From: William Lallemand <wlallemand@irq6.net>
Date: Fri, 23 Oct 2026 11:50:51 +0000 (+0000)
Subject: REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests
X-Git-Tag: v3.5-dev11~85
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=846930d20d9e76da14629bed3aa91ef6406ec98d;p=haproxy.git

REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests

Four reg-tests deliberately configure cryptographic material that
HAProxy's FIPS compliance checks reject when the SSL library runs in FIPS
mode, so they can never start a configuration there:

  - ssl_ciphersuites.vtc and quic/ssl_ciphersuites.vtc configure the
    TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which is not FIPS-approved;
  - ssl_curves_selection.vtc, quic/ssl_curves_selection.vtc and
    ssl_curve_name.vtc, quic/ssl_curve_name.vtc configure the X25519
    group, which is likewise rejected.

Each then fails while parsing the configuration rather than on the
behaviour under test, which is why ssl_fips_check_ciphersuites(),
ssl_fips_check_curves() and their callers in src/ssl_sock.c exist in the
first place; the rejection is the expected outcome of the check, not a
defect in the test.

Skip those files with the fips_mode() config condition predicate already
used elsewhere in reg-tests/ssl (see "REGTESTS: ssl: skip tests broken by
FIPS mode"), so that they keep running against every non-FIPS SSL library
including OpenSSL and plain AWS-LC, and are only skipped when FIPS is
actually active.
---

diff --git a/reg-tests/quic/ssl_ciphersuites.vtc b/reg-tests/quic/ssl_ciphersuites.vtc
index 71c76fcd3..d7471fb0c 100644
--- a/reg-tests/quic/ssl_ciphersuites.vtc
+++ b/reg-tests/quic/ssl_ciphersuites.vtc
@@ -12,6 +12,10 @@
 varnishtest "Tests for ssl-default-{bind,server}-ciphersuites global option and ciphersuites server and bind options"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+# This test configures the TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which
+# is rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE quic
 include ${testdir}/../ssl/ssl_ciphersuites.vtci
diff --git a/reg-tests/quic/ssl_curve_name.vtc b/reg-tests/quic/ssl_curve_name.vtc
index 6d01b3d23..ba60634cf 100644
--- a/reg-tests/quic/ssl_curve_name.vtc
+++ b/reg-tests/quic/ssl_curve_name.vtc
@@ -3,6 +3,9 @@
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 
 setenv VTC_SOCK_TYPE quic
diff --git a/reg-tests/quic/ssl_curves_selection.vtc b/reg-tests/quic/ssl_curves_selection.vtc
index 4dc00731c..dee0cfbbb 100644
--- a/reg-tests/quic/ssl_curves_selection.vtc
+++ b/reg-tests/quic/ssl_curves_selection.vtc
@@ -12,6 +12,9 @@
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE quic
 include ${testdir}/../ssl/ssl_curves_selection.vtci
diff --git a/reg-tests/ssl/ssl_ciphersuites.vtc b/reg-tests/ssl/ssl_ciphersuites.vtc
index 4eac1ede6..3af6bb027 100644
--- a/reg-tests/ssl/ssl_ciphersuites.vtc
+++ b/reg-tests/ssl/ssl_ciphersuites.vtc
@@ -11,6 +11,10 @@ varnishtest "Tests for ssl-default-{bind,server}-ciphersuites global option and
 # to "wrong-be1" backend must fail contrary to the last one.
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+# This test configures the TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which
+# is rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_ciphersuites.vtci
diff --git a/reg-tests/ssl/ssl_curve_name.vtc b/reg-tests/ssl/ssl_curve_name.vtc
index f73c340e8..f3b46ad2d 100644
--- a/reg-tests/ssl/ssl_curve_name.vtc
+++ b/reg-tests/ssl/ssl_curve_name.vtc
@@ -2,6 +2,9 @@
 
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curve_name.vtci
diff --git a/reg-tests/ssl/ssl_curves_selection.vtc b/reg-tests/ssl/ssl_curves_selection.vtc
index f379ebc92..462d3e736 100644
--- a/reg-tests/ssl/ssl_curves_selection.vtc
+++ b/reg-tests/ssl/ssl_curves_selection.vtc
@@ -11,6 +11,9 @@
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
+# This test configures the X25519 group, which is rejected by HAProxy's
+# FIPS compliance checks when the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curves_selection.vtci