MINOR: ssl: Split ssl_crt-list_filters.vtc in two files by TLS version

Seperate the section from ssl_crt-list_filters.vtc which supports TLS 1.2 and 1.3
versions to produce tls12_ssl_crt-list_filters.vtc and tls13_ssl_crt-list_filters.vtc.

diff --git a/reg-tests/ssl/ssl_crt-list_filters.vtc b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
similarity index 58%
rename from reg-tests/ssl/ssl_crt-list_filters.vtc
rename to reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
index 19921f38f45a939e7a931b9258ae12f840d266cc..fc679646040b69ce0ec50eef539fe85b6066577a 100644 (file)
--- a/reg-tests/ssl/ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
@@ -5,7 +5,7 @@ feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(Op
 # This test checks if the multiple certificate types works correctly with the
 # SNI, and that the negative filters are correctly excluded
 #
-# The selection is done with ciphers in TLSv1.2 and with the sigalgs in TLSv1.3
+# The selection is done with ciphers in TLSv1.2
 #
 feature ignore_unknown_macro
 
@@ -44,32 +44,16 @@ haproxy h1 -conf {
         http-response add-header x-ssl-sha1    '%[ssl_s_sha1,hex]'
         http-response add-header x-ssl-keyalg  '%[ssl_s_key_alg]'
 
-## TLSv1.2
-
         server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2 ciphers "kRSA"
         server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2 ciphers "aECDSA"
-
         server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug818.domain.tld) ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2 ciphers "kRSA"
 
-## TLSv1.3
-
-        server s4 "${tmpdir}/ssl2.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256:ecdsa_secp384r1_sha384
-        server s5 "${tmpdir}/ssl2.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
-        server s6 "${tmpdir}/ssl2.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs ecdsa_secp384r1_sha384
-
-        server s7 "${tmpdir}/ssl2.sock" ssl verify none sni str(another-record.bug818.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
-
-
     listen ssl-lst
         mode http
         bind "${tmpdir}/ssl.sock"  ssl strict-sni ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2  crt-list ${testdir}/certs/filters.crt-list
-        bind "${tmpdir}/ssl2.sock" ssl strict-sni ssl-min-ver TLSv1.3 ssl-max-ver TLSv1.3  crt-list ${testdir}/certs/filters.crt-list
-
         server s1 ${s1_addr}:${s1_port}
 } -start
 
-## TLSv1.2
-
 # RSA + TLSv1.2 + another-record.bug810.domain.tld OK
 client c1 -connect ${h1_clearlst_sock} {
     txreq
@@ -93,38 +77,3 @@ client c1 -connect ${h1_clearlst_sock} {
     rxresp
     expect resp.status == 503
 } -run
-
-## TLSv1.3
-
-# ECDSA/RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
-} -run
-
-# RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the RSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "rsaEncryption"
-} -run
-
-
-# ECDSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 200
-    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
-} -run
-
-# RSA sigalgs + TLSv1.3 + another-record.bug818.domain.tld must fail because
-# this domain is not available with RSA
-client c1 -connect ${h1_clearlst_sock} {
-    txreq
-    rxresp
-    expect resp.status == 503
-} -run

diff --git a/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc
new file mode 100644 (file)
index 0000000..174f314
--- /dev/null
+++ b/reg-tests/ssl/tls13_ssl_crt-list_filters.vtc
@@ -0,0 +1,88 @@
+#REGTEST_TYPE=bug
+varnishtest "Test for ECDSA/RSA selection and crt-list filters"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
+# This test checks if the multiple certificate types works correctly with the
+# SNI, and that the negative filters are correctly excluded
+#
+# The selection is done with ciphers with the sigalgs in TLSv1.3
+#
+feature ignore_unknown_macro
+
+server s1 -repeat 6 {
+    rxreq
+    txresp
+} -start
+
+haproxy h1 -conf {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    .if !ssllib_name_startswith(AWS-LC)
+        tune.ssl.default-dh-param 2048
+    .endif
+        crt-base ${testdir}/certs
+        stats socket "${tmpdir}/h1/stats" level admin
+
+    defaults
+        mode http
+        option httplog
+        retries 0
+        log stderr local0 debug err
+        option logasap
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+
+    listen clear-lst
+        bind "fd@${clearlst}"
+        balance roundrobin
+
+        http-response add-header x-ssl-sha1    '%[ssl_s_sha1,hex]'
+        http-response add-header x-ssl-keyalg  '%[ssl_s_key_alg]'
+        server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256:ecdsa_secp384r1_sha384
+        server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
+        server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug810.domain.tld) ssl-min-ver TLSv1.3 sigalgs ecdsa_secp384r1_sha384
+        server s4 "${tmpdir}/ssl.sock" ssl verify none sni str(another-record.bug818.domain.tld) ssl-min-ver TLSv1.3 sigalgs rsa_pss_rsae_sha384:rsa_pkcs1_sha256
+
+    listen ssl-lst
+        mode http
+        bind "${tmpdir}/ssl.sock" ssl strict-sni ssl-min-ver TLSv1.3 ssl-max-ver TLSv1.3  crt-list ${testdir}/certs/filters.crt-list
+        server s1 ${s1_addr}:${s1_port}
+} -start
+
+# ECDSA/RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
+} -run
+
+# RSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the RSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "rsaEncryption"
+} -run
+
+
+# ECDSA sigalgs + TLSv1.3 + another-record.bug810.domain.tld should return the ECDSA cert
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-keyalg == "id-ecPublicKey"
+} -run
+
+# RSA sigalgs + TLSv1.3 + another-record.bug818.domain.tld must fail because
+# this domain is not available with RSA
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 503
+} -run