cmcfarlen opened a new pull request, #13942:
URL: https://github.com/apache/trafficserver/pull/13942
Follow-up to #13936.
`test_tls_client_versions` and `test_tls_client_versions_minmax` append
`@SECLEVEL=0` to ATS's `proxy.config.ssl.server.cipher_suite` when the
*client's* `openssl version` is 3.x or later. When ATS is built with BoringSSL
and the clients still use the system OpenSSL 3, BoringSSL rejects the directive
(`INVALID_COMMAND`), and with it the whole list. ATS logs `invalid cipher suite
in records.yaml` and then fails every handshake with `NULL_SSL_CTX`.
That used to stay hidden, because the failed TLS 1.0 probe made the test
skip ("the runtime TLS stack cannot complete a TLS 1.0 handshake"). With the
`diags.log` error check, `test_tls_client_versions` now fails at teardown
instead.
Both tests now make the decision from `ATS.tls_library()`. BoringSSL reports
itself as OpenSSL 1.1.1, so it never gets the directive. The unused
`openssl_version` parameter of `configure_ats()` is removed. The other
`@SECLEVEL` uses in the suite are on the client side and are unaffected.
**Testing:** both tests pass without skipping on RHEL 9 x86_64 with ATS on
BoringSSL (no `ERROR` lines in `diags.log`) and on RHEL 9 aarch64 with OpenSSL
3.5.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
