Mercurial > hg > nginx-tests
changeset 1967:0a93f101925a
Tests: sigalgs handling with Net::SSLeay with LibreSSL.
LibreSSL does not provide a way to configure signature algorithms, and
this makes it impossible to request a particular server certificate
when using TLSv1.3. As such, relevant tests fail if Net::SSLeay is compiled
with LibreSSL. Notably, this affects macOS, where Net::SSLeay compiled
with LibreSSL is shipped with the OS.
Fix is to mark relevant tests as TODO if Net:SSLeay is compiled with
LibreSSL, similarly to what we already do for sigalg issues in LibreSSL
on the server side.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Mon, 06 May 2024 00:01:53 +0300 |
parents | c924ae8d7104 |
children | b72a8c4a1bef |
files | ssl_certificates.t ssl_stapling.t |
diffstat | 2 files changed, 15 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/ssl_certificates.t Mon May 06 00:01:46 2024 +0300 +++ b/ssl_certificates.t Mon May 06 00:01:53 2024 +0300 @@ -99,8 +99,16 @@ } +TODO: { +local $TODO = 'no TLSv1.3 sigalgs in Net::SSLeay (LibreSSL)' + if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") + && !$t->has_module('LibreSSL') + && test_tls13(); + like(cert('ECDSA'), qr/CN=ec/, 'ssl cert ECDSA'); +} + ############################################################################### sub test_tls13 {
--- a/ssl_stapling.t Mon May 06 00:01:46 2024 +0300 +++ b/ssl_stapling.t Mon May 06 00:01:53 2024 +0300 @@ -262,6 +262,8 @@ TODO: { local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' if $t->has_module('LibreSSL') && test_tls13(); +local $TODO = 'no TLSv1.3 sigalgs in Net::SSLeay (LibreSSL)' + if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") && test_tls13(); ok(staple(8443, 'ECDSA'), 'staple success'); @@ -272,6 +274,8 @@ TODO: { local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' if $t->has_module('LibreSSL') && test_tls13(); +local $TODO = 'no TLSv1.3 sigalgs in Net::SSLeay (LibreSSL)' + if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") && test_tls13(); ok(staple(8444, 'ECDSA'), 'responder success'); @@ -288,7 +292,9 @@ TODO: { local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' - if $t->has_module('LibreSSL') && test_tls13(); + if $t->has_module('LibreSSL') + && !Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") + && test_tls13(); like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');