Alex Weibel

fix: Zero-initialize all local variable declarations (#6007) Co-authored-by: Carol Yeh <69044490+CarolYeh910@users.noreply.github.com>

fix(cbc): Disable padding after key init and check decrypt len (#6042) Co-authored-by: James Mayclin <maycj@amazon.com>

fix(connection): Make set_config validator replacement transactional (#5847) Co-authored-by: Carol Yeh <69044490+CarolYeh910@users.noreply.github.com>

fix: Add fail-closed default cases to all switch statements (#6006) Co-authored-by: Carol Yeh <69044490+CarolYeh910@users.noreply.github.com>

Merge commit from fork RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records MUST be TLS_APPLICATION_DATA (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data (AAD) rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. If the outer content_type were modified in transit to an unrecognized value (e.g., 0x18), the record would decrypt successfully, but the unrecognized type would fall through the dispatch switch in s2n_recv_impl with no handler, causing the decrypted application data to be discarded. The connection would continue with no error surfaced to the caller. Additionally, per RFC 8446 Appendix D.4, CCS records are only valid during the handshake. Previously, s2n_is_tls13_plaintext_content routed CCS through the null cipher path regardless of handshake state, which meant a content_type modified to CCS (0x14) on a post-handshake record would also be silently discarded. Similarly, plaintext ALERT records were accepted post-handshake. An on-path attacker who flipped the outer content_type from 0x17 to 0x15 (ALERT) would route the raw AEAD ciphertext through the null cipher into the alert parser. Because the null cipher path uses separate sequence numbers, failed attempts do not desynchronize the AEAD state, allowing unlimited retries. If the first two ciphertext bytes happen to form a close_notify (byte[1] == 0x00, probability 1/256) or user_canceled (byte[1] == 0x5A, probability 1/256), the record is silently consumed — either as a fake shutdown or as a discarded warning. RFC 8446 Section 5.2 requires all post-handshake records to be encrypted, so plaintext alerts after the handshake are a protocol violation. This commit adds five layers of validation: 1. s2n_record_header_parse: reject content_type values outside the valid set {20, 21, 22, 23} once the protocol version is established. This is the earliest rejection point, before any buffer allocation or cryptographic work. 2. s2n_is_tls13_plaintext_content: add a s2n_handshake_is_complete guard so that CCS records are no longer routed through the plaintext/null-cipher path after the handshake completes. 3. s2n_is_tls13_plaintext_content: add the same s2n_handshake_is_complete guard for ALERT records, so that plaintext alerts are only accepted during the handshake. After the handshake, alerts must arrive as encrypted records (outer content_type APPLICATION_DATA, inner content_type ALERT). 4. s2n_record_parse: reject TLS 1.3 encrypted records (non-null cipher) whose outer content_type is not TLS_APPLICATION_DATA. 5. s2n_recv_impl: add explicit TLS_CHANGE_CIPHER_SPEC handling and a default case to the record type dispatch switch, so unrecognized types produce a fatal error instead of being discarded.

Merge commit from fork s2n_quic_transport_params_recv used s2n_alloc to store the peer's QUIC transport parameters. s2n_alloc zeroes the blob struct before allocating, which orphans any existing allocation. During a TLS 1.3 HelloRetryRequest, this function is called twice on the same connection: once for the initial ClientHello and again for the retry ClientHello. The second s2n_alloc call would overwrite the blob, permanently leaking the first allocation. This leak occurs on every QUIC connection that triggers a HelloRetryRequest, including non-malicious clients that simply offer a key share group the server does not prefer. An attacker could amplify the leak by deliberately forcing HRR, leaking up to 64KB per handshake. Replace s2n_alloc with s2n_realloc, which safely handles blobs that already have memory allocated by either reusing the existing buffer or freeing it before allocating a new one.

ci: bump MSRV for extended workspace from 1.89 to 1.91 (#5980)

perf(sidetrail): Avoid digest zeroing in proof (#6056)

fix(duvet): Correct CCS quote attribution to RFC 8446 section 5 (#5999)