, &cctx, cert, privkey)))
goto end;
+ /*
+ * This test drives a single ClientHello and expects the listener to
+ * report the incoming connection immediately, so disable address
+ * validation (otherwise the connection is not ready until the HVR/HRR
+ * cookie round-trip completes).
+ */
if (!TEST_true(create_dtls_listener_and_client_mem(sctx, cctx,
- SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_NO_VALIDATE | SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &clientssl, &client_addr)))
goto end;
@@ -4154,7 +4160,7 @@ static int test_dtls_listener_max_dgram_size_functional(void)
goto end;
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
@@ -4389,7 +4395,7 @@ static int test_pending_conn_cap_enforcement(void)
/* Create listener with HVR required (so connections stay pending) */
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto err;
@@ -4482,7 +4488,7 @@ static int test_pending_cap_with_timeout(void)
/* Create listener with HVR required (so connections stay pending) */
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto err;
@@ -4723,8 +4729,7 @@ static int run_new_pending_cb_scenario(uint64_t max_pending, int allow_remaining
goto err;
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR
- | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto err;
@@ -4957,7 +4962,7 @@ static int test_dtls_notifier_signalled_on_accept_queue_push(void)
* listener has a notifier at all.
*/
if (!TEST_true(create_dtls_listener(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR,
+ 0,
&listener, &server_addr, &server_fd)))
goto end;
@@ -5462,8 +5467,7 @@ static int test_dtls_blocking_mode(void)
* A socket BIO supplies a poll descriptor, so blocking is available.
*/
if (!TEST_true(create_dtls_listener_unconfigured(sctx,
- SSL_LISTENER_FLAG_REQUIRE_HVR | SSL_LISTENER_FLAG_REQUIRE_HRR
- | SSL_LISTENER_FLAG_SINGLE_THREAD,
+ SSL_LISTENER_FLAG_SINGLE_THREAD,
&listener, &server_addr, &server_fd)))
goto end;
diff --git a/util/other.syms b/util/other.syms
index d2699881a5..9b36384dd8 100644
--- a/util/other.syms
+++ b/util/other.syms
@@ -826,8 +826,7 @@ SSL_WRITE_FLAG_CONCLUDE define
SSL_LISTENER_FLAG_NO_ACCEPT define
SSL_LISTENER_FLAG_NO_VALIDATE define
SSL_LISTENER_FLAG_SINGLE_THREAD define
-SSL_LISTENER_FLAG_REQUIRE_HRR define
-SSL_LISTENER_FLAG_REQUIRE_HVR define
+SSL_LISTENER_FLAG_ADDRESS_VALIDATION define
TLS_DEFAULT_CIPHERSUITES define deprecated 3.0.0
X509_CRL_http_nbio define deprecated 3.0.0
X509_http_nbio define deprecated 3.0.0