REGTESTS: checks: skip tcp-check-client-hello.vtc under FIPS mode

This test hangs and gets killed after a 10s timeout when run against
an SSL library running in FIPS mode (e.g. AWS-LC-FIPS): backend be1's
check server line uses "curves X25519" to exercise X25519 key-share
routing (group 0x001d), which is rejected at config-parse time by
HAProxy's own FIPS compliance checks (src/fips.c) since X25519 is not
a NIST P-curve. The "h1" haproxy process then fails to start, and
vtest waits on it until its startup timeout kills it with SIGKILL
instead of reporting a clean startup failure.

Skip the test using the fips_mode() config condition predicate.

diff --git a/reg-tests/checks/tcp-check-client-hello.vtc b/reg-tests/checks/tcp-check-client-hello.vtc
index 85dd38991a921834e0f38c4f62237410e0765789..481dbbcdb4368e4b845fafadfe63b6f2f3413add 100644 (file)
--- a/reg-tests/checks/tcp-check-client-hello.vtc
+++ b/reg-tests/checks/tcp-check-client-hello.vtc
@@ -3,6 +3,11 @@
 
 varnishtest "Health checks: test enhanced observability of TLS ClientHello"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(wolfSSL) && !ssllib_name_startswith(LibreSSL) && openssl_version_atleast(1.1.1)'"
+# backend be1's check relies on the "curves X25519" server keyword to
+# exercise X25519 key-share routing (group 0x001d); X25519 is not a
+# NIST P-curve and is rejected by HAProxy's FIPS compliance checks when
+# the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 feature ignore_unknown_macro
 
 syslog S_ok -level notice {