From 01fde2c3cc9012c5e6e329691a47114874a44065 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 29 Apr 2024 17:44:19 +0200 Subject: [PATCH] Force some test cases to use TLS 1.2 Some OpenSSL or GnuTLS interoperability test cases fail if the other implementation is recent enough to support TLS 1.3. Force those test cases to use TLS 1.2 so that the script works with more recent $OPENSSL or $GNUTLS_CLI or $GNUTLS_SERV than our official CI versions. Signed-off-by: Gilles Peskine --- tests/ssl-opt.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 2740415e9a..875b8b8ace 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -3836,7 +3836,7 @@ run_test "Session resume using tickets: openssl server" \ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS run_test "Session resume using tickets: openssl client" \ - "$P_SRV debug_level=3 tickets=1" \ + "$P_SRV force_version=tls12 debug_level=3 tickets=1" \ "( $O_CLI -sess_out $SESSION; \ $O_CLI -sess_in $SESSION; \ rm -f $SESSION )" \ @@ -5675,7 +5675,7 @@ requires_gnutls requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "Renego ext: gnutls client strict, server default" \ "$P_SRV debug_level=3" \ - "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION localhost" \ + "$G_CLI --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%SAFE_RENEGOTIATION localhost" \ 0 \ -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ -s "server hello, secure renegotiation extension" @@ -5684,7 +5684,7 @@ requires_gnutls requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "Renego ext: gnutls client unsafe, server default" \ "$P_SRV debug_level=3" \ - "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ + "$G_CLI --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION localhost" \ 0 \ -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ -S "server hello, secure renegotiation extension" @@ -5693,7 +5693,7 @@ requires_gnutls requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "Renego ext: gnutls client unsafe, server break legacy" \ "$P_SRV debug_level=3 allow_legacy=-1" \ - "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ + "$G_CLI --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION localhost" \ 1 \ -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ -S "server hello, secure renegotiation extension" @@ -7823,7 +7823,7 @@ run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ - "$P_SRV debug_level=1 auth_mode=required" \ + "$P_SRV debug_level=1 force_version=tls12 auth_mode=required" \ "$O_CLI -key data_files/server2.key \ -cert data_files/server2.ku-ke.crt" \ 1 \ @@ -8055,7 +8055,7 @@ run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ - "$P_SRV debug_level=1 auth_mode=required" \ + "$P_SRV debug_level=1 force_version=tls12 auth_mode=required" \ "$O_CLI -key data_files/server5.key \ -cert data_files/server5.eku-cs.crt" \ 1 \