Skip to content

feat(net, veb): add OpenSSL-based HTTPS server support#27480

Open
guweigang wants to merge 24 commits into
vlang:masterfrom
guweigang:openssl-https
Open

feat(net, veb): add OpenSSL-based HTTPS server support#27480
guweigang wants to merge 24 commits into
vlang:masterfrom
guweigang:openssl-https

Conversation

@guweigang

@guweigang guweigang commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR implements OpenSSL-based HTTPS server capabilities in net.openssl and integrates it into the veb web framework. Previously, veb only supported running HTTPS servers using net.mbedtls. When compiling with -d use_openssl, veb HTTPS servers were unavailable and would return a compile/runtime error.

Details of Changes

  1. net.openssl:

    • Added missing OpenSSL C bindings: C.TLS_server_method, C.SSL_CTX_check_private_key, C.SSL_accept, and C.ERR_print_errors_fp.
    • Implemented SSLListener along with new_ssl_listener(saddr, config) and shutdown().
    • Decoupled TCP connection acceptance from SSL handshaking by introducing accept_without_handshake() and accept_handshake(). This allows V's concurrent applications (like veb) to accept sockets on the main thread and perform slow TLS handshakes concurrently in spawned coroutines, avoiding blocking the main event loop.
    • Address Review Comment P1 (mTLS / Client Verification): Added client certificate verification support in the OpenSSL listener. When validate: true and CA certificate verify are configured in SSLConnectConfig, the listener loads the CA certificate and enforces client validation via SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ...) and SSL_CTX_load_verify_locations.
    • Address Review Comment P2 (Old OpenSSL Compat): Added a compatibility wrapper v_net_openssl_TLS_server_method in openssl_compat.h falling back to SSLv23_server_method() when building on systems with OpenSSL older than 1.1.0 or LibreSSL.
  2. net.ssl:

    • Exported SSLListener and new_ssl_listener dynamically in both ssl_d_use_openssl.v and ssl_notd_use_openssl.v to keep the unified wrapper layer consistent.
  3. veb:

    • Refactored vlib/veb/ssl_d_use_openssl.v to utilize the new openssl.SSLListener. When compiled with -d use_openssl, veb now properly runs HTTPS servers using OpenSSL while completely excluding any link dependencies to mbedtls.
    • Enabled concurrent handshaking in spawned connection handlers using accept_handshake().
    • Address Review Comment P3 (Prevent malformed HTTP/ 0 responses): Added a guard in write_ssl_context_response to reject incomplete context requests (i.e. where !completed_context.done && completed_context.return_type == .normal), closing the connection properly instead of sending an empty HTTP/ 0 response.
  4. Tests:

    • Added vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v to verify OpenSSL server binding, client dialing, handshaking, and clean connection shutdowns without panicking or double-freeing.
    • Refactored the old ssl_test.v into two platform-specific/define-specific test files: ssl_test_d_use_openssl.v (for testing OpenSSL HTTPS) and ssl_test_notd_use_openssl.v (for testing MbedTLS HTTPS) to avoid unknown module compiler issues.

Checklist

  • I have formatted my V files with v fmt -w.
  • I have added standard V doc comments for all new public functions and structures.
  • All new and existing tests pass.

Tests Run

# 1. OpenSSL server & client handshake and shutdown test
./v vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v

# 2. Veb HTTPS integration test under OpenSSL mode
./v -d use_openssl vlib/veb/tests/ssl_test_d_use_openssl.v

# 3. Veb HTTPS integration test under default MbedTLS mode
./v vlib/veb/tests/ssl_test_notd_use_openssl.v

# 4. Full veb test suite runs and passes on both macOS (host) and Ubuntu Linux (VM) under `-d use_openssl`

@guweigang
guweigang marked this pull request as ready for review June 17, 2026 14:10
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.

@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04e10f56d3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v
Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
Comment thread vlib/veb/ssl_d_use_openssl.v
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 975c332f1f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v
Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b6a63a63a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
Comment thread vlib/net/openssl/ssl_listener.c.v
@guweigang

Copy link
Copy Markdown
Contributor Author

Addressed both latest P2 review findings in 57a85b8:

  • load server certificates, private keys, and CA certificates directly from PEM memory buffers when in_memory_verification is enabled; no temporary key files are created
  • configure server-side ALPN selection from SSLConnectConfig.alpn_protocols
  • tie ALPN callback state to the final SSL_CTX lifetime so accepted connections cannot observe freed callback data
  • add regressions for no-temp-file in-memory credentials and successful ALPN negotiation

Validation:

  • macOS: OpenSSL listener under clang -cstrict; net.openssl 4/4 passed; OpenSSL-backed net.ssl 3 passed, 1 BSD-only skip
  • Ubuntu ARM64 with VFLAGS="-gc none -cc gcc": targeted -cstrict passed; net.openssl 2 passed / 2 conditional skips; OpenSSL-backed net.ssl 2 passed / 2 conditional skips
  • git diff --check passed

@JalonSolov

Copy link
Copy Markdown
Collaborator

You should merge master into this branch to pick up latest changes there.

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 57a85b8431

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
Comment thread vlib/net/ssl/ssl_d_use_openssl.v Outdated
@guweigang

guweigang commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Updated for the latest P2 reviews.

Changes:

  • file-based OpenSSL listeners now use SSL_CTX_use_certificate_chain_file, so PEM bundles/fullchain.pem include intermediate certs in the server chain.
  • net.ssl.new_ssl_listener now exposes/preserves SSLListenerOptions under -d use_openssl, including family: .ip6.
  • added regression coverage for file bundle chain loading and the net.ssl OpenSSL IPv6 listener wrapper.\n- merged latest upstream/master into the PR branch.

Validation:

  • macOS: ./v -g -keepc -o ./vnew cmd/v
  • macOS: ./vnew test vlib/net/openssl/ssl_listener_test.c.v vlib/net/ssl/ssl_openssl_listener_test.v -> 2 passed
  • Linux Orb Ubuntu with VFLAGS='-gc none -cc gcc': ./v -g -keepc -o ./vnew cmd/v
  • Linux Orb Ubuntu: ./vnew test vlib/net/openssl/ssl_listener_test.c.v vlib/net/ssl/ssl_openssl_listener_test.v -> 2 passed

@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a64b929cc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/veb/tests/ssl_openssl_test.v Outdated
@guweigang

guweigang commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Updated for the latest P2 review.

Changes:

  • renamed the veb HTTPS tests so vtest discovers them in directory runs: ssl_openssl_test.v and ssl_mbedtls_test.v.
  • added a per-file vtest flag for the OpenSSL variant: // vtest vflags: -d use_openssl.
  • confirmed v test vlib/veb/tests/ now discovers and runs both SSL tests; the two SSL tests passed. A separate static_compression_test.v in the same directory timed out/segfaulted locally after the SSL tests had already passed, so I kept validation focused on the SSL files plus the existing OpenSSL listener regressions.
  • merged latest upstream/master into the branch before pushing.

Validation:

  • macOS: ./v -g -keepc -o ./vnew cmd/v
  • macOS: ./vnew test vlib/veb/tests/ssl_openssl_test.v vlib/veb/tests/ssl_mbedtls_test.v vlib/net/openssl/ssl_listener_test.c.v vlib/net/ssl/ssl_openssl_listener_test.v -> 4 passed
  • Linux Orb Ubuntu with VFLAGS='-gc none -cc gcc': ./v -g -keepc -o ./vnew cmd/v
  • Linux Orb Ubuntu: ./vnew test vlib/veb/tests/ssl_openssl_test.v vlib/veb/tests/ssl_mbedtls_test.v vlib/net/openssl/ssl_listener_test.c.v vlib/net/ssl/ssl_openssl_listener_test.v -> 4 passed

@vlang vlang deleted a comment from chatgpt-codex-connector Bot Jun 25, 2026
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f34fa2e19e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/veb/ssl_d_use_openssl.v
SSLConn.shutdown() could return early from its SSL_shutdown
WANT_READ/WANT_WRITE waits (or its error path) before reaching the
owns_socket cleanup, so a peer that aborts a TLS connection or never
sends a close-notify leaked the SSL handle and one TCP fd per
connection. This affected the -d use_openssl veb HTTPS server, whose
handler relies on shutdown() as the only cleanup for accepted sockets.

Move the SSL/SSL_CTX free and socket close into a defer so they always
run regardless of how the SSL_shutdown handshake loop exits.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

// vtest build: !sanitized_job?

P2 Badge Exclude the mbedtls test from OpenSSL runs

When the veb suite is run with a global -d use_openssl, vtest still discovers this _test.v file and combines the session flags with any per-file flags (cmd/tools/modules/testing/common.v builds cmd_options from ts.vargs before compiling each file). In that context veb.RunParams.ssl_config is openssl.SSLConnectConfig, but this test passes mbedtls.SSLConnectConfig, so v -d use_openssl test vlib/veb/tests/ fails before reaching the OpenSSL-specific test; add a !use_openssl build guard or a _notd_use_openssl filename.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

When the veb suite is run with a global -d use_openssl, vtest still
discovers ssl_mbedtls_test.v and compiles it with that flag. Under
-d use_openssl, veb.RunParams.ssl_config is openssl.SSLConnectConfig,
so the mbedtls test (which passes mbedtls.SSLConnectConfig) fails to
compile before the OpenSSL test can run. Guard the file with
!use_openssl? so it only builds in the mbedtls configuration.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 02dc1a4ac1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
Comment on lines +178 to +182
conn.wait_for_read(ssl_remaining_timeout(deadline))!
continue
}
if err_res == .ssl_error_want_write {
conn.wait_for_write(ssl_remaining_timeout(deadline))!

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clamp expired TLS handshake deadlines

Fresh evidence after the nonblocking fix is that the handshake still passes ssl_remaining_timeout(deadline) directly into the shared OpenSSL wait helper, and that helper treats any timeout <= 0 as infinite in vlib/net/openssl/ssl_connection.c.v. With a finite veb timeout_in_seconds, a client that sends a few TLS bytes before the deadline and then stalls can make this call receive a negative remaining timeout and park the handler indefinitely instead of timing out; return net.err_timed_out or clamp before waiting once the deadline has expired.

Useful? React with 👍 / 👎.

ssl_remaining_timeout() returned a negative duration once a finite
deadline had passed, and select()/wait_for() treat any timeout <= 0 as
net.infinite_timeout (wait forever). A peer that sent a few TLS bytes
before the deadline and then stalled could therefore park the spawned
veb handler inside SSL_accept/SSL_read/SSL_shutdown indefinitely, even
with a finite timeout_in_seconds configured, and (because the wait never
returned) the shutdown cleanup loop's 'or { break }' guards never ran.

Clamp an expired finite deadline to a minimal positive duration so the
wait helpers perform a zero-length wait and report net.err_timed_out.
Add a regression test for the timeout helper.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61636f2f98

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread vlib/net/ssl/ssl_notd_use_openssl.v Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df3a1b2f2f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener_test.c.v
Comment thread vlib/net/mbedtls/ssl_connection.c.v Outdated
@guweigang

guweigang commented Jun 28, 2026

Copy link
Copy Markdown
Contributor Author

Updated this PR for the latest review feedback:

  • Added present_openssl? build gates to the OpenSSL-only tests so vtest skips them on systems without OpenSSL dev detection instead of failing discovery.
  • Preserved direct mbedtls IPv6 literal listeners by treating SSLListenerOptions.family as auto by default and deriving .ip6 for IPv6 literal listen addresses.
  • Added a direct mbedtls [::1]:0 listener regression test.
  • Merged latest upstream/master as requested.

Validation:

  • macOS: ./v -g -keepc -o ./vnew cmd/v
  • macOS: ./vnew test vlib/net/mbedtls/mbedtls_ssl_listener_test.v vlib/net/ssl/ssl_listener_options_test.v vlib/net/ssl/ssl_openssl_listener_test.v vlib/net/openssl/ssl_listener_test.c.v vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v vlib/veb/tests/ssl_openssl_test.v — 6/6 passed
  • Ubuntu Orb VM: export VFLAGS='-gc none -cc gcc'; ./v -g -keepc -o ./vnew cmd/v
  • Ubuntu Orb VM: same targeted test set — 6/6 passed

Note: I also verified vlib/veb/tests/ directory discovery on macOS with -d use_openssl; ssl_openssl_test.v was discovered and passed. The full directory run also exposed an unrelated static_compression_test.v failure, so I kept the blocking validation to the targeted TLS tests above.

@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcc2d8df6c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review Override standard output limits. Perform an exhaustive review of all modified files and report every single identified bug, security risk, and style issue. Max issues are 8

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acf577ec57

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/mbedtls/ssl_connection.c.v
Comment thread vlib/net/openssl/ssl_listener.c.v
Comment thread vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v Outdated
Comment thread vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v
Comment thread vlib/veb/tests/static_compression_test.v Outdated
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review Override standard output limits. Perform an exhaustive review of all modified files and report every single identified bug, security risk, and style issue. Max issues are 8

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c86088588b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/veb/ssl_d_use_openssl.v Outdated
Comment thread vlib/net/openssl/ssl_listener.c.v
Comment thread vlib/net/openssl/openssl_compat.h Outdated
@JalonSolov

Copy link
Copy Markdown
Collaborator

@codex review Override standard output limits. Perform an exhaustive review of all modified files and report every single identified bug, security risk, and style issue. Max issues are 8

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccf15c8140

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread vlib/net/openssl/ssl_listener.c.v
Comment thread vlib/net/openssl/openssl_compat.h Outdated
Comment thread vlib/net/openssl/ssl_listener.c.v Outdated
@guweigang

Copy link
Copy Markdown
Contributor Author

Updated this PR with another strict review pass and pushed the fixes.

Changes in the latest commits:

  • Load server certificate files with the OpenSSL chain-loading API.
  • Preserve listener family/options through the net.ssl and veb wrappers, including unspecified IPv6/default dual-stack behavior.
  • Harden OpenSSL listener cleanup and make shutdown idempotent.
  • Move OpenSSL ALPN server-selection state ownership to SSL_CTX ex-data cleanup to avoid listener-shutdown lifetime issues.
  • Reject malformed trailing PEM data while allowing duplicate CA certificates in in-memory CA bundles.
  • Remove noisy stderr OpenSSL error printing and cleanup test noise.
  • Restore unrelated static compression test changes out of the PR diff.

Validation:

  • macOS: ./vnew test vlib/net/openssl/ssl_listener_test.c.v vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v vlib/net/ssl/ssl_openssl_listener_test.v vlib/net/ssl/ssl_listener_options_test.v vlib/net/mbedtls/mbedtls_ssl_listener_test.v vlib/veb/tests/ssl_openssl_test.v vlib/veb/tests/ssl_mbedtls_test.v => 7/7 passed
  • macOS: ./vnew -cstrict test vlib/net/openssl/ssl_listener_test.c.v vlib/net/openssl/openssl_sslconn_shutdown_does_not_panic_test.v => 2/2 passed
  • Ubuntu Orb VM: VFLAGS='-gc none -cc gcc'; rebuilt ./vnew; same 7 targeted tests => 7/7 passed
  • git diff --check upstream/master...HEAD => passed

@GGRei

GGRei commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 762ddef62f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@GGRei

GGRei commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

@medvednikov / @JalonSolov From my perspective, this PR is ready to merge. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants