cmcfarlen opened a new pull request, #13936: URL: https://github.com/apache/trafficserver/pull/13936
These fixes came from running the Uranium (urtest) suite on RHEL 9-family images, with ATS built against BoringSSL and with a packaged layout. Each one fixes a test, or the harness, that assumed a particular environment. **Harness** - `TestRuntime` now also reads `traffic_layout --versions`, and `ATS.tls_library()` returns the TLS library ATS was built with. When ATS uses BoringSSL, the test clients (`openssl`, curl, Python's `ssl`) are usually still the system OpenSSL, so checking the client's library predicts the wrong server behavior. - `ATS.run` decodes output with `errors="replace"`, so binary data printed by `openssl s_client` (such as an h2 SETTINGS frame) no longer raises `UnicodeDecodeError`. - `test_ats_owns_process_lifecycle` accepts the short socket-path fallback that ATS uses once the default path passes the Unix socket limit. With xdist, a long username or `TMP` is enough to trigger it. **Tests** - `tls_sni_ticket` and `tls_renegotiation`: choose their BoringSSL expectations from `tls_library()`. - `tls_h2_cipher_suite`: under BoringSSL, leave out `@SECLEVEL` (BoringSSL rejects the whole cipher list) and use `ECDHE-RSA-AES128-SHA` as the prohibited CBC suite, since BoringSSL has no SHA-256 CBC suites. - `tls_verify_override*`: accept "self signed certificate" without the hyphen (BoringSSL, OpenSSL < 3). - `tls_bad_alpn`: accept curl < 7.82's "ALPN, server accepted to use h2". - `tls_sni_groups`: pass `-groups X25519MLKEM768` to s_client, since RHEL's crypto policy leaves it out of the default offer. - `tunnel_transform`, `txn_type`, `tls_sni_with_port`: tunnel to `127.0.0.1` instead of `localhost`. HostDB doesn't read `/etc/hosts` by default, so `localhost` depended on the resolver answering it. - `stats_over_http_compression`: `traffic_layout --features` now reports `TS_USE_MALLOC_ALLOCATOR`, and the freelist-based continuation count is skipped when it's set, because the dump has no `INKContAllocator` rows then. - `runroot_verify`: skip when LOGDIR is outside PREFIX; the runroot keeps that directory and the test user can't pass verify's write checks. **Build** - `Findunwind.cmake` takes `libunwind.so` and the header from beside `libunwind-ptrace`. An LLVM toolchain prefix that ships LLVM's libunwind would otherwise win, and `traffic_crashlog`'s remote unwinding fails to compile against it. **Testing** - On master with OpenSSL 3.5 (RHEL 9 aarch64, clang 22, libc++): `-k 'tls or tunnel or txn_type or stats_over_http or runroot or tools'` gives 271 passed, 8 skipped. - The BoringSSL and packaged-layout cases were tested with the same changes on RHEL 9 x86_64 with BoringSSL, where the full suite passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
