REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests

The TCP and QUIC crt-list ciphersuites tests require TLSv1.3, which
OpenSSL only supports starting with 1.1.1. Their previous library checks
did not impose this minimum version, allowing the tests to run with
older OpenSSL versions that cannot support the configuration.

Require OpenSSL 1.1.1 or later while retaining AWS-LC support. Keep the
QUIC prerequisites separate from the library check so that AWS-LC does
not bypass the QUIC and backend-support restrictions.

The TCP regression passed with OpenSSL 3.5.5 and the QUIC regression
passed with AWS-LC.

This must be backported wherever commit 38398d2476 ("BUG/MEDIUM: ssl:
crt-list ciphers ignored with AWS-LC") is backported, as far as 3.0.

diff --git a/reg-tests/quic/ssl_crt-list_ciphersuites.vtc b/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
index e69d5390eb5cce194863e199dc35aadb06e2d93f..ecf0bec2f7e678e9ab6e5b60903a47646f856b84 100644 (file)
--- a/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
+++ b/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
@@ -1,7 +1,8 @@
 #REGTEST_TYPE=bug
 varnishtest "Test for per-certificate ciphersuites in a crt-list over QUIC"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL) && !ssllib_name_startswith(LibreSSL) && !ssllib_name_startswith(BoringSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
 # This test checks that the ciphersuites set on a crt-list line are enforced
 # over QUIC, even when the bind line allows more of them.
 # See GitHub issue #3500.

diff --git a/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc b/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
index f622f630b8bd232b7f25c75cf0f5a6a1138ab574..d410f75804c4945dfcbf1ecdf20404b745cf3a08 100644 (file)
--- a/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
+++ b/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
@@ -1,7 +1,7 @@
 #REGTEST_TYPE=bug
 varnishtest "Test for per-certificate ciphersuites in a crt-list"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(LibreSSL) && !ssllib_name_startswith(BoringSSL) && !feature(OPENSSL_WOLFSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
 # This test checks that the ciphersuites set on a crt-list line are enforced,
 # even when the bind line allows more of them.
 # See GitHub issue #3500.