]> git.kaiwu.me - haproxy.git/commit
REGTESTS: ssl: skip tests broken by FIPS mode
authorWilliam Lallemand <wlallemand@haproxy.com>
Thu, 13 Aug 2026 14:07:14 +0000 (14:07 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Thu, 13 Aug 2026 14:08:06 +0000 (16:08 +0200)
commitc81f65c98987aff1f87b38c4b6c7859e7e73af05
treebd7ac9e0a34cec142a4d6ff4337ecbf2dd8345aa
parent3914af44e0bbc529d431f65bf9e4809f2944d4bf
REGTESTS: ssl: skip tests broken by FIPS mode

Both reg-tests fail when run against an SSL library running in FIPS
mode (e.g. AWS-LC-FIPS), for two distinct reasons:

- tls12_ssl_crt-list_filters.vtc configures the "kRSA" (non-ECDHE)
  TLSv1.2 cipher suite, which is rejected at config-parse time by
  HAProxy's own FIPS compliance checks (src/fips.c).

- ssl_generate_certificate.vtc's P-384 check observes the default
  curve/group (e.g. P-256) instead of the configured secp384r1: the
  "ecdhe" bind keyword does not appear to restrict the negotiated
  curve/group in this mode, reproduced independently of the TLS
  version forced by the client.

Skip both using the newly introduced fips_mode() config condition
predicate rather than disabling them outright, so they keep running
everywhere else.
reg-tests/ssl/ssl_generate_certificate.vtc
reg-tests/ssl/tls12_ssl_crt-list_filters.vtc