Commit c059db1feb for openssl.org
commit c059db1feb2e070971836338159f289d9b71880e
Author: Ryan Hooper <ryanh@openssl.foundation>
Date: Tue Aug 11 16:40:14 2026 -0400
DTLS 1.3 Fix no-dtls1_3 build configuration CI failures
Guard the DTLS1_3_VERSION entry in dtls_version_table with
OPENSSL_NO_DTLS1_3 (NULL fallback), matching the pattern used by
tls_version_table for TLS1_3. Add a min_version clamp for DTLS1_3 in
ssl_check_allowed_versions() to fix SSL_CTX_set_min_proto_version()
incorrectly returning failure under no-dtls1_3, caused by DTLS inverted
wire-number ordering making the range check fire after max was clamped to
DTLS1_2. Guard _dtls13 test functions and their ADD_TEST calls in
dtlstest.c. Guard DTLS 1.3-only helpers and tests in
dtlsssllistenertest.c, and move SSL_poll tests outside the DTLS 1.3
guard so they run for any DTLS version. Add no-dtls1_3 to the daily CI
checker matrix.
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Merge-date: Thu Aug 20 09:55:41 2026
Merged-from: https://github.com/openssl/openssl/pull/32340
diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml
index c025cc6d4c..d84c4f3a93 100644
--- a/.github/workflows/run-checker-daily.yml
+++ b/.github/workflows/run-checker-daily.yml
@@ -88,6 +88,7 @@ jobs:
no-dsa,
no-dtls1,
no-dtls1_2,
+ no-dtls1_3,
no-dtls1_2-method,
no-dtls1-method,
enable-ec_nistp_64_gcc_128,
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 4d2838154e..fcc10320aa 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -1905,7 +1905,11 @@ static const version_info tls_version_table[] = {
/* Must be in order high to low */
static const version_info dtls_version_table[] = {
+#ifndef OPENSSL_NO_DTLS1_3
{ DTLS1_3_VERSION, dtlsv1_3_client_method, dtlsv1_3_server_method },
+#else
+ { DTLS1_3_VERSION, NULL, NULL },
+#endif
#ifndef OPENSSL_NO_DTLS1_2
{ DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method },
#else
diff --git a/test/dtlsssllistenertest.c b/test/dtlsssllistenertest.c
index 1505a49aaa..74b5bab2d3 100644
--- a/test/dtlsssllistenertest.c
+++ b/test/dtlsssllistenertest.c
@@ -270,6 +270,7 @@ err:
return ret;
}
+#ifndef OPENSSL_NO_DTLS1_3
/*
* Helper to create a DTLS client with a bound local address.
*
@@ -342,6 +343,7 @@ err:
}
return ret;
}
+#endif /* OPENSSL_NO_DTLS1_3 */
/*
* Helper to create a DTLS listener and client using memory BIOs.
@@ -457,9 +459,7 @@ static int test_dtls_new_listener(void)
SSL *listener = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
/* Create a DTLS listener */
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -486,9 +486,7 @@ static int test_dtls_listener_bio(void)
BIO *bio2 = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -572,9 +570,7 @@ static int test_dtls_get0_listener_non_dtls_listener(void)
SSL *ssl = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
/* Create a DTLS connection object */
if (!TEST_ptr(ssl = SSL_new(ctx)))
@@ -601,9 +597,7 @@ static int test_dtls_get0_listener_listener(void)
SSL *listener = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
/* Create a DTLS listener */
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
@@ -631,9 +625,7 @@ static int test_dtls_listen_basic(void)
SSL *listener = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
goto err;
@@ -656,9 +648,7 @@ static int test_dtls_listen_wrong_type(void)
SSL *ssl = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(ssl = SSL_new(ctx)))
goto err;
@@ -681,9 +671,7 @@ static int test_dtls_accept_connection_wrong_type(void)
SSL *ssl = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(ssl = SSL_new(ctx)))
goto err;
@@ -707,9 +695,7 @@ static int test_dtls_accept_connection_empty_no_block(void)
SSL *listener = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
goto err;
@@ -734,9 +720,7 @@ static int test_dtls_queue_len_wrong_type(void)
SSL *ssl = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(ssl = SSL_new(ctx)))
goto err;
@@ -759,9 +743,7 @@ static int test_dtls_queue_len_empty(void)
SSL *listener = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
goto err;
@@ -787,9 +769,7 @@ static int test_dtls_accept_connection_no_bio_no_block(void)
SSL *conn = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
goto err;
@@ -832,9 +812,7 @@ static int test_dtls_accept_connection_no_bio_block(void)
SSL *conn = NULL;
int success = 0;
- if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method()))
- || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_3_VERSION))
- || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_3_VERSION)))
+ if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
if (!TEST_ptr(listener = SSL_new_listener(ctx, SSL_LISTENER_FLAG_SINGLE_THREAD)))
goto err;
@@ -1394,7 +1372,7 @@ static int test_dtls_concurrent_clients_real_sockets(void)
/* Create server and client contexts */
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_2_VERSION, DTLS1_3_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -2459,6 +2437,7 @@ end:
return testresult;
}
+#ifndef OPENSSL_NO_DTLS1_3
/*
* Test: Three connections with different ownership states.
*
@@ -2662,6 +2641,7 @@ end:
SSL_CTX_free(cctx);
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_3 */
/*
* Test: SSL_set0_rbio with pending connections causes leak.
@@ -3770,6 +3750,7 @@ end:
return testresult;
}
+#ifndef OPENSSL_NO_DTLS1_3
/*
* Test DTLS 1.3 SSL Listener handshake message buffering.
*
@@ -3964,6 +3945,7 @@ end:
SSL_CTX_free(cctx);
return testresult;
}
+#endif /* OPENSSL_NO_DTLS1_3 */
static int test_dtls_listener_max_pending_conns_api(void)
{
@@ -4177,7 +4159,7 @@ static int test_dtls_listener_max_dgram_size_functional(void)
int abortctr = 0;
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
- DTLS_client_method(), DTLS1_3_VERSION, DTLS1_3_VERSION,
+ DTLS_client_method(), 0, 0,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -4238,9 +4220,6 @@ static int test_dtls_listener_max_dgram_size_functional(void)
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
- if (!TEST_int_eq(SSL_version(serverssl), DTLS1_3_VERSION))
- goto end;
-
if (!TEST_true(SSL_write_ex(clientssl, msg, sizeof(msg), &written))
|| !TEST_size_t_eq(written, sizeof(msg)))
goto end;
@@ -4416,7 +4395,7 @@ static int test_pending_conn_cap_enforcement(void)
/* Create SSL contexts */
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_3_VERSION, DTLS1_3_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto err;
@@ -4509,7 +4488,7 @@ static int test_pending_cap_with_timeout(void)
/* Create SSL contexts */
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_3_VERSION, DTLS1_3_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto err;
@@ -4751,7 +4730,7 @@ static int run_new_pending_cb_scenario(uint64_t max_pending, int allow_remaining
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
- DTLS1_3_VERSION, DTLS1_3_VERSION,
+ 0, 0,
&sctx, &cctx, cert, privkey)))
goto err;
@@ -6019,6 +5998,7 @@ int setup_tests(void)
/* Concurrent client tests */
ADD_TEST(test_dtls_concurrent_clients_real_sockets);
+#endif /* OPENSSL_NO_DTLS1_3 */
/* SSL_poll() specific tests */
ADD_TEST(test_dtls_poll_conn_event_w);
@@ -6028,6 +6008,7 @@ int setup_tests(void)
ADD_TEST(test_dtls_poll_conn_event_ec);
ADD_TEST(test_dtls_poll_null_item);
+#ifndef OPENSSL_NO_DTLS1_3
/* Message buffering test */
ADD_TEST(test_dtls13_listener_msg_buffering);
#endif /* OPENSSL_NO_DTLS1_3 */
@@ -6049,7 +6030,9 @@ int setup_tests(void)
/* SSL object ownership tests (run with ASAN to detect leaks/double-frees) */
ADD_TEST(test_ssl_ownership_pending_conn_leak);
ADD_TEST(test_ssl_ownership_incoming_conn_leak);
+#ifndef OPENSSL_NO_DTLS1_3
ADD_TEST(test_ssl_ownership_three_conn_states);
+#endif
ADD_TEST(test_ssl_ownership_set_rbio_pending_leak);
ADD_TEST(test_ssl_ownership_accept_free_no_double_free);
ADD_TEST(test_ssl_ownership_set_rbio_incoming_leak);
diff --git a/test/dtlstest.c b/test/dtlstest.c
index f9cf472f69..f95a02ea91 100644
--- a/test/dtlstest.c
+++ b/test/dtlstest.c
@@ -181,8 +181,10 @@ end:
#define TOTAL_RECORDS (TOTAL_FULL_HAND_RECORDS + TOTAL_RESUME_HAND_RECORDS)
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
+#ifndef OPENSSL_NO_DTLS
static int test_dtls_drop_records(int serverwbio, int minversion, int maxversion,
int doresumption, int epoch, int idx);
+#endif
#ifndef OPENSSL_NO_DTLS1_2
static int test_dtls_drop_records_dtls1(int idx)
{
@@ -256,7 +258,7 @@ static int test_dtls_drop_records_dtls1(int idx)
#define DTLS13_TOTAL_RECORDS \
(DTLS13_TOTAL_HAND_RECORDS_FULL + DTLS13_TOTAL_HAND_RECORDS_RESM)
-#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS)
+#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) && !defined(OPENSSL_NO_DTLS1_3)
/**
* test_dtls_drop_records_dtls13 tests DTLS 1.3 implementation robustness against
* dropped records
@@ -319,6 +321,7 @@ static int test_dtls_drop_records_dtls13(int idx)
}
#endif /* !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) */
+#ifndef OPENSSL_NO_DTLS
static int test_dtls_drop_records(int serverwbio, int minversion, int maxversion,
int doresumption, int epoch, int idx)
{
@@ -436,6 +439,7 @@ end:
return testresult;
}
+#endif /* OPENSSL_NO_DTLS */
#endif /* !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC) */
static int test_cookie(void)
@@ -736,7 +740,8 @@ end:
* Test 2: Test receiving the second fragment of the New Session Ticket before ACK message on client side
* Test 3: Test receiving an app data before ACK and the New Session Ticket messages on client side
*/
-#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM)
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM) \
+ && !defined(OPENSSL_NO_DTLS1_3)
static int test_swap_records_dtls13(int idx)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -851,7 +856,9 @@ end:
}
#endif
+#ifndef OPENSSL_NO_DTLS
static int test_duplicate_app_data(int minversion, int maxversion);
+#endif
#ifndef OPENSSL_NO_DTLS1_2
static int test_duplicate_app_data_dtls1(void)
{
@@ -859,11 +866,14 @@ static int test_duplicate_app_data_dtls1(void)
}
#endif /* OPENSSL_NO_DTLS1_2 */
+#ifndef OPENSSL_NO_DTLS1_3
static int test_duplicate_app_data_dtls13(void)
{
return test_duplicate_app_data(DTLS1_3_VERSION, DTLS1_3_VERSION);
}
+#endif /* OPENSSL_NO_DTLS1_3 */
+#ifndef OPENSSL_NO_DTLS
static int test_duplicate_app_data(int minversion, int maxversion)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -962,6 +972,7 @@ end:
return testresult;
}
+#endif /* OPENSSL_NO_DTLS */
/* Confirm that we can create a connections using DTLSv1_listen() */
#ifndef OPENSSL_NO_DTLS1_2
@@ -1024,7 +1035,7 @@ int setup_tests(void)
#ifndef OPENSSL_NO_DTLS1_2
ADD_ALL_TESTS(test_dtls_drop_records_dtls1, TOTAL_RECORDS);
#endif
-#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS)
+#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHERS) && !defined(OPENSSL_NO_DTLS1_3)
ADD_ALL_TESTS(test_dtls_drop_records_dtls13, DTLS13_TOTAL_RECORDS);
#endif
#endif
@@ -1034,14 +1045,17 @@ int setup_tests(void)
#ifndef OPENSSL_NO_DTLS1_2
ADD_ALL_TESTS(test_swap_records_dtls1, 4);
#endif
-#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM)
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECX) && !defined(OPENSSL_NO_ML_KEM) \
+ && !defined(OPENSSL_NO_DTLS1_3)
ADD_ALL_TESTS(test_swap_records_dtls13, 4);
#endif
#ifndef OPENSSL_NO_DTLS1_2
ADD_TEST(test_listen);
ADD_TEST(test_duplicate_app_data_dtls1);
#endif
+#ifndef OPENSSL_NO_DTLS1_3
ADD_TEST(test_duplicate_app_data_dtls13);
+#endif
return 1;
}
diff --git a/test/ssl_ctx_test.c b/test/ssl_ctx_test.c
index ac9b5bb993..cc5a077ed6 100644
--- a/test/ssl_ctx_test.c
+++ b/test/ssl_ctx_test.c
@@ -50,7 +50,9 @@ static const version_test version_testdata[] = {
#endif
{ PROTO_DTLS, DTLS1_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_VERSION, DTLS1_3_VERSION },
{ PROTO_DTLS, DTLS1_2_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_2_VERSION, DTLS1_3_VERSION },
+#ifndef OPENSSL_NO_DTLS1_3
{ PROTO_DTLS, DTLS1_3_VERSION, DTLS1_3_VERSION, 1, 1, DTLS1_3_VERSION, DTLS1_3_VERSION },
+#endif
#ifndef OPENSSL_NO_DTLS1_2
{ PROTO_DTLS, DTLS1_2_VERSION, DTLS1_2_VERSION, 1, 1, DTLS1_2_VERSION, DTLS1_2_VERSION },
#endif