REGTESTS: ssl: skip tests broken by FIPS mode

Both reg-tests fail when run against an SSL library running in FIPS
mode (e.g. AWS-LC-FIPS), for two distinct reasons:

- tls12_ssl_crt-list_filters.vtc configures the "kRSA" (non-ECDHE)
  TLSv1.2 cipher suite, which is rejected at config-parse time by
  HAProxy's own FIPS compliance checks (src/fips.c).

- ssl_generate_certificate.vtc's P-384 check observes the default
  curve/group (e.g. P-256) instead of the configured secp384r1: the
  "ecdhe" bind keyword does not appear to restrict the negotiated
  curve/group in this mode, reproduced independently of the TLS
  version forced by the client.

Skip both using the newly introduced fips_mode() config condition
predicate rather than disabling them outright, so they keep running
everywhere else.

diff --git a/reg-tests/ssl/ssl_generate_certificate.vtc b/reg-tests/ssl/ssl_generate_certificate.vtc
index 53f81c780a6a5110cc9946b1d244b5f90efd95d8..3144d6e914abdecbc77dfcef26eb47133e528a22 100644 (file)
--- a/reg-tests/ssl/ssl_generate_certificate.vtc
+++ b/reg-tests/ssl/ssl_generate_certificate.vtc
@@ -17,6 +17,12 @@
 varnishtest "Test the 'generate-certificates' SSL option"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(wolfSSL)'"
 feature cmd "command -v openssl && command -v grep"
+# The "ecdhe" bind keyword does not appear to restrict the negotiated
+# curve/group when the SSL library is running in FIPS mode: the P-384
+# check below observes the default group (e.g. P-256) instead of the
+# configured secp384r1, regardless of the TLS version forced by the
+# client.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 feature ignore_unknown_macro
 
 server s1 -repeat 6 {

diff --git a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
index fc679646040b69ce0ec50eef539fe85b6066577a..94a3b61aa6d0ca35b9e6d49fcee935f6a46af05d 100644 (file)
--- a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
@@ -2,6 +2,10 @@
 varnishtest "Test for ECDSA/RSA selection and crt-list filters"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
+# This test relies on the "kRSA" (non-ECDHE) TLSv1.2 cipher suite, which is
+# rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 # This test checks if the multiple certificate types works correctly with the
 # SNI, and that the negative filters are correctly excluded
 #