openssl/test/dtls_multithread_test.c, branch master

Bring recent comments into line with the STYLE.md comment rules

2026-10-02T08:05:59Z

Comments added by AI-assisted commits over the last three months often narrate the change rather than describe the code: the behaviour being replaced, the alternative not taken, or the bug the test was written for. STYLE.md now says that a comment states what the code does and the constraint it satisfies, and that the reasoning behind a change does not belong in one. Reword those comments to that standard. Reviewed-by: Milan Broz Reviewed-by: Neil Horman Merge-date: Fri Oct 2 08:06:12 2026 Merged-from: https://github.com/openssl/openssl/pull/32779

Fix DTLS listener reset races

2026-09-29T16:24:39Z

Keep listener drive guards and the RX queue alias in SSL_CONNECTION so concurrent listener threads do not access resettable DTLS state during SSL_clear(). Check stable state before d1 and clear the RX alias before freeing its queue. Add focused multithreaded coverage for both SSL_clear() paths and run the race tests in ThreadSanitizer CI. Incorporates changes from #32962. Fixes #32948 Fixes #32949 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi Reviewed-by: Ryan Hooper Merge-date: Tue Sep 29 16:24:45 2026 Merged-from: https://github.com/openssl/openssl/pull/32964

Skip the common test options in dtls_multithread_test

2026-08-25T11:41:26Z

setup_tests() read its two positional arguments without first calling test_skip_common_options(), so the option cursor was never advanced from the test's point of view and test_get_argument(0) returned the option itself. Passing -test or -iter therefore left the certificate path set to the literal string "-test", and the run failed on that: error:80000002:system library:file_ctrl:No such file or directory: ...:calling fopen(-test, r) The option was not being ignored: the framework parses it in process_shared_options() and the selected sub-test really does run. Only the positional arguments were shifted, which is what made the failure look unrelated to the option. Also declare the usage string, so -help describes the two arguments the test needs rather than showing none. Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Ryan Hooper Reviewed-by: Jakub Zelenka Merge-date: Mon Aug 17 08:36:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32331

DTLS 1.3 Support blocking reads on listener connections

2026-08-25T11:41:26Z

A connection created by a DTLS listener has no BIO of its own. The listener owns the socket and demultiplexes datagrams into a per connection queue, so there is nothing for a read to block in, and every read on an empty queue reported WANT_READ however the connection was configured. SSL_set_blocking_mode() therefore had no effect on reads. Wait in the record layer instead, where a blocking BIO would have. When rlayer_dtls_get_urxe_packet() finds the queue empty and the connection is in blocking mode, ossl_dtls_conn_wait_for_datagram() waits for one to arrive. The state machine above is untouched, so SSL_read(), SSL_peek(), SSL_do_handshake() and SSL_accept() all become blocking together, which is what an application moving from a plain DTLS object expects. The wait loops, because the socket is shared: a wakeup may be for a datagram belonging to a different connection, in which case our queue is still empty and there is nothing to return. It also handles events after each wakeup, since while a thread is in here nothing else services the connection, and the retransmission timer has to keep running - the poll translation folds the event timeout into the deadline so the wait ends in time for it. Existing tests drive both ends of a connection from a single thread, which cannot work if the server side blocks, so create_dtls_listener() in dtlsssllistenertest.c now turns blocking mode off for its callers, with create_dtls_listener_unconfigured() for the one test which has to observe the default. test_dtls_multithread opts out for the same reason. The new test_dtls_blocking_read has the client stay silent for a while after its handshake, so the server thread is already parked in SSL_read_ex() when the write finally comes. Its second iteration handshakes in non-blocking mode and switches to blocking only for the read, which pins the read path on its own: in the first iteration the handshake is what fails without this change, and the read is never reached. Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Ryan Hooper Reviewed-by: Jakub Zelenka Merge-date: Mon Aug 17 08:29:57 2026 Merged-from: https://github.com/openssl/openssl/pull/32324

DTLS 1.3 Wait rather than spin in the blocking accept path

2026-08-25T11:41:26Z

SSL_accept_connection() looped calling ossl_dtls_tick() with nothing in between, so it only avoided spinning if the application supplied a blocking network BIO and each tick slept inside BIO_recvmmsg(). A listener cannot require that. It demultiplexes one socket to many connections and ossl_dgram_demux_pump() holds the demux lock across the receive, so a thread blocked in accept stalls reads on every established connection until a datagram for any peer arrives. QUIC takes the opposite approach, keeping the socket non-blocking and waiting for readiness instead. Do the same: set the listener's network BIO non-blocking and wait between ticks via ossl_dtls_block_until_ready(), which reuses SSL_poll()'s blocking machinery. It reads nothing out, so the caller re-tests its own condition and waits again if the wakeup was not for it. Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Ryan Hooper Reviewed-by: Jakub Zelenka Merge-date: Mon Aug 17 08:29:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32324

DTLS 1.3 Limit DTLSv1_listen to DTLS1.2 and add SSL Listener for DTLS

2026-08-25T11:41:25Z

DTLSv1_listen will not support DTLSv1.3. Instead its max version is DTLSv1.2 Adding DTLS SSL Listener that utilizes a similar DEMUX approach as QUIC and passes traffic through the URXE structure. This will establish full connection and an application can ask for a ready SSL connection. The DTLS SSL listener also supports HVR and HRR cookie validation. Fixes: openssl/project#1946 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell MergeDate: Mon Jul 6 09:29:09 2026 (Merged from https://github.com/openssl/openssl/pull/31137)