REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests

Four reg-tests deliberately configure cryptographic material that
HAProxy's FIPS compliance checks reject when the SSL library runs in FIPS
mode, so they can never start a configuration there:

  - ssl_ciphersuites.vtc and quic/ssl_ciphersuites.vtc configure the
    TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which is not FIPS-approved;
  - ssl_curves_selection.vtc, quic/ssl_curves_selection.vtc and
    ssl_curve_name.vtc, quic/ssl_curve_name.vtc configure the X25519
    group, which is likewise rejected.

Each then fails while parsing the configuration rather than on the
behaviour under test, which is why ssl_fips_check_ciphersuites(),
ssl_fips_check_curves() and their callers in src/ssl_sock.c exist in the
first place; the rejection is the expected outcome of the check, not a
defect in the test.

Skip those files with the fips_mode() config condition predicate already
used elsewhere in reg-tests/ssl (see "REGTESTS: ssl: skip tests broken by
FIPS mode"), so that they keep running against every non-FIPS SSL library
including OpenSSL and plain AWS-LC, and are only skipped when FIPS is
actually active.

diff --git a/reg-tests/quic/ssl_ciphersuites.vtc b/reg-tests/quic/ssl_ciphersuites.vtc
index 71c76fcd364a0423856bda015741f427faddbcfa..d7471fb0cb58af2fccfb9d347ebc35895bf40d5a 100644 (file)
--- a/reg-tests/quic/ssl_ciphersuites.vtc
+++ b/reg-tests/quic/ssl_ciphersuites.vtc
@@ -12,6 +12,10 @@
 varnishtest "Tests for ssl-default-{bind,server}-ciphersuites global option and ciphersuites server and bind options"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+# This test configures the TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which
+# is rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE quic
 include ${testdir}/../ssl/ssl_ciphersuites.vtci

diff --git a/reg-tests/quic/ssl_curve_name.vtc b/reg-tests/quic/ssl_curve_name.vtc
index 6d01b3d2321bdf4eb3231bc9d991cd6738a7516f..ba60634cfb87a4b1dca5a7c46adb6bd6575db71f 100644 (file)
--- a/reg-tests/quic/ssl_curve_name.vtc
+++ b/reg-tests/quic/ssl_curve_name.vtc
@@ -3,6 +3,9 @@
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 
 setenv VTC_SOCK_TYPE quic

diff --git a/reg-tests/quic/ssl_curves_selection.vtc b/reg-tests/quic/ssl_curves_selection.vtc
index 4dc00731c44b3b0ba6167ba23fc719f3b964cca1..dee0cfbbb46179fad1b62315e571fe3c7c62b241 100644 (file)
--- a/reg-tests/quic/ssl_curves_selection.vtc
+++ b/reg-tests/quic/ssl_curves_selection.vtc
@@ -12,6 +12,9 @@
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE quic
 include ${testdir}/../ssl/ssl_curves_selection.vtci

diff --git a/reg-tests/ssl/ssl_ciphersuites.vtc b/reg-tests/ssl/ssl_ciphersuites.vtc
index 4eac1ede63c8285bfd9501ea074fa32a7a6c0840..3af6bb02712a7b3d4077060094a968536211a395 100644 (file)
--- a/reg-tests/ssl/ssl_ciphersuites.vtc
+++ b/reg-tests/ssl/ssl_ciphersuites.vtc
@@ -11,6 +11,10 @@ varnishtest "Tests for ssl-default-{bind,server}-ciphersuites global option and
 # to "wrong-be1" backend must fail contrary to the last one.
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+# This test configures the TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which
+# is rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_ciphersuites.vtci

diff --git a/reg-tests/ssl/ssl_curve_name.vtc b/reg-tests/ssl/ssl_curve_name.vtc
index f73c340e83db684da8ab178348ebaf697571b5d5..f3b46ad2d644019cc423c31ec3d1f60d9e9e9482 100644 (file)
--- a/reg-tests/ssl/ssl_curve_name.vtc
+++ b/reg-tests/ssl/ssl_curve_name.vtc
@@ -2,6 +2,9 @@
 
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curve_name.vtci

diff --git a/reg-tests/ssl/ssl_curves_selection.vtc b/reg-tests/ssl/ssl_curves_selection.vtc
index f379ebc92fb40f5aafbe6e8e7011af4d39aea91e..462d3e736c1b174f6e9f36143c00a7c76edd2cbe 100644 (file)
--- a/reg-tests/ssl/ssl_curves_selection.vtc
+++ b/reg-tests/ssl/ssl_curves_selection.vtc
@@ -11,6 +11,9 @@
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curves_selection.vtci