REGTESTS: quic: tls13_ssl_crt-list_filters.vtc supported by QUIC

ssl/tls13_ssl_crt-list_filters.vtc was renamed to ssl/tls13_ssl_crt-list_filters.vtci
to produce a common part runnable both for QUIC and TCP listeners.
Then tls13_ssl_crt-list_filters.vtc files were created both under ssl and quic directories
to call this .vtci file with correct VTC_SOCK_TYPE environment values
("quic" for QUIC listeners and "stream" for TCP listeners);

diff --git a/reg-tests/quic/tls13_ssl_crt-list_filters.vtc b/reg-tests/quic/tls13_ssl_crt-list_filters.vtc
new file mode 100644 (file)
index 0000000..561493f
--- /dev/null
+++ b/reg-tests/quic/tls13_ssl_crt-list_filters.vtc
@@ -0,0 +1,11 @@
+#REGTEST_TYPE=bug
+varnishtest "Test for ECDSA/RSA selection and crt-list filters"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
+# This test checks if the multiple certificate types works correctly with the
+# SNI, and that the negative filters are correctly excluded
+#
+# The selection is done with ciphers with the sigalgs in TLSv1.3
+
+setenv VTC_SOCK_TYPE quic
+include ${testdir}/../ssl/tls13_ssl_crt-list_filters.vtci

diff --git a/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc
index 174f3147e25d64b33eb52fe6d0504c3cda3e7aa9..903cd42a61b1b9699a7b84bf2b22140b8a38363b 100644 (file)
--- a/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc
@@ -6,83 +6,6 @@ feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(Op
 # SNI, and that the negative filters are correctly excluded
 #
 # The selection is done with ciphers with the sigalgs in TLSv1.3
-#
-feature ignore_unknown_macro
-
-server s1 -repeat 6 {
-    rxreq
-    txresp
-} -start
-
-haproxy h1 -conf {
-    global
-    .if feature(THREAD)
-        thread-groups 1
-    .endif
-
-    .if !ssllib_name_startswith(AWS-LC)
-        tune.ssl.default-dh-param 2048
-    .endif
-        crt-base ${testdir}/certs
-        stats socket "${tmpdir}/h1/stats" level admin
-
-    defaults
-        mode http
-        option httplog
-        retries 0
-        log stderr local0 debug err
-        option logasap
-        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
-        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
-        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
-
-
-    listen clear-lst
-        bind "fd@${clearlst}"
-        balance roundrobin
-
-        http-response add-header x-ssl-sha1    '%[ssl_s_sha1,hex]'
-        http-response add-header x-ssl-keyalg  '%[ssl_s_key_alg]'
-        server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256:ecdsa_secp384r1_sha384
-        server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
-        server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs ecdsa_secp384r1_sha384
-        server s4 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug818.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
-
-    listen ssl-lst
-        mode http
-        bind "${tmpdir}/ssl.sock" ssl strict-sni ssl-min-ver TLSv1.3 ssl-max-ver TLSv1.3  crt-list ${testdir}/certs/filters.crt-list
-        server s1 ${s1_addr}:${s1_port}
-} -start
-
-# ECDSA/RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
-} -run
-
-# RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the RSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "rsaEncryption"
-} -run
-
-
-# ECDSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
-} -run
 
-# RSA sigalgs + TLSv1.3 + another-record.bug818.domain.tld must fail because
-# this domain is not available with RSA
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 503
-} -run
+setenv VTC_SOCK_TYPE stream
+include ${testdir}/tls13_ssl_crt-list_filters.vtci

diff --git a/reg-tests/ssl/tls13_ssl_crt-list_filters.vtci b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtci
new file mode 100644 (file)
index 0000000..487ebc9
--- /dev/null
+++ b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtci
@@ -0,0 +1,83 @@
+feature ignore_unknown_macro
+
+server s1 -repeat 6 {
+    rxreq
+    txresp
+} -start
+
+haproxy h1 -conf {
+    global
+    .if streq("$VTC_SOCK_TYPE",quic)
+        # required for backend connections
+        expose-experimental-directives
+    .endif
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    .if !ssllib_name_startswith(AWS-LC)
+        tune.ssl.default-dh-param 2048
+    .endif
+        crt-base ${testdir}/certs
+        stats socket "${tmpdir}/h1/stats" level admin
+
+    defaults
+        mode http
+        option httplog
+        retries 0
+        log stderr local0 debug err
+        option logasap
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+
+    listen clear-lst
+        bind "fd@${clearlst}"
+        balance roundrobin
+
+        http-response add-header x-ssl-sha1    '%[ssl_s_sha1,hex]'
+        http-response add-header x-ssl-keyalg  '%[ssl_s_key_alg]'
+        server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256:ecdsa_secp384r1_sha384
+        server s2 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
+        server s3 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs ecdsa_secp384r1_sha384
+        server s4 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(another-record.bug818.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
+
+    listen ssl-lst
+        mode http
+        bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl strict-sni ssl-min-ver TLSv1.3 ssl-max-ver TLSv1.3  crt-list ${testdir}/certs/filters.crt-list
+        server s1 ${s1_addr}:${s1_port}
+} -start
+
+# ECDSA/RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
+} -run
+
+# RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the RSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "rsaEncryption"
+} -run
+
+
+# ECDSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
+} -run
+
+# RSA sigalgs + TLSv1.3 + another-record.bug818.domain.tld must fail because
+# this domain is not available with RSA
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 503
+} -run