]> git.kaiwu.me - haproxy.git/commit
REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests
authorWilliam Lallemand <wlallemand@irq6.net>
Fri, 23 Oct 2026 11:50:51 +0000 (11:50 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Mon, 2 Nov 2026 08:38:07 +0000 (09:38 +0100)
commit846930d20d9e76da14629bed3aa91ef6406ec98d
treebaedae6bc7ddb6fabbe0903500b783dedfda1b99
parent15c8469518a0d1f2e35266d5951c006b8492029e
REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests

Four reg-tests deliberately configure cryptographic material that
HAProxy's FIPS compliance checks reject when the SSL library runs in FIPS
mode, so they can never start a configuration there:

  - ssl_ciphersuites.vtc and quic/ssl_ciphersuites.vtc configure the
    TLS_CHACHA20_POLY1305_SHA256 ciphersuite, which is not FIPS-approved;
  - ssl_curves_selection.vtc, quic/ssl_curves_selection.vtc and
    ssl_curve_name.vtc, quic/ssl_curve_name.vtc configure the X25519
    group, which is likewise rejected.

Each then fails while parsing the configuration rather than on the
behaviour under test, which is why ssl_fips_check_ciphersuites(),
ssl_fips_check_curves() and their callers in src/ssl_sock.c exist in the
first place; the rejection is the expected outcome of the check, not a
defect in the test.

Skip those files with the fips_mode() config condition predicate already
used elsewhere in reg-tests/ssl (see "REGTESTS: ssl: skip tests broken by
FIPS mode"), so that they keep running against every non-FIPS SSL library
including OpenSSL and plain AWS-LC, and are only skipped when FIPS is
actually active.
reg-tests/quic/ssl_ciphersuites.vtc
reg-tests/quic/ssl_curve_name.vtc
reg-tests/quic/ssl_curves_selection.vtc
reg-tests/ssl/ssl_ciphersuites.vtc
reg-tests/ssl/ssl_curve_name.vtc
reg-tests/ssl/ssl_curves_selection.vtc