[openssl/openssl] b5f0da: test: assert the specific alert in DTLS sslrecords...

[Jakub Zelenka]

Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: b5f0da4c9412202bc546555f0e7f459ee427a791
https://github.com/openssl/openssl/commit/b5f0da4c9412202bc546555f0e7f459ee427a791
Author: Jakub Zelenka <jakub....@openssl.foundation>
Date: 2026-09-10 (Thu, 10 Sep 2026)

Changed paths:
M test/recipes/70-test_sslrecords.t
M util/perl/TLSProxy/Proxy.pm

Log Message:
-----------
test: assert the specific alert in DTLS sslrecords tests

The DTLS unknown-record-type tests in 70-test_sslrecords.t checked only
that s_client exited non-zero, which does not distinguish a genuine
rejection of the record from an unrelated failure (or a crash).

Capture s_client's stdout+stderr in TLSProxy and parse the alerts it
logs via the -msg message callback, exposing them through new accessors:
clientoutput, client_alerts and client_sent_fatal_alert(). The check
reflects the alert s_client generated locally and so does not depend on
the peer receiving it, keeping the test deterministic.

In the DTLS cases add -msg to the client flags and assert that s_client
generated the fatal unexpected_message alert and exited cleanly with a
failure, using a new client_failed() helper that decodes the child
status so a signal death is not mistaken for a rejection. On failure
the captured client output is dumped for diagnostics.

Assisted-by: Claude:claude-fable-5

Reviewed-by: Tomas Mraz <to...@openssl.foundation>
Reviewed-by: Ryan Hooper <ry...@openssl.foundation>
Reviewed-by: Neil Horman <nho...@openssl.org>
MergeDate: Thu Sep 10 21:33:34 2026
(Merged from https://github.com/openssl/openssl/pull/32135)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications