openssl/test/statem_clnt_construct_test.c, branch dependabot/github_actions/actions/setup-python-7

Fix missing NULL check in statem_clnt_construct_test

2026-07-23T08:24:01Z

Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695905 Reviewed-by: Milan Broz Reviewed-by: Andrew Dinh Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Thu Jul 23 08:24:25 2026 (Merged from https://github.com/openssl/openssl/pull/31992)

statem: test tls_construct_client_certificate

2026-07-20T09:11:36Z

Exercise the certificate output functions under mfail with real key material embedded in the test: an x509 chain over TLS 1.3 and an RPK over TLS 1.2. Add deterministic tests for the error branches mfail cannot reach: an unknown certificate type, a failed write-key change, and WPACKET failures writing the TLS 1.3 context. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 09:11:48 2026 (Merged from https://github.com/openssl/openssl/pull/31861)

statem: test tls_construct_end_of_early_data

2026-07-20T09:11:36Z

Cover the success path (state advances to FINISHED_WRITING, empty body) and the invalid-state error path. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 09:11:47 2026 (Merged from https://github.com/openssl/openssl/pull/31861)

statem: generalize statem_clnt construct test helpers

2026-07-20T09:11:36Z

Parameterize prime_ssl() by message type and extract a generic finish_msg() so the scaffolding is reusable by other client construct tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 09:11:45 2026 (Merged from https://github.com/openssl/openssl/pull/31861)

test: drop no-cached-fetch mfail guards

2026-07-13T09:43:40Z

Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Mon Jul 13 09:43:51 2026 (Merged from https://github.com/openssl/openssl/pull/31780)

Fix new statem_clnt_test when dtls is disabled

2026-07-06T09:42:17Z

The new statem client tests added in comimt c36a9b4 assume that if OPENSSL_NO_DTLS is not defined, that we have DTLS support, but we have this odd setup in which we can have DTLS enabled, but DTLS1_2 disabled, in which case the needed support isn't present, and the test fails. why we have it setup that way, I'm not sure, but we should only run the dtls tests if both DTLS and DTLS1_2 support is available. Fixes #31851 Reviewed-by: Milan Broz Reviewed-by: Matt Caswell MergeDate: Mon Jul 6 09:42:44 2026 (Merged from https://github.com/openssl/openssl/pull/31582)

statem: add direct tests for tls_construct_client_hello

2026-06-30T08:54:38Z

Add a new test which calls tls_construct_client_hello() directly, creating an SSL_CONNECTION enough to invoke the construct function without making a full handshake, then verifies the produced ClientHello structurally and by round-tripping it through the server-side tls_process_client_hello(). The covered branches include TLS 1.3 (with and without middlebox compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS cookie and client_random reuse paths, the deterministic error branches (WPACKET overflow and no usable ciphers), and the ECH wrapper path (happy path with server-side decryption, the TLS 1.2 version error, and OOM). Out-of-memory branches are exercised with the mfail tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz Reviewed-by: Daniel Kubec MergeDate: Tue Jun 30 08:54:48 2026 (Merged from https://github.com/openssl/openssl/pull/31618)