From: William Lallemand <wlallemand@haproxy.com>
Date: Thu, 13 Aug 2026 14:07:14 +0000 (+0000)
Subject: REGTESTS: ssl: skip tests broken by FIPS mode
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c81f65c98987aff1f87b38c4b6c7859e7e73af05;p=thirdparty%2Fhaproxy.git

REGTESTS: ssl: skip tests broken by FIPS mode

Both reg-tests fail when run against an SSL library running in FIPS
mode (e.g. AWS-LC-FIPS), for two distinct reasons:

- tls12_ssl_crt-list_filters.vtc configures the "kRSA" (non-ECDHE)
  TLSv1.2 cipher suite, which is rejected at config-parse time by
  HAProxy's own FIPS compliance checks (src/fips.c).

- ssl_generate_certificate.vtc's P-384 check observes the default
  curve/group (e.g. P-256) instead of the configured secp384r1: the
  "ecdhe" bind keyword does not appear to restrict the negotiated
  curve/group in this mode, reproduced independently of the TLS
  version forced by the client.

Skip both using the newly introduced fips_mode() config condition
predicate rather than disabling them outright, so they keep running
everywhere else.
---

diff --git a/reg-tests/ssl/ssl_generate_certificate.vtc b/reg-tests/ssl/ssl_generate_certificate.vtc
index 53f81c780..3144d6e91 100644
--- a/reg-tests/ssl/ssl_generate_certificate.vtc
+++ b/reg-tests/ssl/ssl_generate_certificate.vtc
@@ -17,6 +17,12 @@
 varnishtest "Test the 'generate-certificates' SSL option"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(wolfSSL)'"
 feature cmd "command -v openssl && command -v grep"
+# The "ecdhe" bind keyword does not appear to restrict the negotiated
+# curve/group when the SSL library is running in FIPS mode: the P-384
+# check below observes the default group (e.g. P-256) instead of the
+# configured secp384r1, regardless of the TLS version forced by the
+# client.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 feature ignore_unknown_macro
 
 server s1 -repeat 6 {
diff --git a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
index fc6796460..94a3b61aa 100644
--- a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
@@ -2,6 +2,10 @@
 varnishtest "Test for ECDSA/RSA selection and crt-list filters"
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.8)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) || feature(OPENSSL_AWSLC)'"
+# This test relies on the "kRSA" (non-ECDHE) TLSv1.2 cipher suite, which is
+# rejected by HAProxy's FIPS compliance checks when the SSL library is
+# running in FIPS mode.
+feature cmd "$HAPROXY_PROGRAM -cc '!fips_mode()'"
 # This test checks if the multiple certificate types works correctly with the
 # SNI, and that the negative filters are correctly excluded
 #