Commit c059db1feb for openssl.org

commit c059db1feb2e070971836338159f289d9b71880e
Author: Ryan Hooper <ryanh@openssl.foundation>
Date:   Tue Aug 11 16:40:14 2026 -0400

    DTLS 1.3 Fix no-dtls1_3 build configuration CI failures

    Guard the DTLS1_3_VERSION entry in dtls_version_table with
    OPENSSL_NO_DTLS1_3 (NULL fallback), matching the pattern used by
    tls_version_table for TLS1_3. Add a min_version clamp for DTLS1_3 in
    ssl_check_allowed_versions() to fix SSL_CTX_set_min_proto_version()
    incorrectly returning failure under no-dtls1_3, caused by DTLS inverted
    wire-number ordering making the range check fire after max was clamped to
    DTLS1_2. Guard _dtls13 test functions and their ADD_TEST calls in
    dtlstest.c. Guard DTLS 1.3-only helpers and tests in
    dtlsssllistenertest.c, and move SSL_poll tests outside the DTLS 1.3
    guard so they run for any DTLS version. Add no-dtls1_3 to the daily CI
    checker matrix.

    Assisted-by: Claude:claude-sonnet-4-6
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Merge-date: Thu Aug 20 09:55:41 2026
    Merged-from: https://github.com/openssl/openssl/pull/32340

diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml
index c025cc6d4c..d84c4f3a93 100644
--- a/.github/workflows/run-checker-daily.yml
+++ b/.github/workflows/run-checker-daily.yml
@@ -88,6 +88,7 @@ jobs:
           no-dsa,
           no-dtls1,
           no-dtls1_2,
+          no-dtls1_3,
           no-dtls1_2-method,
           no-dtls1-method,
           enable-ec_nistp_64_gcc_128,
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 4d2838154e..fcc10320aa 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -1905,7 +1905,11 @@ static const version_info tls_version_table[] = {

 /* Must be in order high to low */
 static const version_info dtls_version_table[] = {
+#ifndef OPENSSL_NO_DTLS1_3
     { DTLS1_3_VERSION, dtlsv1_3_client_method, dtlsv1_3_server_method },
+#else
+    { DTLS1_3_VERSION, NULL, NULL },
+#endif
 #ifndef OPENSSL_NO_DTLS1_2
     { DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method },
 #else
diff --git a/test/dtlsssllistenertest.c b/test/dtlsssllistenertest.c
index 1505a49aaa..74b5bab2d3 100644
--- a/test/dtlsssllistenertest.c
+++ b/test/dtlsssllistenertest.c
@@ -270,6 +270,7 @@ err:
     return ret;
 }

+#ifndef OPENSSL_NO_DTLS1_3
 /*
  * Helper to create a DTLS client with a bound local address.
  *
@@ -342,6 +343,7 @@ err:
     }
     return ret;
 }
+#endif /* OPENSSL_NO_DTLS1_3 */

 /*
  * Helper to create a DTLS listener and client using memory BIOs.
@@ -457,9 +459,7 @@ static int test_dtls_new_listener(void)
     SSL *listener = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     /* Create a DTLS listener */
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -486,9 +486,7 @@ static int test_dtls_listener_bio(void)
     BIO *bio2 = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;

     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -572,9 +570,7 @@ static int test_dtls_get0_listener_non_dtls_listener(void)
     SSL *ssl = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     /* Create a DTLS connection object */
     if (!TEST_ptr(ssl = SSL_new(ctx)))
@@ -601,9 +597,7 @@ static int test_dtls_get0_listener_listener(void)
     SSL *listener = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     /* Create a DTLS listener */
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -631,9 +625,7 @@ static int test_dtls_listen_basic(void)
     SSL *listener = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
         goto err;
@@ -656,9 +648,7 @@ static int test_dtls_listen_wrong_type(void)
     SSL *ssl = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(ssl = SSL_new(ctx)))
         goto err;
@@ -681,9 +671,7 @@ static int test_dtls_accept_connection_wrong_type(void)
     SSL *ssl = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(ssl = SSL_new(ctx)))
         goto err;
@@ -707,9 +695,7 @@ static int test_dtls_accept_connection_empty_no_block(void)
     SSL *listener = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
         goto err;
@@ -734,9 +720,7 @@ static int test_dtls_queue_len_wrong_type(void)
     SSL *ssl = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(ssl = SSL_new(ctx)))
         goto err;
@@ -759,9 +743,7 @@ static int test_dtls_queue_len_empty(void)
     SSL *listener = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
         goto err;
@@ -787,9 +769,7 @@ static int test_dtls_accept_connection_no_bio_no_block(void)
     SSL *conn = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
         goto err;
@@ -832,9 +812,7 @@ static int test_dtls_accept_connection_no_bio_block(void)
     SSL *conn = NULL;
     int success = 0;

-    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
-        || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
-        || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
         goto err;
     if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
         goto err;
@@ -1394,7 +1372,7 @@ static int test_dtls_concurrent_clients_real_sockets(void)
     /* Create server and client contexts */
     if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
             DTLS_client_method(),
-            DTLS1_2_VERSION, DTLS1_3_VERSION,
+            0, 0,
             &sctx, &cctx, cert, privkey)))
         goto end;

@@ -2459,6 +2437,7 @@ end:
     return testresult;
 }

+#ifndef OPENSSL_NO_DTLS1_3
 /*
  * Test: Three connections with different ownership states.
  *
@@ -2662,6 +2641,7 @@ end:
     SSL_CTX_free(cctx);
     return testresult;
 }
+#endif /* OPENSSL_NO_DTLS1_3 */

 /*
  * Test: SSL_set0_rbio with pending connections causes leak.
@@ -3770,6 +3750,7 @@ end:
     return testresult;
 }

+#ifndef OPENSSL_NO_DTLS1_3
 /*
  * Test DTLS 1.3 SSL Listener handshake message buffering.
  *
@@ -3964,6 +3945,7 @@ end:
     SSL_CTX_free(cctx);
     return testresult;
 }
+#endif /* OPENSSL_NO_DTLS1_3 */

 static int test_dtls_listener_max_pending_conns_api(void)
 {
@@ -4177,7 +4159,7 @@ static int test_dtls_listener_max_dgram_size_functional(void)
     int abortctr = 0;

     if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
-            DTLS_client_method(), DTLS1_3_VERSION, DTLS1_3_VERSION,
+            DTLS_client_method(), 0, 0,
             &sctx, &cctx, cert, privkey)))
         goto end;

@@ -4238,9 +4220,6 @@ static int test_dtls_listener_max_dgram_size_functional(void)
     if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
         goto end;

-    if (!TEST_int_eq(SSL_version(serverssl), DTLS1_3_VERSION))
-        goto end;
-
     if (!TEST_true(SSL_write_ex(clientssl, msg, sizeof(msg), &written))
         || !TEST_size_t_eq(written, sizeof(msg)))
         goto end;
@@ -4416,7 +4395,7 @@ static int test_pending_conn_cap_enforcement(void)
     /* Create SSL contexts */
     if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
             DTLS_client_method(),
-            DTLS1_3_VERSION, DTLS1_3_VERSION,
+            0, 0,
             &sctx, &cctx, cert, privkey)))
         goto err;

@@ -4509,7 +4488,7 @@ static int test_pending_cap_with_timeout(void)
     /* Create SSL contexts */
     if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
             DTLS_client_method(),
-            DTLS1_3_VERSION, DTLS1_3_VERSION,
+            0, 0,
             &sctx, &cctx, cert, privkey)))
         goto err;

@@ -4751,7 +4730,7 @@ static int run_new_pending_cb_scenario(uint64_t max_pending, int allow_remaining

     if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
             DTLS_client_method(),
-            DTLS1_3_VERSION, DTLS1_3_VERSION,
+            0, 0,
             &sctx, &cctx, cert, privkey)))
         goto err;

@@ -6019,6 +5998,7 @@ int setup_tests(void)

     /* Concurrent client tests */
     ADD_TEST(test_dtls_concurrent_clients_real_sockets);
+#endif /* OPENSSL_NO_DTLS1_3 */

     /* SSL_poll() specific tests */
     ADD_TEST(test_dtls_poll_conn_event_w);
@@ -6028,6 +6008,7 @@ int setup_tests(void)
     ADD_TEST(test_dtls_poll_conn_event_ec);
     ADD_TEST(test_dtls_poll_null_item);

+#ifndef OPENSSL_NO_DTLS1_3
     /* Message buffering test */
     ADD_TEST(test_dtls13_listener_msg_buffering);
 #endif /* OPENSSL_NO_DTLS1_3 */
@@ -6049,7 +6030,9 @@ int setup_tests(void)
     /* SSL object ownership tests (run with ASAN to detect leaks/double-frees) */
     ADD_TEST(test_ssl_ownership_pending_conn_leak);
     ADD_TEST(test_ssl_ownership_incoming_conn_leak);
+#ifndef OPENSSL_NO_DTLS1_3
     ADD_TEST(test_ssl_ownership_three_conn_states);
+#endif
     ADD_TEST(test_ssl_ownership_set_rbio_pending_leak);
     ADD_TEST(test_ssl_ownership_accept_free_no_double_free);
     ADD_TEST(test_ssl_ownership_set_rbio_incoming_leak);
diff --git a/test/dtlstest.c b/test/dtlstest.c
index f9cf472f69..f95a02ea91 100644
--- a/test/dtlstest.c
+++ b/test/dtlstest.c
@@ -181,8 +181,10 @@ end:
 #define TOTAL_RECORDS (TOTAL_FULL_HAND_RECORDS + TOTAL_RESUME_HAND_RECORDS)

 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
+#ifndef OPENSSL_NO_DTLS
 static int test_dtls_drop_records(int serverwbio, int minversion, int maxversion,
     int doresumption, int epoch, int idx);
+#endif
 #ifndef OPENSSL_NO_DTLS1_2
 static int test_dtls_drop_records_dtls1(int idx)
 {
@@ -256,7 +258,7 @@ static int test_dtls_drop_records_dtls1(int idx)
 #define DTLS13_TOTAL_RECORDS \
     (DTLS13_TOTAL_HAND_RECORDS_FULL + DTLS13_TOTAL_HAND_RECORDS_RESM)

-#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS)
+#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) && !defined(OPENSSL_NO_DTLS1_3)
 /**
  * test_dtls_drop_records_dtls13 tests DTLS 1.3 implementation robustness against
  * dropped records
@@ -319,6 +321,7 @@ static int test_dtls_drop_records_dtls13(int idx)
 }
 #endif /* !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) */

+#ifndef OPENSSL_NO_DTLS
 static int test_dtls_drop_records(int serverwbio, int minversion, int maxversion,
     int doresumption, int epoch, int idx)
 {
@@ -436,6 +439,7 @@ end:

     return testresult;
 }
+#endif /* OPENSSL_NO_DTLS */
 #endif /* !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC) */

 static int test_cookie(void)
@@ -736,7 +740,8 @@ end:
  * Test 2: Test receiving the second fragment of the New Session Ticket before ACK message on client side
  * Test 3: Test receiving an app data before ACK and the New Session Ticket messages on client side
  */
-#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM)
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM) \
+    && !defined(OPENSSL_NO_DTLS1_3)
 static int test_swap_records_dtls13(int idx)
 {
     SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -851,7 +856,9 @@ end:
 }
 #endif

+#ifndef OPENSSL_NO_DTLS
 static int test_duplicate_app_data(int minversion, int maxversion);
+#endif
 #ifndef OPENSSL_NO_DTLS1_2
 static int test_duplicate_app_data_dtls1(void)
 {
@@ -859,11 +866,14 @@ static int test_duplicate_app_data_dtls1(void)
 }
 #endif /* OPENSSL_NO_DTLS1_2 */

+#ifndef OPENSSL_NO_DTLS1_3
 static int test_duplicate_app_data_dtls13(void)
 {
     return test_duplicate_app_data(DTLS1_3_VERSION, DTLS1_3_VERSION);
 }
+#endif /* OPENSSL_NO_DTLS1_3 */

+#ifndef OPENSSL_NO_DTLS
 static int test_duplicate_app_data(int minversion, int maxversion)
 {
     SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -962,6 +972,7 @@ end:

     return testresult;
 }
+#endif /* OPENSSL_NO_DTLS */

 /* Confirm that we can create a connections using DTLSv1_listen() */
 #ifndef OPENSSL_NO_DTLS1_2
@@ -1024,7 +1035,7 @@ int setup_tests(void)
 #ifndef OPENSSL_NO_DTLS1_2
     ADD_ALL_TESTS(test_dtls_drop_records_dtls1, TOTAL_RECORDS);
 #endif
-#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS)
+#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) && !defined(OPENSSL_NO_DTLS1_3)
     ADD_ALL_TESTS(test_dtls_drop_records_dtls13, DTLS13_TOTAL_RECORDS);
 #endif
 #endif
@@ -1034,14 +1045,17 @@ int setup_tests(void)
 #ifndef OPENSSL_NO_DTLS1_2
     ADD_ALL_TESTS(test_swap_records_dtls1, 4);
 #endif
-#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM)
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM) \
+    && !defined(OPENSSL_NO_DTLS1_3)
     ADD_ALL_TESTS(test_swap_records_dtls13, 4);
 #endif
 #ifndef OPENSSL_NO_DTLS1_2
     ADD_TEST(test_listen);
     ADD_TEST(test_duplicate_app_data_dtls1);
 #endif
+#ifndef OPENSSL_NO_DTLS1_3
     ADD_TEST(test_duplicate_app_data_dtls13);
+#endif

     return 1;
 }
diff --git a/test/ssl_ctx_test.c b/test/ssl_ctx_test.c
index ac9b5bb993..cc5a077ed6 100644
--- a/test/ssl_ctx_test.c
+++ b/test/ssl_ctx_test.c
@@ -50,7 +50,9 @@ static const version_test version_testdata[] = {
 #endif
     { PROTO_DTLS, DTLS1_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_VERSION, DTLS1_3_VERSION },
     { PROTO_DTLS, DTLS1_2_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_2_VERSION, DTLS1_3_VERSION },
+#ifndef OPENSSL_NO_DTLS1_3
     { PROTO_DTLS, DTLS1_3_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_3_VERSION, DTLS1_3_VERSION },
+#endif
 #ifndef OPENSSL_NO_DTLS1_2
     { PROTO_DTLS, DTLS1_2_VERSION, DTLS1_2_VERSION, 1, 1, DTLS1_2_VERSION, DTLS1_2_VERSION },
 #endif