maskit opened a new pull request, #13945: URL: https://github.com/apache/trafficserver/pull/13945
## Why `test_tls_client_versions`, `test_tls_client_versions_minmax`, `test_tls_renegotiation` and `test_tls_renegotiation_allowed` pass `--ciphers DEFAULT@SECLEVEL=0` to curl unconditionally. When curl is built against BoringSSL, it rejects the whole cipher list and exits with code 59 (`failed setting cipher list: DEFAULT@SECLEVEL=0`) before the TLS handshake, so all four tests fail regardless of ATS's behavior. CI is unaffected because its curl uses OpenSSL. ## Change - Add `Curl.accepts_seclevel()`, which reads the first line of `curl --version` and returns true only when the active TLS backend is OpenSSL 1.1.0 or later, or quictls. In a curl built with several TLS backends, `curl --version` prints the inactive ones in parentheses, so only the active one is considered. - The four tests append `@SECLEVEL=0` only when curl accepts it, and otherwise pass plain `DEFAULT`, which BoringSSL accepts. This mirrors `00f4de1f90`, which made the same decision for the cipher list ATS is configured with, based on `ATS.tls_library()`. ## Validation - New parametrized unit tests in `tests/tools/uranium/tests/test_services.py` cover OpenSSL, quictls, OpenSSL older than 1.1.0, BoringSSL, and multi-backend builds with the active and inactive backends in both orders. Versions the helper ignores are dummies (`0.0.0`). - The four tests pass on macOS with a BoringSSL-built ATS, both with a BoringSSL-linked curl (all four failed before this change) and with an OpenSSL-linked curl. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
