From: William Lallemand <wlallemand@haproxy.com>
Date: Thu, 13 Aug 2026 14:27:35 +0000 (+0000)
Subject: REGTESTS: checks: skip tcp-check-client-hello.vtc under FIPS mode
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=03410d0d366f92e13c9e83df8dd76efe96f9f5b5;p=thirdparty%2Fhaproxy.git

REGTESTS: checks: skip tcp-check-client-hello.vtc under FIPS mode

This test hangs and gets killed after a 10s timeout when run against
an SSL library running in FIPS mode (e.g. AWS-LC-FIPS): backend be1's
check server line uses "curves X25519" to exercise X25519 key-share
routing (group 0x001d), which is rejected at config-parse time by
HAProxy's own FIPS compliance checks (src/fips.c) since X25519 is not
a NIST P-curve. The "h1" haproxy process then fails to start, and
vtest waits on it until its startup timeout kills it with SIGKILL
instead of reporting a clean startup failure.

Skip the test using the fips_mode() config condition predicate.
---

diff --git a/reg-tests/checks/tcp-check-client-hello.vtc b/reg-tests/checks/tcp-check-client-hello.vtc
index 85dd38991..481dbbcdb 100644
--- a/reg-tests/checks/tcp-check-client-hello.vtc
+++ b/reg-tests/checks/tcp-check-client-hello.vtc
@@ -3,6 +3,11 @@
 
 varnishtest "Health checks: test enhanced observability of TLS ClientHello"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(wolfSSL) && !ssllib_name_startswith(LibreSSL) && openssl_version_atleast(1.1.1)'"
+# backend be1's check relies on the "curves X25519" server keyword to
+# exercise X25519 key-share routing (group 0x001d); X25519 is not a
+# NIST P-curve and is rejected by HAProxy's FIPS compliance checks when
+# the SSL library is running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 feature ignore_unknown_macro
 
 syslog S_ok -level notice {