[openssl/openssl] b72502: test: don't depend on DTLS alert delivery in sslre...

[Jakub Zelenka]

Branch: refs/heads/openssl-3.6
Home: https://github.com/openssl/openssl
Commit: b72502f24d767f695714f79ceec99d7dbb55bd16
https://github.com/openssl/openssl/commit/b72502f24d767f695714f79ceec99d7dbb55bd16
Author: Jakub Zelenka <jakub....@openssl.foundation>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
M test/recipes/70-test_sslrecords.t
M util/perl/TLSProxy/Proxy.pm

Log Message:
-----------
test: don't depend on DTLS alert delivery in sslrecords test

The unknown-record-type tests (tests 5 and 6) inferred failure of a DTLS
connection from TLSProxy's socket-teardown timing ($proxy_start_success == 0).
This relied on the client's fatal alert reaching the peer before the client
closes its socket, which is a race: DTLS alerts are best-effort and are never
retransmitted (RFC 6347 section 4.2.7 / RFC 9147 section 5.10), and after the
s_client shutdown drain was skipped for datagram protocols the alert can be
lost during teardown, making the test flaky.

Verify instead what is actually under test: that the DTLS client rejected the
unrecognised record type, i.e. that s_client exited with a failure. This is a
deterministic, local decision that does not depend on the alert being observed
by the peer. Keep the alert observation as a best-effort diagnostic note.

Capture the s_client exit status in TLSProxy (previously discarded after
waitpid) and expose it via a new clientexit accessor.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Neil Horman <nho...@openssl.org>
Reviewed-by: Tomas Mraz <to...@openssl.foundation>
MergeDate: Sat Jul 18 12:54:36 2026
(Merged from https://github.com/openssl/openssl/pull/31927)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications