openssl/test/ssl-tests, branch master

Change all files with OpenSSL License to ASL 2.0 License

2026-10-05T09:34:43Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Dmitry Belyavskiy Reviewed-by: Simo Sorce Reviewed-by: Paul Dale Merge-date: Mon Oct 5 09:34:48 2026 Merged-from: https://github.com/openssl/openssl/pull/33070

More accurate ssl_new curve tests

2026-09-23T14:40:13Z

- Prefer negotiated group value over tmp pkey type heuristic - Drop no longer needed brainpool NID workaround. - Test 14-curves.cnf unless both "ec" and "dh" are disabled. - Expect specific FFDHE group with TLS 1.3 - Specify "DHE" ciphers when testing FFDHE groups with TLS 1.2 - Test ML-KEM-512 hybrids in FIPS mode after version bump to 4.2 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Neil Horman MergeDate: Mon Sep 21 11:52:07 2026 (Merged from https://github.com/openssl/openssl/pull/32670)

ML-KEM-512 hybrid TLS KEMs

2026-09-23T14:40:11Z

Per the new codepoints assigned by IANA for draft-rosomakho-tls-ecdhe-mlkem512-00. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Neil Horman MergeDate: Mon Sep 21 11:52:03 2026 (Merged from https://github.com/openssl/openssl/pull/32670)

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

DTLS 1.3 CI nightly NO DTLS 1.2 Failures Fix

2026-08-25T11:41:26Z

dtlsv1listentest uses DTLSv1_listen(), a DTLS 1.2-only API that crashes when DTLS 1.2 is disabled. Guard the test in build.info under !$disabled{dtls1_2} and add a matching recipe skip so the test is neither compiled nor run when DTLS 1.2 is unavailable. The dtls_ccs_reorder test file is specific to DTLS 1.0/1.2 CCS reordering, which does not apply to DTLS 1.3. The recipe only skipped when all DTLS was disabled, so when both DTLS 1.0 and 1.2 were disabled while DTLS 1.3 remained, the test still ran. Add a recipe skip for when both DTLS 1.0 and DTLS 1.2 are disabled, matching the build.info condition. ssl_ctx_test had two test table entries that set DTLS1_2_VERSION as a max protocol version and expected success. When DTLS 1.2 is disabled that version is not valid for any protocol, so SSL_CTX_set_max_proto_version() returns 0. Guard both entries with #ifndef OPENSSL_NO_DTLS1_2. dtlstest contained a dead #ifdef OPENSSL_NO_DTLS1_2 block inside test_listen(), which is itself wrapped in #ifndef OPENSSL_NO_DTLS1_2. The inner ifdef could never be true; remove it. Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Merge-date: Thu Aug 20 09:55:38 2026 Merged-from: https://github.com/openssl/openssl/pull/32340

DTLS 1.3 Enable Resumption Tests

2026-08-25T11:41:25Z

Enable teh DTLS resumption tests for DTLS1.3. Fixes: openssl/project#1794 Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell MergeDate: Mon Mar 16 11:07:16 2026 (Merged from https://github.com/openssl/openssl/pull/30258)

Update SCTP support fot DTLS1.3

2026-08-25T11:41:25Z

There is a draft RFC for DTLS1.3 over SCTP. This PR does not address that draft RFC. Instead what it does is force DTLS connections over SCTP to downgrade to DTLS1.2. Fixes: openssl/project#1793 Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Tue Mar 3 14:16:12 2026 (Merged from https://github.com/openssl/openssl/pull/30167)

Place start of ClientHello correctly when calculating binder for DTLS 1.3

2026-08-25T11:41:24Z

Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24426)

Adds DTLSv1.3 to protocol_version.pm for additional protocol version tests.

2026-08-25T11:41:24Z

Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23242)

Fix test_ssl_new tests

2026-08-25T11:41:24Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/22275)