Commit 5b8501c9c7 for openssl.org
commit 5b8501c9c7058de27524b8cf44ee687f75b1ef6a
Author: Ryan Hooper <ryanh@openssl.foundation>
Date: Tue Aug 11 10:17:22 2026 -0400
DTLS 1.3 CI nightly NO DTLS 1.2 Failures Fix
dtlsv1listentest uses DTLSv1_listen(), a DTLS 1.2-only API that crashes
when DTLS 1.2 is disabled. Guard the test in build.info under
!$disabled{dtls1_2} and add a matching recipe skip so the test is neither
compiled nor run when DTLS 1.2 is unavailable.
The dtls_ccs_reorder test file is specific to DTLS 1.0/1.2 CCS reordering,
which does not apply to DTLS 1.3. The recipe only skipped when all DTLS was
disabled, so when both DTLS 1.0 and 1.2 were disabled while DTLS 1.3
remained, the test still ran. Add a recipe skip for when both DTLS 1.0 and
DTLS 1.2 are disabled, matching the build.info condition.
ssl_ctx_test had two test table entries that set DTLS1_2_VERSION as a max
protocol version and expected success. When DTLS 1.2 is disabled that
version is not valid for any protocol, so SSL_CTX_set_max_proto_version()
returns 0. Guard both entries with #ifndef OPENSSL_NO_DTLS1_2.
dtlstest contained a dead #ifdef OPENSSL_NO_DTLS1_2 block inside
test_listen(), which is itself wrapped in #ifndef OPENSSL_NO_DTLS1_2.
The inner ifdef could never be true; remove it.
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Merge-date: Thu Aug 20 09:55:38 2026
Merged-from: https://github.com/openssl/openssl/pull/32340
diff --git a/test/build.info b/test/build.info
index 0bb738bc0b..88b8f21b7a 100644
--- a/test/build.info
+++ b/test/build.info
@@ -55,7 +55,7 @@ IF[{- !$disabled{tests} -}]
conf_include_test params_api_test params_conversion_test \
constant_time_test crypto_memcmp_test safe_math_test verify_extra_test clienthellotest \
packettest asynctest secmemtest srptest memleaktest stack_test \
- dtlsv1listentest ct_test threadstest d2i_test \
+ ct_test threadstest d2i_test \
ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
bio_callback_test bio_memleak_test bio_core_test bio_dgram_test param_build_test \
sslapitest ssl_handshake_rtt_test dtlstest sslcorrupttest \
@@ -107,10 +107,14 @@ IF[{- !$disabled{tests} -}]
PROGRAMS{noinst}=cert_comp_test
ENDIF
- IF[{- !$disabled{dtls} -}]
+ IF[{- !$disabled{dtls1} || !$disabled{dtls1_2} -}]
PROGRAMS{noinst}=dtls_ccs_reorder_test
ENDIF
+ IF[{- !$disabled{dtls1_2} -}]
+ PROGRAMS{noinst}=dtlsv1listentest
+ ENDIF
+
SOURCE[confdump]=confdump.c
INCLUDE[confdump]=../include ../apps/include
DEPEND[confdump]=../libcrypto
@@ -530,9 +534,11 @@ IF[{- !$disabled{tests} -}]
INCLUDE[lhash_test]=../include ../apps/include
DEPEND[lhash_test]=../libcrypto.a libtestutil.a
- SOURCE[dtlsv1listentest]=dtlsv1listentest.c helpers/ssltestlib.c
- INCLUDE[dtlsv1listentest]=../include ../apps/include
- DEPEND[dtlsv1listentest]=../libcrypto ../libssl libtestutil.a
+ IF[{- !$disabled{dtls1_2} -}]
+ SOURCE[dtlsv1listentest]=dtlsv1listentest.c helpers/ssltestlib.c
+ INCLUDE[dtlsv1listentest]=../include ../apps/include
+ DEPEND[dtlsv1listentest]=../libcrypto ../libssl libtestutil.a
+ ENDIF
IF[{- !$disabled{sock} && !$disabled{dtls} -}]
PROGRAMS{noinst}=dtlsssllistenertest
diff --git a/test/dtlsssllistenertest.c b/test/dtlsssllistenertest.c
index 5c913c0a9d..1505a49aaa 100644
--- a/test/dtlsssllistenertest.c
+++ b/test/dtlsssllistenertest.c
@@ -532,6 +532,7 @@ err:
* Test SSL_new_listener with DTLS 1.2 only context.
* Verifies that listeners work with DTLS 1.2.
*/
+#ifndef OPENSSL_NO_DTLS1_2
static int test_dtls_new_listener_dtls12(void)
{
SSL_CTX *ctx = NULL;
@@ -560,6 +561,7 @@ err:
SSL_CTX_free(ctx);
return success;
}
+#endif /* OPENSSL_NO_DTLS1_2 */
/*
* Test SSL_get0_listener and SSL_is_listener on a non-listener DTLS SSL object.
@@ -1123,6 +1125,7 @@ end:
return testresult;
}
+#ifndef OPENSSL_NO_DTLS1_2
/*
* Test mixed DTLS versions: DTLS 1.2 with HVR and DTLS 1.3 with HRR.
*
@@ -1350,6 +1353,7 @@ end:
SSL_CTX_free(cctx_13);
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_2 */
/*
* Test true concurrent multi-client with real UDP sockets (shared socket).
@@ -1615,6 +1619,7 @@ end:
}
#endif /* OPENSSL_NO_DTLS1_3 */
+#ifndef OPENSSL_NO_DTLS1_2
/*
* Test DTLS 1.2 connection WITH HelloVerifyRequest (HVR).
*
@@ -1877,6 +1882,7 @@ end:
SSL_CTX_free(cctx);
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_2 */
/*
* Test SSL_get_peer_addr on a fresh SSL object with no peer.
@@ -2307,7 +2313,7 @@ static int test_ssl_ownership_pending_conn_leak(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2386,7 +2392,7 @@ static int test_ssl_ownership_incoming_conn_leak(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2678,7 +2684,7 @@ static int test_ssl_ownership_set_rbio_pending_leak(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2773,7 +2779,7 @@ static int test_ssl_ownership_set_rbio_incoming_leak(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2868,7 +2874,7 @@ static int test_ssl_ownership_accept_free_no_double_free(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2963,7 +2969,7 @@ static int test_ssl_ownership_multiple_pending_leak(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3045,7 +3051,7 @@ static int test_ssl_ownership_pending_timeout_cleanup(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3180,7 +3186,7 @@ static int test_dtls_poll_conn_event_w(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3271,7 +3277,8 @@ static int test_dtls_poll_conn_dgram_pair_readable(void)
BIO_ADDR *client_addr = NULL;
const char msg[] = "Test data for poll readable";
char buf[64];
- size_t written, readbytes;
+ unsigned char drain[256];
+ size_t written, readbytes, drain_len = 0;
int testresult = 0;
int retc, err_code;
SSL_POLL_ITEM poll_item;
@@ -3281,7 +3288,7 @@ static int test_dtls_poll_conn_dgram_pair_readable(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3327,6 +3334,15 @@ static int test_dtls_poll_conn_dgram_pair_readable(void)
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
+ /*
+ * Drain any pending post-handshake records (e.g., DTLS 1.3 ACKs for
+ * NewSessionTicket). These are not application data but appear as readable.
+ * Expect SSL_read_ex to return 0 (no app data) with zero bytes read.
+ */
+ if (!TEST_false(SSL_read_ex(serverssl, drain, sizeof(drain), &drain_len))
+ || !TEST_size_t_eq(drain_len, 0))
+ goto end;
+
/*
* Poll server connection for SSL_POLL_EVENT_R BEFORE any data is sent.
* This should return revents=0 since no data is pending.
@@ -3401,6 +3417,8 @@ static int test_dtls_poll_conn_no_events_before_data(void)
SSL *listener = NULL;
SSL *serverssl = NULL, *clientssl = NULL;
BIO_ADDR *client_addr = NULL;
+ unsigned char drain[256];
+ size_t drain_len = 0;
int testresult = 0;
int retc, err_code;
SSL_POLL_ITEM poll_item;
@@ -3410,7 +3428,7 @@ static int test_dtls_poll_conn_no_events_before_data(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3456,6 +3474,15 @@ static int test_dtls_poll_conn_no_events_before_data(void)
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
+ /*
+ * Drain any pending post-handshake records (e.g., DTLS 1.3 ACKs for
+ * NewSessionTicket). These are not application data but appear as readable.
+ * Expect SSL_read_ex to return 0 (no app data) with zero bytes read.
+ */
+ if (!TEST_false(SSL_read_ex(serverssl, drain, sizeof(drain), &drain_len))
+ || !TEST_size_t_eq(drain_len, 0))
+ goto end;
+
/*
* Poll server connection for SSL_POLL_EVENT_R with no data pending.
* Use zero timeout for non-blocking behavior.
@@ -3509,7 +3536,7 @@ static int test_dtls_poll_listener_multiple_events(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -3607,7 +3634,7 @@ static int test_dtls_poll_conn_event_ec(void)
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_2_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -5941,7 +5968,9 @@ int setup_tests(void)
/* Basic listener creation and configuration tests */
ADD_TEST(test_dtls_new_listener);
+#ifndef OPENSSL_NO_DTLS1_2
ADD_TEST(test_dtls_new_listener_dtls12);
+#endif
/* BIO management tests */
ADD_TEST(test_dtls_listener_bio);
@@ -5973,8 +6002,10 @@ int setup_tests(void)
ADD_TEST(test_dtls_listen_ex_returns_error);
/* DTLS 1.2 connection tests */
+#ifndef OPENSSL_NO_DTLS1_2
ADD_TEST(test_dtls12_connection_with_hvr);
ADD_TEST(test_dtls12_connection_without_hvr);
+#endif
#ifndef OPENSSL_NO_DTLS1_3
/* DTLS 1.3 connection tests */
@@ -5982,7 +6013,9 @@ int setup_tests(void)
ADD_TEST(test_dtls13_connection_without_hrr);
/* Mixed version tests */
+#ifndef OPENSSL_NO_DTLS1_2
ADD_TEST(test_dtls_mixed_12_hvr_and_13_hrr);
+#endif
/* Concurrent client tests */
ADD_TEST(test_dtls_concurrent_clients_real_sockets);
diff --git a/test/dtlstest.c b/test/dtlstest.c
index 91a0029ee9..f9cf472f69 100644
--- a/test/dtlstest.c
+++ b/test/dtlstest.c
@@ -183,6 +183,7 @@ end:
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
static int test_dtls_drop_records(int serverwbio, int minversion, int maxversion,
int doresumption, int epoch, int idx);
+#ifndef OPENSSL_NO_DTLS1_2
static int test_dtls_drop_records_dtls1(int idx)
{
int doresumption;
@@ -224,6 +225,7 @@ static int test_dtls_drop_records_dtls1(int idx)
return test_dtls_drop_records(serverwbio, DTLS1_VERSION, DTLS1_2_VERSION,
doresumption, epoch, idx);
}
+#endif /* OPENSSL_NO_DTLS1_2 */
/* ClientHello */
#define DTLS13_CLI_TO_SRV_EPOCH_0_RECS_FULL 1
@@ -604,6 +606,7 @@ end:
* Test 2: Test receiving an app data record early from next epoch on client side
* Test 3: Test receiving an app data before Finished on client side
*/
+#ifndef OPENSSL_NO_DTLS1_2
static int test_swap_records_dtls1(int idx)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -724,6 +727,7 @@ end:
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_2 */
/*
* Test that swapping later records before Finished or CCS still works
@@ -848,10 +852,12 @@ end:
#endif
static int test_duplicate_app_data(int minversion, int maxversion);
+#ifndef OPENSSL_NO_DTLS1_2
static int test_duplicate_app_data_dtls1(void)
{
return test_duplicate_app_data(DTLS1_VERSION, DTLS1_2_VERSION);
}
+#endif /* OPENSSL_NO_DTLS1_2 */
static int test_duplicate_app_data_dtls13(void)
{
@@ -958,6 +964,7 @@ end:
}
/* Confirm that we can create a connections using DTLSv1_listen() */
+#ifndef OPENSSL_NO_DTLS1_2
static int test_listen(void)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -970,14 +977,6 @@ static int test_listen(void)
&sctx, &cctx, cert, privkey)))
return 0;
-#ifdef OPENSSL_NO_DTLS1_2
- /* Default sigalgs are SHA1 based in <DTLS1.2 which is in security level 0 */
- if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
- || !TEST_true(SSL_CTX_set_cipher_list(cctx,
- "DEFAULT:@SECLEVEL=0")))
- goto end;
-#endif
-
SSL_CTX_set_cookie_generate_cb(sctx, generate_cookie_cb);
SSL_CTX_set_cookie_verify_cb(sctx, verify_cookie_cb);
@@ -1005,6 +1004,7 @@ end:
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_2 */
OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
@@ -1021,7 +1021,9 @@ int setup_tests(void)
ADD_ALL_TESTS(test_dtls_unprocessed, NUM_TESTS);
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
+#ifndef OPENSSL_NO_DTLS1_2
ADD_ALL_TESTS(test_dtls_drop_records_dtls1, TOTAL_RECORDS);
+#endif
#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS)
ADD_ALL_TESTS(test_dtls_drop_records_dtls13, DTLS13_TOTAL_RECORDS);
#endif
@@ -1029,12 +1031,16 @@ int setup_tests(void)
ADD_TEST(test_cookie);
ADD_TEST(test_dtls_duplicate_records);
ADD_TEST(test_just_finished);
+#ifndef OPENSSL_NO_DTLS1_2
ADD_ALL_TESTS(test_swap_records_dtls1, 4);
+#endif
#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM)
ADD_ALL_TESTS(test_swap_records_dtls13, 4);
#endif
+#ifndef OPENSSL_NO_DTLS1_2
ADD_TEST(test_listen);
ADD_TEST(test_duplicate_app_data_dtls1);
+#endif
ADD_TEST(test_duplicate_app_data_dtls13);
return 1;
diff --git a/test/recipes/80-test_dtls_ccs_reorder.t b/test/recipes/80-test_dtls_ccs_reorder.t
index 3c703afc34..b6ac263286 100755
--- a/test/recipes/80-test_dtls_ccs_reorder.t
+++ b/test/recipes/80-test_dtls_ccs_reorder.t
@@ -18,6 +18,9 @@ setup("test_dtls_ccs_reorder");
plan skip_all => "No DTLS protocols are supported"
if alldisabled(available_protocols("dtls"));
+plan skip_all => "No DTLS 1.2 or 1.0 support in this OpenSSL build"
+ if disabled("dtls1_2") && disabled("dtls1");
+
plan tests => 1;
ok(run(test(["dtls_ccs_reorder_test",
diff --git a/test/recipes/80-test_dtlsv1listen.t b/test/recipes/80-test_dtlsv1listen.t
index b8968fe012..f9fd84c1a9 100644
--- a/test/recipes/80-test_dtlsv1listen.t
+++ b/test/recipes/80-test_dtlsv1listen.t
@@ -14,6 +14,9 @@ setup("test_dtlsv1listen");
plan skip_all => "No DTLS protocols are supported by this OpenSSL build"
if alldisabled(available_protocols("dtls"));
+plan skip_all => "No DTLS 1.2 support in this OpenSSL build"
+ if disabled("dtls1_2");
+
plan tests => 1;
ok(run(test(["dtlsv1listentest", srctop_file("apps", "server.pem"),
diff --git a/test/ssl-tests/18-dtls-renegotiate.cnf.in b/test/ssl-tests/18-dtls-renegotiate.cnf.in
index 8996849a2c..2281067e8a 100644
--- a/test/ssl-tests/18-dtls-renegotiate.cnf.in
+++ b/test/ssl-tests/18-dtls-renegotiate.cnf.in
@@ -23,7 +23,7 @@ our @tests = ();
foreach my $sctp ("No", "Yes")
{
next if disabled("sctp") && $sctp eq "Yes";
- next if disabled("dtls1_2") && $fips_mode;
+ next if disabled("dtls1_2");
my $suffix = ($sctp eq "No") ? "" : "-sctp";
our @tests_basic = (
diff --git a/test/ssl_ctx_test.c b/test/ssl_ctx_test.c
index 7397ffffa0..ac9b5bb993 100644
--- a/test/ssl_ctx_test.c
+++ b/test/ssl_ctx_test.c
@@ -39,13 +39,15 @@ static const version_test version_testdata[] = {
{ PROTO_TLS, TLS1_2_VERSION, TLS1_1_VERSION, 1, 1, TLS1_2_VERSION, TLS1_1_VERSION },
{ PROTO_TLS, SSL3_VERSION, TLS1_3_VERSION, 0, 1, 0, TLS1_3_VERSION },
{ PROTO_TLS, TLS1_VERSION, TLS1_3_VERSION + 1, 1, 0, TLS1_VERSION, 0 },
-#ifndef OPENSSL_NO_DTLS
+#if !defined(OPENSSL_NO_DTLS) && !defined(OPENSSL_NO_DTLS1_2)
{ PROTO_TLS, DTLS1_VERSION, DTLS1_2_VERSION, 1, 1, 0, 0 },
#endif
{ PROTO_TLS, OSSL_QUIC1_VERSION, OSSL_QUIC1_VERSION, 0, 0, 0, 0 },
{ PROTO_TLS, 7, 42, 0, 0, 0, 0 },
{ PROTO_DTLS, 0, 0, 1, 1, 0, 0 },
+#ifndef OPENSSL_NO_DTLS1_2
{ PROTO_DTLS, DTLS1_VERSION, DTLS1_2_VERSION, 1, 1, DTLS1_VERSION, DTLS1_2_VERSION },
+#endif
{ PROTO_DTLS, DTLS1_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_VERSION, DTLS1_3_VERSION },
{ PROTO_DTLS, DTLS1_2_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_2_VERSION, DTLS1_3_VERSION },
{ PROTO_DTLS, DTLS1_3_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_3_VERSION, DTLS1_3_VERSION },