From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 13 Oct 2026 12:16:01 +0000 (+0000)
Subject: REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests
X-Git-Tag: v3.5-dev9~26
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=50f1285b484c891787c5c1ea919e4d4b1f7c9eb2;p=haproxy.git

REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests

The TCP and QUIC crt-list ciphersuites tests require TLSv1.3, which
OpenSSL only supports starting with 1.1.1. Their previous library checks
did not impose this minimum version, allowing the tests to run with
older OpenSSL versions that cannot support the configuration.

Require OpenSSL 1.1.1 or later while retaining AWS-LC support. Keep the
QUIC prerequisites separate from the library check so that AWS-LC does
not bypass the QUIC and backend-support restrictions.

The TCP regression passed with OpenSSL 3.5.5 and the QUIC regression
passed with AWS-LC.

This must be backported wherever commit 38398d2476 ("BUG/MEDIUM: ssl:
crt-list ciphers ignored with AWS-LC") is backported, as far as 3.0.
---

diff --git a/reg-tests/quic/ssl_crt-list_ciphersuites.vtc b/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
index e69d5390e..ecf0bec2f 100644
--- a/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
+++ b/reg-tests/quic/ssl_crt-list_ciphersuites.vtc
@@ -1,7 +1,8 @@
 #REGTEST_TYPE=bug
 varnishtest "Test for per-certificate ciphersuites in a crt-list over QUIC"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL) && !ssllib_name_startswith(LibreSSL) && !ssllib_name_startswith(BoringSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
 # This test checks that the ciphersuites set on a crt-list line are enforced
 # over QUIC, even when the bind line allows more of them.
 # See GitHub issue #3500.
diff --git a/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc b/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
index f622f630b..d410f7580 100644
--- a/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
+++ b/reg-tests/ssl/ssl_crt-list_ciphersuites.vtc
@@ -1,7 +1,7 @@
 #REGTEST_TYPE=bug
 varnishtest "Test for per-certificate ciphersuites in a crt-list"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(LibreSSL) && !ssllib_name_startswith(BoringSSL) && !feature(OPENSSL_WOLFSSL)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
 # This test checks that the ciphersuites set on a crt-list line are enforced,
 # even when the bind line allows more of them.
 # See GitHub issue #3500.